@juspay/neurolink 11.18.0 → 11.18.2

package/dist/cli/commands/proxy.js

@@ -895,6 +895,11 @@ function printProxyBanner(url, strategy) {
     logger.always(chalk.bold("Endpoints:"));
     logger.always(`  ${chalk.blue("POST")} /v1/messages         — Claude proxy (Anthropic format)`);
     logger.always(`  ${chalk.blue("POST")} /v1/chat/completions — OpenAI-compatible proxy`);
+    // The banner listed two of the four inbound doors, so the Codex and Gemini
+    // CLIs looked unsupported to anyone reading start-up output rather than the
+    // docs. Every door the proxy actually answers on belongs here.
+    logger.always(`  ${chalk.blue("POST")} /backend-api/codex/… — Codex proxy (Responses format)`);
+    logger.always(`  ${chalk.blue("POST")} /v1beta/models/…     — Gemini proxy (generateContent)`);
     logger.always(`  ${chalk.green("GET")}  /health              — Health check`);
     logger.always(`  ${chalk.green("GET")}  /status              — Detailed status`);
     logger.always("");
@@ -1149,9 +1154,17 @@ function registerProxyRequestTracking(app, requestMetadata, readiness) {
             throw error;
         }
     };
-    // Cover both the Anthropic (/v1/*) and Codex (/backend-api/*) inbound paths so
-    // drain/reject, lifecycle logging, and concurrency accounting apply to both.
+    // Cover every inbound door so drain/reject, lifecycle logging, and
+    // concurrency accounting apply to all of them.
+    //
+    // `/v1beta/*` is listed separately on purpose: Hono matches wildcards a path
+    // segment at a time, so `/v1/*` does NOT cover `/v1beta/models/...` — the
+    // segment is `v1beta`, not `v1`. When the Gemini door landed it inherited
+    // neither tracker, which meant its requests were absent from the request
+    // log, from per-CLI attribution, and from the in-flight count the graceful
+    // drain waits on. An update could therefore cut a live Gemini stream.
     app.use("/v1/*", trackingHandler);
+    app.use("/v1beta/*", trackingHandler);
     app.use("/backend-api/*", trackingHandler);
 }
 export async function createProxyStartApp(params) {

package/dist/cli/proxy-clients/claudeCode.js

@@ -8,7 +8,7 @@
 import { homedir } from "os";
 import { join } from "path";
 import { logger } from "../../utils/logger.js";
-import { isProxyOwnedValue, shouldCaptureSnapshot } from "./snapshot.js";
+import { isProxyOwnedValue, shouldCaptureSnapshot, writeFileAtomic, } from "./snapshot.js";
 /**
  * Resolved per call rather than at module load so `detect()` and `apply()`
  * agree when HOME changes — under test, and on the `--dev` isolation path.
@@ -63,7 +63,7 @@ export async function setClaudeProxySettings(baseUrl) {
         ANTHROPIC_BASE_URL: baseUrl,
         ENABLE_TOOL_SEARCH: "true",
     };
-    fs.writeFileSync(getClaudeSettingsPath(), JSON.stringify(settings, null, 2));
+    await writeFileAtomic(getClaudeSettingsPath(), JSON.stringify(settings, null, 2));
 }
 export async function clearClaudeProxySettings(expectedBaseUrl) {
     const fs = await import("fs");
@@ -128,7 +128,7 @@ export async function clearClaudeProxySettings(expectedBaseUrl) {
     else {
         settings.env = env;
     }
-    fs.writeFileSync(getClaudeSettingsPath(), JSON.stringify(settings, null, 2));
+    await writeFileAtomic(getClaudeSettingsPath(), JSON.stringify(settings, null, 2));
     return hadBaseUrl || hadToolSearch;
 }
 export const claudeCodeConfigurator = {

