lightnow-cli 1.0.5__tar.gz → 1.2.0__tar.gz

lightnow_cli-1.2.0/.github/workflows/release-please.yml

@@ -0,0 +1,24 @@
+name: Release Please
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    name: Open or tag release PR
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Run Release Please
+        uses: googleapis/release-please-action@v4
+        with:
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json

lightnow_cli-1.2.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "1.2.0"
+}

lightnow_cli-1.2.0/CHANGELOG.md

@@ -0,0 +1,58 @@
+# Changelog
+
+All notable changes to the LightNow CLI are documented here.
+
+This project follows semantic versioning.
+
+## [1.2.0](https://github.com/lightnow-ai/lightnow-cli/compare/v1.1.0...v1.2.0) (2026-07-12)
+
+
+### Features
+
+* **#5:** support runtime Vault bindings ([7750c27](https://github.com/lightnow-ai/lightnow-cli/commit/7750c27b87567012eadb6e96a934a25d5d205b0e))
+* **secrets:** support runtime Vault bindings ([7cacff6](https://github.com/lightnow-ai/lightnow-cli/commit/7cacff66c162c1c320fef5195c6acd0f3a77ca45))
+
+
+### Bug Fixes
+
+* **#4:** fix/empty mcp server sync ([a2865bf](https://github.com/lightnow-ai/lightnow-cli/commit/a2865bf21ba7fba7b7bb7115388ad45f153c3280))
+* **sync:** handle empty MCP server profiles ([065d940](https://github.com/lightnow-ai/lightnow-cli/commit/065d940ea0d7a4016705a8fb124ebdc07d204a7f))
+
+## [1.1.0](https://github.com/lightnow-ai/lightnow-cli/compare/v1.0.5...v1.1.0) (2026-07-07)
+
+
+### Features
+
+* add whoami json output ([9eab480](https://github.com/lightnow-ai/lightnow-cli/commit/9eab480b85765fa50506f4d7126790c2a3ebd094))
+
+
+### Bug Fixes
+
+* **#2:** fix import wizard client configs ([ae0f0b4](https://github.com/lightnow-ai/lightnow-cli/commit/ae0f0b4931dcb1516be65473df3ca73397d6c16e))
+* support wizard client config imports ([35a7347](https://github.com/lightnow-ai/lightnow-cli/commit/35a7347fa438af6e4d9fb754f87a7a5d6a709548))
+* write default local proxy config alias ([47223f6](https://github.com/lightnow-ai/lightnow-cli/commit/47223f62b96ef0790d027ada11abf84459eb63fb))
+
+## 1.0.0 - Unreleased
+
+Initial stable release candidate.
+
+### Added
+
+- OIDC Device Code login for LightNow.
+- Automatic access-token refresh using the stored refresh token.
+- `status`, `whoami`, and `logout` account commands.
+- MCP registry discovery with `search`, `favorites`, and `info`.
+- MCP publishing and local validation commands.
+- Integration profile sync for Codex, Claude, Cursor, Windsurf, Continue,
+  Gemini CLI, LibreChat, VS Code, and MCP Inspector targets.
+- Client-side sync with explicit plaintext-secret confirmation.
+- Placeholder sync for secret-safe client configs.
+- Local runner mode for resolving LightNow-managed secrets at process runtime.
+- Atomic client-config writes with restrictive permissions.
+- Secret redaction for dry-run previews, errors, and terminal output.
+
+### Security
+
+- Device authorization uses PKCE.
+- API calls use shared 401 handling and refresh retry behavior.
+- Expired sessions use consistent messaging across commands.

