fix(update): tray gate honors --config override; check() re-reads enabled

Codex final-review findings on PR #805 (Spec 079 US1):

- Major: ServerAdapter.GetConfigPath() hardcoded ~/.mcpproxy/mcp_config.json,
  ignoring MCPPROXY_TRAY_CONFIG_PATH — the very path the tray launches core
  with as --config (buildCoreArgs). So the update_check gate read the wrong
  file under a custom config path and failed open, letting the tray-owned
  daily GitHub check run despite update_check.enabled=false. Resolve the env
  override first, matching what core actually uses.

- Minor: check() captured cfgGen but not the enabled flag, so a disable racing
  after the caller's outer Enabled() gate (loop tick / re-enable goroutine)
  still issued a GitHub request. The generation guard dropped the result, but
  the request fired — violating FR-015 "no network check on any surface".
  Re-read enabled under the same lock as gen and bail before checkFunc.

Both covered by new tests.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: Dumbris

cmd/mcpproxy-tray/internal/api/adapter.go

@@ -6,6 +6,7 @@ import (
 	"os"
 	"path/filepath"
 	"runtime"
+	"strings"
 
 	internalRuntime "github.com/smart-mcp-proxy/mcpproxy-go/internal/runtime"
 	"github.com/smart-mcp-proxy/mcpproxy-go/internal/tray"
@@ -307,8 +308,15 @@ func (a *ServerAdapter) ReloadConfiguration() error {
 	return fmt.Errorf("ReloadConfiguration not yet supported via API")
 }
 
-// GetConfigPath returns the configuration file path
+// GetConfigPath returns the configuration file path core is running with.
+// The tray passes MCPPROXY_TRAY_CONFIG_PATH to core as --config (see
+// buildCoreArgs in main.go), so tray-side config consumers — e.g. the Spec 079
+// update_check gate — must resolve to that same override, not a hardcoded
+// default. Falls back to the default ~/.mcpproxy path when unset.
 func (a *ServerAdapter) GetConfigPath() string {
+	if cfg := strings.TrimSpace(os.Getenv("MCPPROXY_TRAY_CONFIG_PATH")); cfg != "" {
+		return cfg
+	}
 	homeDir, err := os.UserHomeDir()
 	if err != nil {
 		return "~/.mcpproxy/mcp_config.json" // fallback

cmd/mcpproxy-tray/internal/api/adapter_test.go

@@ -645,3 +645,30 @@ func TestHealthDataFlow_EndToEnd(t *testing.T) {
 	status := adapter.GetStatus().(map[string]interface{})
 	assert.Equal(t, 1, status["connected_servers"], "Status should use health.level for connected count")
 }
+
+// =============================================================================
+// ServerAdapter.GetConfigPath Tests
+// =============================================================================
+
+// The tray launches core with --config <MCPPROXY_TRAY_CONFIG_PATH> (see
+// buildCoreArgs in main.go). GetConfigPath must resolve to that SAME path so
+// tray-side config consumers (e.g. the Spec 079 update_check gate) read the
+// config core is actually using — not a hardcoded default.
+func TestServerAdapter_GetConfigPath_HonorsTrayConfigPathEnv(t *testing.T) {
+	const custom = "/tmp/custom-tray-config/mcp_config.json"
+	t.Setenv("MCPPROXY_TRAY_CONFIG_PATH", custom)
+
+	adapter := NewServerAdapter(NewMockClient())
+
+	assert.Equal(t, custom, adapter.GetConfigPath())
+}
+
+func TestServerAdapter_GetConfigPath_DefaultWhenEnvUnset(t *testing.T) {
+	t.Setenv("MCPPROXY_TRAY_CONFIG_PATH", "")
+
+	adapter := NewServerAdapter(NewMockClient())
+
+	got := adapter.GetConfigPath()
+	assert.Contains(t, got, "mcp_config.json")
+	assert.NotEqual(t, "", got)
+}

internal/updatecheck/checker.go

@@ -244,8 +244,19 @@ func (c *Checker) check() {
 
 	c.mu.RLock()
 	gen := c.cfgGen
+	enabled := c.enabledLocked()
 	c.mu.RUnlock()
 
+	// Re-read enabled under the same lock as gen: a disable racing after the
+	// caller's outer Enabled() gate (loop tick, or a re-enable-triggered
+	// goroutine from SetConfig) must not fire a network request. The
+	// generation guard already drops any stale result; this avoids the request
+	// entirely (FR-015: disabled means no network check on any surface).
+	if !enabled {
+		c.logger.Debug("Skipping update check: update checking disabled")
+		return
+	}
+
 	release, err := c.checkFunc()
 	if err != nil {
 		c.logger.Debug("Update check failed", zap.Error(err))

internal/updatecheck/checker_test.go

@@ -211,6 +211,29 @@ func TestChecker_SetConfig_DisabledSkipsCheckAndHidesInfo(t *testing.T) {
 	}
 }
 
+// TestChecker_CheckSkipsNetworkWhenDisabled verifies the low-level check()
+// loop path re-reads the enabled flag before hitting the network, so a disable
+// racing an in-flight tick or a re-enable-triggered goroutine performs no
+// GitHub request (FR-015: disabled means no network check on any surface).
+func TestChecker_CheckSkipsNetworkWhenDisabled(t *testing.T) {
+	checker := New(zaptest.NewLogger(t), "v1.0.0")
+
+	calls := 0
+	checker.SetCheckFunc(func() (*GitHubRelease, error) {
+		calls++
+		return &GitHubRelease{TagName: "v1.1.0"}, nil
+	})
+
+	checker.SetConfig(false, false)
+
+	// Directly exercise the loop's check() (bypasses the CheckNow gate).
+	checker.check()
+
+	if calls != 0 {
+		t.Errorf("check function invoked %d times, want 0 when disabled", calls)
+	}
+}
+
 // TestChecker_SetConfig_ReEnableRestoresChecks verifies a hot-reload flip back
 // to enabled=true makes CheckNow work again without a restart (FR-012).
 func TestChecker_SetConfig_ReEnableRestoresChecks(t *testing.T) {