package/dist/cli/proxy-clients/codex.js

@@ -7,6 +7,7 @@
 import { homedir } from "os";
 import { join } from "path";
 import { logger } from "../../utils/logger.js";
+import { writeFileAtomic } from "./snapshot.js";
 //
 // Points the Codex CLI at the proxy by managing `~/.codex/config.toml`:
 //   - appends a marker-delimited `[model_providers.neurolink]` table
@@ -92,7 +93,7 @@ export async function setCodexProxySettings(baseUrl) {
                 ? providerMatch[0]
                 : null;
             fs.mkdirSync(join(homedir(), ".neurolink"), { recursive: true });
-            fs.writeFileSync(getCodexSnapshotPath(), JSON.stringify({ originalProviderLine }, null, 2), { mode: 0o600 });
+            await writeFileAtomic(getCodexSnapshotPath(), JSON.stringify({ originalProviderLine }, null, 2), 0o600);
         }
         let text = stripCodexManagedConfig(original);
         // Set the selector: replace an existing top-level model_provider or insert
@@ -113,7 +114,7 @@ export async function setCodexProxySettings(baseUrl) {
             text = `model_provider = "neurolink"\n${text}`;
         }
         const trimmed = text.replace(/\s*$/, "\n");
-        fs.writeFileSync(getCodexConfigPath(), `${trimmed}\n${buildCodexProviderBlock(baseUrl)}`);
+        await writeFileAtomic(getCodexConfigPath(), `${trimmed}\n${buildCodexProviderBlock(baseUrl)}`);
         return true;
     }
     catch (error) {
@@ -182,7 +183,7 @@ export async function clearCodexProxySettings(expectedBaseUrl) {
             }
             return false;
         }
-        fs.writeFileSync(getCodexConfigPath(), text.replace(/\s*$/, "\n"));
+        await writeFileAtomic(getCodexConfigPath(), text.replace(/\s*$/, "\n"));
         try {
             fs.rmSync(getCodexSnapshotPath(), { force: true });
         }

package/dist/cli/proxy-clients/copilot.js

@@ -24,6 +24,7 @@
 import { homedir } from "os";
 import { join } from "path";
 import { logger } from "../../utils/logger.js";
+import { writeFileAtomic } from "./snapshot.js";
 /**
  * Resolved per call rather than at module load so `detect()` and `apply()`
  * agree when HOME changes — under test, and on the `--dev` isolation path.
@@ -61,12 +62,11 @@ export async function setCopilotProxySettings(baseUrl, proxyKey) {
     try {
         const envPath = getCopilotEnvPath();
         fs.mkdirSync(join(homedir(), ".neurolink"), { recursive: true });
-        fs.writeFileSync(envPath, buildCopilotEnvScript(baseUrl, proxyKey || "neurolink-proxy"), { mode: 0o600 });
-        // The mode option above only applies when open() creates the file. On an
-        // overwrite it is ignored, so a pre-existing file keeps whatever
-        // permissions it had — which for a file holding a proxy key could be
-        // world-readable. Enforce it on both paths.
-        fs.chmodSync(envPath, 0o600);
+        // 0600 is applied to the temp file before the rename, so the script never
+        // exists at the destination with wider permissions — not even briefly.
+        // writeFileSync's own mode option would not do this: it applies only when
+        // open() creates the file, so an overwrite kept whatever mode was there.
+        await writeFileAtomic(envPath, buildCopilotEnvScript(baseUrl, proxyKey || "neurolink-proxy"), 0o600);
         return true;
     }
     catch (error) {

package/dist/cli/proxy-clients/openCode.js

@@ -7,7 +7,7 @@
 import { homedir } from "os";
 import { join } from "path";
 import { logger } from "../../utils/logger.js";
-import { cloneForSnapshot, isProxyOwnedValue, shouldCaptureSnapshot, } from "./snapshot.js";
+import { cloneForSnapshot, isProxyOwnedValue, shouldCaptureSnapshot, writeFileAtomic, } from "./snapshot.js";
 function getOpenCodeConfigDir() {
     // OpenCode resolves this with the unmodified `xdg-basedir` package —
     // `XDG_CONFIG_HOME || ~/.config` — on every platform, macOS included. There
@@ -82,7 +82,7 @@ export async function setOpenCodeProxySettings(baseUrl, proxyKey) {
     provider.neurolink = block;
     config[OPENCODE_WRITTEN_KEY] = cloneForSnapshot(block);
     config.provider = provider;
-    fs.writeFileSync(getOpenCodeConfigPath(), JSON.stringify(config, null, 2));
+    await writeFileAtomic(getOpenCodeConfigPath(), JSON.stringify(config, null, 2));
     return true;
 }
 export async function clearOpenCodeProxySettings(expectedBaseUrl) {
@@ -146,7 +146,7 @@ export async function clearOpenCodeProxySettings(expectedBaseUrl) {
         return false;
     }
     config.provider = provider;
-    fs.writeFileSync(getOpenCodeConfigPath(), JSON.stringify(config, null, 2));
+    await writeFileAtomic(getOpenCodeConfigPath(), JSON.stringify(config, null, 2));
     return hadNeurolink;
 }
 /**