{lightnow_cli-1.0.5 → lightnow_cli-1.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: lightnow-cli
-Version: 1.0.5
+Version: 1.2.0
 Summary: Official LightNow CLI for MCP registry discovery, client config sync, and local MCP runner workflows
 Project-URL: Homepage, https://github.com/lightnow-ai/lightnow-cli
 Project-URL: Repository, https://github.com/lightnow-ai/lightnow-cli
@@ -38,6 +38,10 @@ Requires-Dist: pytest-mock>=3.10.0; extra == 'dev'
 Requires-Dist: pytest>=7.0.0; extra == 'dev'
 Requires-Dist: responses>=0.23.0; extra == 'dev'
 Requires-Dist: twine>=5.0.0; extra == 'dev'
+Requires-Dist: types-jsonschema>=4.25.0; extra == 'dev'
+Requires-Dist: types-pyyaml>=6.0.12; extra == 'dev'
+Provides-Extra: keyring
+Requires-Dist: keyring>=25.6.0; extra == 'keyring'
 Description-Content-Type: text/markdown
 
 # LightNow CLI
@@ -170,6 +174,10 @@ Let LightNow choose the configured organization policy for a client:
 lightnow sync --client codex --from-settings
 ```
 
+When LightNow Config blocks unmanaged MCP servers, managed clients keep only the
+`LightNow` entry. When unmanaged servers are allowed, existing user-managed MCP
+entries stay in the client config and `config-status` reports `mixed`.
+
 Check whether a client is configured as expected:
 
 ```bash

{lightnow_cli-1.0.5 → lightnow_cli-1.2.0}/README.md

@@ -128,6 +128,10 @@ Let LightNow choose the configured organization policy for a client:
 lightnow sync --client codex --from-settings
 ```
 
+When LightNow Config blocks unmanaged MCP servers, managed clients keep only the
+`LightNow` entry. When unmanaged servers are allowed, existing user-managed MCP
+entries stay in the client config and `config-status` reports `mixed`.
+
 Check whether a client is configured as expected:
 
 ```bash

{lightnow_cli-1.0.5 → lightnow_cli-1.2.0}/docs/development.md

@@ -55,13 +55,28 @@ lightnow config-status --client antigravity --json
 
 Expected states:
 
-- `managed`: only the LightNow Local Proxy entry is configured.
+- `managed`: the LightNow Local Proxy entry is configured and no unmanaged
+  user MCP servers are present. Client-internal MCP entries may be reported
+  separately as `internal_servers`.
 - `mixed`: LightNow Local Proxy exists, but unmanaged MCP entries are also
-  present.
+  present. This is acceptable when LightNow Config allows unmanaged client
+  servers, but those entries bypass LightNow monitoring and policy.
 - `unmanaged`: MCP entries exist, but none point at the LightNow Local Proxy.
 - `legacy_runner`: older per-server `lightnow run` wrappers are still present.
 - `missing`, `invalid` or `unreadable`: the client config cannot be used as-is.
 
+For settings-driven rollout, `lightnow sync --client <client> --from-settings`
+uses the tenant policy. Managed clients remove unmanaged MCP entries only when
+`allowUnmanagedClientServers` is false. If the policy allows unmanaged entries,
+sync preserves them and the posture remains `mixed`.
+
+When a Local Proxy config exists, `config-status` also reads the non-secret
+runtime posture from that file: selected profile, client identity, client
+transport, telemetry flag, policy mode, and whether unmanaged client MCP
+servers are allowed. If policy mode is `enforce`, unmanaged entries are blocked
+by policy, and the client config still contains unmanaged MCP servers, the
+command reports `policy_blocks_unmanaged_servers`.
+
 The command must not print secrets, headers or payloads. It is the local building
 block for future UI-led enablement and enterprise posture reporting.
 

{lightnow_cli-1.0.5 → lightnow_cli-1.2.0}/docs/release.md

@@ -11,7 +11,31 @@ Use these settings for the public repository:
 
 ## Checklist
 
-Before publishing a release:
+Release Please owns normal version bumps, changelog updates, Git tags, and
+GitHub Releases from Conventional Commits.
+
+Required GitHub setup:
+
+- Repository secret: `RELEASE_PLEASE_TOKEN`
+- Token permissions: contents, pull requests, and issues read/write for this
+  repository
+- Repository Actions setting: allow GitHub Actions to create pull requests
+
+Use a real PAT or GitHub App token for `RELEASE_PLEASE_TOKEN`, not the default
+`GITHUB_TOKEN`. Tags created with the default token do not trigger the existing
+tag-based `Release` workflow, so PyPI publishing would not run.
+
+Normal release flow:
+
+1. Merge Conventional Commit changes to `main`.
+2. Release Please opens or updates a release PR.
+3. Merge the release PR when ready.
+4. Release Please creates the `vX.Y.Z` tag and GitHub Release.
+5. The existing tag-based `Release` workflow builds and publishes PyPI
+   distributions through Trusted Publishing.
+6. Update the Homebrew tap after the release artifact is available.
+
+Manual release checklist for fallback or first-time setup:
 
 1. Update `pyproject.toml` and `lightnow_cli/__init__.py` to the same
    semantic version.

{lightnow_cli-1.0.5 → lightnow_cli-1.2.0}/lightnow_cli/__init__.py

@@ -1,3 +1,3 @@
 """LightNow CLI - A command-line tool for managing MCP servers."""
 
-__version__ = "1.0.5"
+__version__ = "1.2.0"  # x-release-please-version

{lightnow_cli-1.0.5 → lightnow_cli-1.2.0}/lightnow_cli/commands/auth.py

@@ -3,6 +3,7 @@
 import asyncio
 import base64
 import hashlib
+import json
 import secrets
 import time
 import webbrowser
@@ -457,10 +458,19 @@ def status() -> None:
         console.print(f"Token expires: [dim]{exp_time}[/dim]")
 
 
-def whoami() -> None:
+def whoami(
+    json_output: Annotated[
+        bool,
+        typer.Option("--json", help="Print machine-readable identity JSON"),
+    ] = False,
+) -> None:
     """Show current user information."""
     user_info = current_user_info()
 
+    if json_output:
+        typer.echo(json.dumps(user_info, indent=2, sort_keys=True))
+        return
+
     # Display user information
     console.print("[bold blue]Current User Information:[/bold blue]")
 
@@ -488,6 +498,14 @@ def whoami() -> None:
 
 def current_user_info() -> Dict[str, Any]:
     """Return current user info after verifying or refreshing the access token."""
+
+    def fallback_claims_or_exit(token_value: str, exc: AuthError) -> Dict[str, Any]:
+        claims = get_user_info(token_value)
+        if claims is not None and claims.get("sub"):
+            return claims
+        console.print(f"[red]{exc}[/red]")
+        raise typer.Exit(1) from exc
+
     try:
         token = require_access_token()
     except AccessTokenExpired as exc:
@@ -504,16 +522,17 @@ def current_user_info() -> Dict[str, Any]:
         try:
             token = refresh_current_session()
             config = config_manager.load_config()
-            return asyncio.run(fetch_user_info(config.issuer or DEFAULT_ISSUER, token))
+            try:
+                return asyncio.run(
+                    fetch_user_info(config.issuer or DEFAULT_ISSUER, token)
+                )
+            except AuthError as exc:
+                return fallback_claims_or_exit(token, exc)
         except AccessTokenExpired as exc:
             console.print(f"[red]{exc}[/red]")
             raise typer.Exit(1) from exc
-        except AuthError as exc:
-            console.print(f"[red]{exc}[/red]")
-            raise typer.Exit(1) from exc
     except AuthError as exc:
-        console.print(f"[red]{exc}[/red]")
-        raise typer.Exit(1) from exc
+        return fallback_claims_or_exit(token, exc)
 
 
 def logout() -> None:

{lightnow_cli-1.0.5 → lightnow_cli-1.2.0}/lightnow_cli/commands/integrations.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 import json
 import os
 import re
+import shlex
 import shutil
 import subprocess
 import sys
@@ -82,6 +83,14 @@ CLIENT_DEFAULTS: dict[str, tuple[str, Path]] = {
 }
 