package/dist/cli/proxy-clients/qwenCode.js

@@ -20,7 +20,7 @@
 import { homedir } from "os";
 import { join } from "path";
 import { logger } from "../../utils/logger.js";
-import { cloneForSnapshot, isProxyOwnedValue, shouldCaptureSnapshot, } from "./snapshot.js";
+import { cloneForSnapshot, isProxyOwnedValue, shouldCaptureSnapshot, writeFileAtomic, } from "./snapshot.js";
 /**
  * Resolved per call rather than at module load so `detect()` and `apply()`
  * agree when HOME changes — under test, and on the `--dev` isolation path.
@@ -87,7 +87,7 @@ export async function setQwenProxySettings(baseUrl, proxyKey) {
     security.auth = auth;
     settings.security = security;
     settings[QWEN_WRITTEN_KEY] = cloneForSnapshot(auth);
-    fs.writeFileSync(getQwenSettingsPath(), JSON.stringify(settings, null, 2));
+    await writeFileAtomic(getQwenSettingsPath(), JSON.stringify(settings, null, 2));
     return true;
 }
 export async function clearQwenProxySettings(expectedBaseUrl) {
@@ -133,7 +133,7 @@ export async function clearQwenProxySettings(expectedBaseUrl) {
     delete settings[QWEN_ORIGINAL_KEY];
     delete settings[QWEN_WRITTEN_KEY];
     settings.security = security;
-    fs.writeFileSync(getQwenSettingsPath(), JSON.stringify(settings, null, 2));
+    await writeFileAtomic(getQwenSettingsPath(), JSON.stringify(settings, null, 2));
     return true;
 }
 export const qwenCodeConfigurator = {

package/dist/cli/proxy-clients/snapshot.d.ts

@@ -50,3 +50,54 @@ export declare function isProxyOwnedValue(args: {
     written: unknown;
     current: unknown;
 }): boolean;
+/**
+ * Replace a file's contents without ever exposing a partial one.
+ *
+ * `writeFileSync` opens with `O_TRUNC`, so from the truncate until the last
+ * byte lands the user's config is short — and a real config spans several
+ * syscalls, not an instant. Anything reading concurrently, the CLI the config
+ * belongs to included, can load a truncated file; a crash in that window leaves
+ * it truncated permanently. Both Qwen and OpenCode keep live API keys there.
+ *
+ * Writing to a sibling temp file and renaming closes it: `rename(2)` within a
+ * directory is atomic, so a reader sees either the whole old file or the whole
+ * new one. The temp file must be a sibling — a rename across filesystems is a
+ * copy, which reintroduces exactly the window this removes.
+ *
+ * PERMISSIONS ARE THE SUBTLE PART, and getting them wrong here leaks API keys.
+ *
+ * Writing through a temp file changes who decides the destination's mode. A
+ * plain `writeFileSync` over an existing file leaves that file's mode alone, so
+ * a config the user had locked to 0600 stayed 0600. A rename replaces the inode,
+ * so the destination inherits the TEMP file's mode instead — and a temp file
+ * created without an explicit mode lands at 0666 minus umask, i.e. 0644 on a
+ * default system. Left unhandled, making the write atomic would have quietly
+ * widened every credential file it touched from 0600 to 0644.
+ *
+ * So when the caller does not specify a mode, the destination's current mode is
+ * carried over, which reproduces `writeFileSync`'s behaviour exactly; a file
+ * that does not exist yet starts at 0600 rather than whatever umask allows.
+ *
+ * The mode is applied at CREATE time, not after. `writeFileSync` followed by
+ * `chmodSync` would put the credential bytes on disk at 0644 first and tighten
+ * them a moment later — a window a local reader can win. The trailing `chmod`
+ * remains only to pin the exact mode, since umask masks the create mode; by
+ * then the file has never been readable more widely than its final mode.
+ *
+ * On Windows the guarantee holds but the failure mode differs, which is worth
+ * stating because the obvious worry there is the wrong one. Node's `renameSync`
+ * is `MoveFileExW` with `MOVEFILE_REPLACE_EXISTING`; replacing a file on the
+ * same volume is an atomic directory-entry update, so a concurrent reader still
+ * sees the whole old file or the whole new one and never a torn one. What
+ * Windows adds is that the rename can *fail* — `EPERM`/`EBUSY` when a reader
+ * holds the destination open — where POSIX would succeed. That path is safe:
+ * the catch below removes the temp file and rethrows, leaving the previous
+ * config intact for the caller to report on.
+ *
+ * The sibling rule above is what makes that true. `MOVEFILE_COPY_ALLOWED` is
+ * also set, so a cross-volume rename silently degrades to copy-then-delete and
+ * is NOT atomic. Moving the temp file to `os.tmpdir()` would look like a
+ * tidy-up and would quietly restore the exact window this function exists to
+ * close, on Windows only, where nobody here would see it.
+ */
+export declare function writeFileAtomic(filePath: string, contents: string, mode?: number): Promise<void>;