 CLIENTS = sorted(CLIENT_DEFAULTS)
+IMPORT_CLIENTS = {
+    "antigravity",
+    "claude-code",
+    "claude-desktop",
+    "codex",
+    "cursor",
+    "vscode",
+}
 SECRET_MODES = ["placeholder", "plaintext"]
 LOCAL_PROXY_MCP_SERVERS_JSON_CLIENTS = {
     "antigravity",
@@ -102,7 +111,6 @@ LIGHTNOW_PROXY_ALIASES = {"lightnow", "LightNow"}
 CLIENT_INTERNAL_MCP_SERVERS = {
     "codex": {"node_repl"},
 }
-LOCAL_PROXY_RUNNER_VERSION = "0.1.2"
 VSCODE_VIRTUAL_TOOLS_THRESHOLD_SETTING = "github.copilot.chat.virtualTools.threshold"
 VSCODE_VIRTUAL_TOOLS_THRESHOLD = 128
 LOCAL_PROXY_STDIO_SUPPORT_MESSAGE = (
@@ -125,6 +133,27 @@ def default_local_proxy_config_path(client: str) -> Path:
     return DEFAULT_LOCAL_PROXY_CONFIG_DIR / f"{safe_client}.yaml"
 
 
+def default_local_proxy_profile_config_path(profile: str = "default") -> Path:
+    """Return the profile-level Local Proxy config path used by proxy defaults."""
+    safe_profile = re.sub(r"[^A-Za-z0-9_.-]+", "-", profile).strip("-") or "default"
+    return DEFAULT_LOCAL_PROXY_CONFIG_DIR / f"{safe_profile}.yaml"
+
+
+def local_proxy_default_config_alias(
+    *,
+    profile: str,
+    explicit_config_path: Optional[Path],
+    proxy_target: Path,
+) -> Optional[Path]:
+    """Return the default health-check alias path that should mirror a sync."""
+    if explicit_config_path is not None or profile != "default":
+        return None
+    alias = default_local_proxy_profile_config_path(profile).expanduser()
+    if alias == proxy_target.expanduser():
+        return None
+    return alias
+
+
 def discover_local_lightnow_ca_file(registry_api_url: str) -> Optional[Path]:
     """Find the local LightNow CA for local development Registry API URLs."""
     parsed = urlparse(registry_api_url)
@@ -194,6 +223,70 @@ def direct_server_aliases(content: str, export_format: str) -> list[str]:
     return sorted(alias for alias in entries if alias not in LIGHTNOW_PROXY_ALIASES)
 
 
+def json_server_maps_are_empty(content: str) -> bool:
+    """Return whether a JSON export contains only empty server maps."""
+    payload = json.loads(content)
+    if not isinstance(payload, dict):
+        return False
+    sections = [payload[key] for key in ("mcpServers", "servers") if key in payload]
+    return bool(sections) and all(
+        isinstance(section, dict) and not section for section in sections
+    )
+
+
+def empty_profile_import_command(
+    *,
+    client: str,
+    profile: str,
+    target: Path,
+    tenant: Optional[str],
+    api_url: Optional[str],
+) -> str:
+    """Build a copyable command that previews importing an existing client config."""
+    args = [
+        "lightnow",
+        "import-config",
+        "--client",
+        client,
+        "--profile",
+        profile,
+        "--config-path",
+        str(target),
+        "--dry-run",
+    ]
+    if tenant:
+        args.extend(["--tenant", tenant])
+    if api_url:
+        args.extend(["--api-url", api_url])
+    return shlex.join(args)
+
+
+def print_empty_profile_import_hint(
+    *,
+    client: str,
+    profile: str,
+    target: Path,
+    aliases: list[str],
+    tenant: Optional[str],
+    api_url: Optional[str],
+) -> None:
+    """Explain that existing client servers were preserved and can be imported."""
+    err_console.print(
+        f"[yellow]LightNow profile {profile} has no MCP servers, but {client} already "
+        f"configures: {', '.join(aliases)}. These existing client entries were kept.[/yellow]"
+    )
+    command = empty_profile_import_command(
+        client=client,
+        profile=profile,
+        target=target,
+        tenant=tenant,
+        api_url=api_url,
+    )
+    err_console.print(
+        f"[cyan]To preview importing them into LightNow, run:[/cyan] {command}"
+    )
+
+
 @app.command("sync")
 def sync(
     client: Annotated[str, typer.Option("--client", help="Target MCP client")],
@@ -326,8 +419,12 @@ def sync(
     proxy_target = (
         local_proxy_config_path or default_local_proxy_config_path(client)
     ).expanduser()
+    proxy_default_alias: Optional[Path] = None
     settings_local_proxy_summary: dict[str, Any] = {}
     removed_direct_servers: list[str] = []
+    empty_profile_existing_aliases: list[str] = []
+    remove_unmanaged_client_servers = local_proxy
+    policy_managed_sync = False
 
     try:
         if from_settings:
@@ -348,6 +445,10 @@ def sync(
             )
             if local_proxy_settings.get("enabled") is True and client_is_managed:
                 local_proxy = True
+                policy_managed_sync = True
+                remove_unmanaged_client_servers = (
+                    local_proxy_settings.get("allowUnmanagedClientServers") is False
+                )
                 configured_profile = local_proxy_settings.get("profile")
                 if isinstance(configured_profile, str) and configured_profile:
                     profile = configured_profile
@@ -355,6 +456,11 @@ def sync(
                 profile = str(settings_payload["defaultProfile"])
 
         if local_proxy:
+            proxy_default_alias = local_proxy_default_config_alias(
+                profile=profile,
+                explicit_config_path=local_proxy_config_path,
+                proxy_target=proxy_target,
+            )
             generated = build_local_proxy_export(
                 client=client,
                 export_format=export_format,
@@ -373,6 +479,7 @@ def sync(
                 local_proxy_settings=(
                     settings_local_proxy_summary if from_settings else None
                 ),
+                runtime_secrets=read_local_runtime_secrets(proxy_target),
             )
         elif runner:
             profile_payload = fetch_profile_servers(
@@ -405,12 +512,18 @@ def sync(
             if export_format == "json"
             else {"aliases": [], "input_ids": []}
         )
-        if local_proxy:
+        if local_proxy and remove_unmanaged_client_servers:
             removed_direct_servers = direct_server_aliases(existing, export_format)
-        if local_proxy and client == "codex" and export_format == "toml":
+        if (
+            local_proxy
+            and remove_unmanaged_client_servers
+            and client == "codex"
+            and export_format == "toml"
+        ):
             existing = prepare_codex_local_proxy_config(existing)
         if (
             local_proxy
+            and remove_unmanaged_client_servers
             and client in LOCAL_PROXY_JSON_CLIENTS
             and export_format == "json"
         ):
@@ -422,6 +535,18 @@ def sync(
             previous_managed["aliases"],
             previous_managed["input_ids"],
         )
+        if (
+            not local_proxy
+            and not runner
+            and export_format == "json"
+            and json_server_maps_are_empty(generated)
+        ):
+            managed_aliases = set(previous_managed["aliases"])
+            empty_profile_existing_aliases = [
+                alias
+                for alias in direct_server_aliases(existing, export_format)
+                if alias not in managed_aliases
+            ]
     except AccessTokenExpired:
         console.print(f"[red]{ACCESS_TOKEN_EXPIRED_MESSAGE}[/red]")
         raise typer.Exit(1)
@@ -437,6 +562,16 @@ def sync(
         console.print(f"[bold red]Integration sync failed:[/bold red] {exc}")
         raise typer.Exit(1) from exc
 
+    if empty_profile_existing_aliases:
+        print_empty_profile_import_hint(
+            client=client,
+            profile=profile,
+            target=target,
+            aliases=empty_profile_existing_aliases,
+            tenant=tenant,
+            api_url=api_url,
+        )
+
     if dry_run:
         typer.echo(redact(patched))
         err_console.print("[cyan]Dry run: nothing was written.[/cyan]")
@@ -445,6 +580,10 @@ def sync(
             err_console.print(
                 f"[cyan]Would write Local Proxy config: {proxy_target}[/cyan]"
             )
+            if proxy_default_alias is not None:
+                err_console.print(
+                    f"[cyan]Would update default Local Proxy config: {proxy_default_alias}[/cyan]"
+                )
             if removed_direct_servers:
                 err_console.print(
                     "[yellow]Would remove direct MCP server entries:[/yellow] "
@@ -471,7 +610,7 @@ def sync(
             console.print("[yellow]Canceled.[/yellow]")
             raise typer.Exit(1)
 
-    if local_proxy and removed_direct_servers and not yes:
+    if local_proxy and removed_direct_servers and not yes and not policy_managed_sync:
         console.print(
             f"[yellow]Local Proxy Mode removes direct MCP server entries from {target}:[/yellow] "
             f"{', '.join(removed_direct_servers)}"
@@ -490,6 +629,11 @@ def sync(
     if local_proxy:
         secure_write_text(proxy_target, proxy_config)
         console.print(f"[green]Wrote Local Proxy config to {proxy_target}[/green]")
+        if proxy_default_alias is not None:
+            secure_write_text(proxy_default_alias, proxy_config)
+            console.print(
+                f"[green]Updated default Local Proxy config at {proxy_default_alias}[/green]"
+            )
         if client == "claude-code":
             warm_local_proxy_tools_cache(proxy_target)
 
@@ -520,6 +664,10 @@ def sync(
                 console.print(
                     "[cyan]LightNow policy is enforce: managed clients should keep only the Local Proxy MCP entry.[/cyan]"
                 )
+            if settings_local_proxy_summary.get("allowUnmanagedClientServers") is False:
+                console.print(
+                    "[cyan]LightNow policy blocks unmanaged MCP servers for this client config.[/cyan]"
+                )
         console.print(
             f"[cyan]Next: restart {client} so it picks up the LightNow MCP entry.[/cyan]"
         )
@@ -601,9 +749,10 @@ def import_config(
     if client not in CLIENT_DEFAULTS:
         raise_bad_argument("Unsupported client", f"Use one of: {', '.join(CLIENTS)}")
     _, default_path = CLIENT_DEFAULTS[client]
-    if client != "codex":
+    if client not in IMPORT_CLIENTS:
         raise_bad_argument(
-            "Unsupported import client", "Config import currently supports Codex."
+            "Unsupported import client",
+            f"Config import supports: {', '.join(sorted(IMPORT_CLIENTS))}.",
         )
 
     target = (config_path or default_path).expanduser()
@@ -826,6 +975,7 @@ def build_local_proxy_config(
     tenant: Optional[str],
     registry_ca_file: Optional[Path] = None,
     local_proxy_settings: Optional[dict[str, Any]] = None,
+    runtime_secrets: Optional[dict[str, Any]] = None,
 ) -> str:
     """Render the local LightNow Proxy config for LightNow-managed profile sync."""
     parsed = urlparse(local_proxy_url)
@@ -861,7 +1011,6 @@ def build_local_proxy_config(
         "client_name": client,
         "client_version": None,
         "runner_name": "lightnow-local-proxy",
-        "runner_version": LOCAL_PROXY_RUNNER_VERSION,
         "client_transport": (
             "streamable-http" if local_proxy_transport == "http" else "stdio"
         ),
@@ -893,12 +1042,30 @@ def build_local_proxy_config(
             "jwks_cache_seconds": 300,
         },
         "registry_api": registry_api,
+        "runtime_secrets": runtime_secrets or {"providers": {}},
         "profiles": {profile: {}},
         "upstreams": {},
     }
     return cast(str, yaml.safe_dump(payload, sort_keys=False))
 
 
+def read_local_runtime_secrets(path: Path) -> dict[str, Any]:
+    """Preserve non-secret local provider mappings across managed config syncs."""
+    try:
+        payload = yaml.safe_load(path.expanduser().read_text()) or {}
+    except (FileNotFoundError, OSError, yaml.YAMLError):
+        return {"providers": {}}
+    if not isinstance(payload, dict):
+        return {"providers": {}}
+    runtime_secrets = payload.get("runtime_secrets")
+    if not isinstance(runtime_secrets, dict):
+        return {"providers": {}}
+    providers = runtime_secrets.get("providers")
+    if not isinstance(providers, dict):
+        return {"providers": {}}
+    return {"providers": providers}
+
+
 def build_runner_export(
     *,
     profile_payload: dict[str, Any],
@@ -1403,7 +1570,10 @@ def augment_local_proxy_posture(status: dict[str, Any]) -> dict[str, Any]:
     """Add Local Proxy runtime checks (config file, lightnow-proxy binary) to a posture."""
     warnings = [str(item) for item in status.get("warnings", [])]
     expected_path = status.get("expected_proxy_config_path")
-    proxy_config_exists = bool(expected_path) and Path(str(expected_path)).exists()
+    proxy_config_path = Path(str(expected_path)).expanduser() if expected_path else None
+    proxy_config_exists = False
+    if proxy_config_path is not None:
+        proxy_config_exists = proxy_config_path.exists()
     proxy_commands = [
         str(item) for item in status.get("local_proxy_commands", []) if str(item)
     ]
@@ -1418,6 +1588,39 @@ def augment_local_proxy_posture(status: dict[str, Any]) -> dict[str, Any]:
     if status.get("local_proxy_present"):
         if not proxy_config_exists:
             warnings.append("proxy_config_missing")
+        elif proxy_config_path is not None:
+            try:
+                raw_proxy_config = yaml.safe_load(proxy_config_path.read_text()) or {}
+            except yaml.YAMLError as exc:
+                warnings.append(f"proxy_config_invalid:{exc.__class__.__name__}")
+                raw_proxy_config = {}
+            except OSError as exc:
+                warnings.append(f"proxy_config_read_failed:{exc.__class__.__name__}")
+                raw_proxy_config = {}
+            if isinstance(raw_proxy_config, dict):
+                local_proxy = raw_proxy_config.get("local_proxy")
+                if isinstance(local_proxy, dict):
+                    client_name = local_proxy.get("client_name")
+                    status["local_proxy_profile"] = local_proxy.get("profile")
+                    status["local_proxy_client_name"] = client_name
+                    status["local_proxy_client_transport"] = local_proxy.get(
+                        "client_transport"
+                    )
+                    status["local_proxy_telemetry_enabled"] = local_proxy.get(
+                        "telemetry_enabled"
+                    )
+                    status["local_proxy_policy_mode"] = local_proxy.get("policy_mode")
+                    status["local_proxy_allow_unmanaged_client_servers"] = (
+                        local_proxy.get("allow_unmanaged_client_servers")
+                    )
+                    if client_name and str(client_name) != str(status.get("client")):
+                        warnings.append("proxy_config_client_mismatch")
+                    if (
+                        status.get("status") == "mixed"
+                        and local_proxy.get("policy_mode") == "enforce"
+                        and local_proxy.get("allow_unmanaged_client_servers") is False
+                    ):
+                        warnings.append("policy_blocks_unmanaged_servers")
         if not proxy_command_available:
             if proxy_commands and all(
                 "/" in command or "\\" in command for command in proxy_commands
@@ -1515,6 +1718,14 @@ def warning_hint(code: str, client: str) -> Optional[str]:
             "the LightNow entry points at a different Local Proxy config; "
             f"re-run `{sync_command}` to update it."
         ),
+        "proxy_config_client_mismatch": (
+            "the Local Proxy config belongs to a different client; "
+            f"re-run `{sync_command}` for this client."
+        ),
+        "policy_blocks_unmanaged_servers": (
+            "LightNow policy is set to enforce and unmanaged MCP servers are still present; "
+            f"re-run `{sync_command}` or remove the unmanaged entries."
+        ),
     }
     return hints.get(code)
 
@@ -1567,6 +1778,15 @@ def print_config_status(status: dict[str, Any], path: Path) -> None:
         exists = status.get("proxy_config_exists")
         suffix = "" if exists is None else (" (present)" if exists else " (missing)")
         console.print(f"Local Proxy config: {expected_path}{suffix}")
+    proxy_profile = status.get("local_proxy_profile")
+    if proxy_profile:
+        policy_mode = status.get("local_proxy_policy_mode") or "observe"
+        allow_unmanaged = status.get("local_proxy_allow_unmanaged_client_servers")
+        unmanaged_label = "allowed" if allow_unmanaged is not False else "blocked"
+        console.print(
+            "LightNow policy: "
+            f"profile={proxy_profile}, mode={policy_mode}, unmanaged={unmanaged_label}"
+        )
     unmanaged = status.get("unmanaged_servers")
     if isinstance(unmanaged, list) and unmanaged:
         console.print(