package/dist/cli/proxy-clients/snapshot.js

@@ -95,4 +95,107 @@ export function isProxyOwnedValue(args) {
     }
     return valuesMatch(args.current, args.written);
 }
+/** Distinguishes concurrent writers within one process. */
+let atomicWriteCounter = 0;
+/**
+ * Replace a file's contents without ever exposing a partial one.
+ *
+ * `writeFileSync` opens with `O_TRUNC`, so from the truncate until the last
+ * byte lands the user's config is short — and a real config spans several
+ * syscalls, not an instant. Anything reading concurrently, the CLI the config
+ * belongs to included, can load a truncated file; a crash in that window leaves
+ * it truncated permanently. Both Qwen and OpenCode keep live API keys there.
+ *
+ * Writing to a sibling temp file and renaming closes it: `rename(2)` within a
+ * directory is atomic, so a reader sees either the whole old file or the whole
+ * new one. The temp file must be a sibling — a rename across filesystems is a
+ * copy, which reintroduces exactly the window this removes.
+ *
+ * PERMISSIONS ARE THE SUBTLE PART, and getting them wrong here leaks API keys.
+ *
+ * Writing through a temp file changes who decides the destination's mode. A
+ * plain `writeFileSync` over an existing file leaves that file's mode alone, so
+ * a config the user had locked to 0600 stayed 0600. A rename replaces the inode,
+ * so the destination inherits the TEMP file's mode instead — and a temp file
+ * created without an explicit mode lands at 0666 minus umask, i.e. 0644 on a
+ * default system. Left unhandled, making the write atomic would have quietly
+ * widened every credential file it touched from 0600 to 0644.
+ *
+ * So when the caller does not specify a mode, the destination's current mode is
+ * carried over, which reproduces `writeFileSync`'s behaviour exactly; a file
+ * that does not exist yet starts at 0600 rather than whatever umask allows.
+ *
+ * The mode is applied at CREATE time, not after. `writeFileSync` followed by
+ * `chmodSync` would put the credential bytes on disk at 0644 first and tighten
+ * them a moment later — a window a local reader can win. The trailing `chmod`
+ * remains only to pin the exact mode, since umask masks the create mode; by
+ * then the file has never been readable more widely than its final mode.
+ *
+ * On Windows the guarantee holds but the failure mode differs, which is worth
+ * stating because the obvious worry there is the wrong one. Node's `renameSync`
+ * is `MoveFileExW` with `MOVEFILE_REPLACE_EXISTING`; replacing a file on the
+ * same volume is an atomic directory-entry update, so a concurrent reader still
+ * sees the whole old file or the whole new one and never a torn one. What
+ * Windows adds is that the rename can *fail* — `EPERM`/`EBUSY` when a reader
+ * holds the destination open — where POSIX would succeed. That path is safe:
+ * the catch below removes the temp file and rethrows, leaving the previous
+ * config intact for the caller to report on.
+ *
+ * The sibling rule above is what makes that true. `MOVEFILE_COPY_ALLOWED` is
+ * also set, so a cross-volume rename silently degrades to copy-then-delete and
+ * is NOT atomic. Moving the temp file to `os.tmpdir()` would look like a
+ * tidy-up and would quietly restore the exact window this function exists to
+ * close, on Windows only, where nobody here would see it.
+ */
+export async function writeFileAtomic(filePath, contents, mode) {
+    const fs = await import("fs");
+    const { dirname, join, basename } = await import("path");
+    atomicWriteCounter += 1;
+    const tempPath = join(dirname(filePath), `.${basename(filePath)}.neurolink-${process.pid}-${atomicWriteCounter}.tmp`);
+    // Which step failed changes what the user should do about it: a failed write
+    // is usually a missing directory or a full disk and the config is untouched,
+    // while a failed rename is a locked destination and the config is intact but
+    // stale. The bare errno is the same shape for both, so the stage is recorded
+    // as it advances and named in the rethrow.
+    let stage = "write";
+    // Resolved before the first byte is written — see the permissions note above.
+    let effectiveMode = mode;
+    if (effectiveMode === undefined) {
+        try {
+            effectiveMode = fs.statSync(filePath).mode & 0o777;
+        }
+        catch {
+            effectiveMode = 0o600;
+        }
+    }
+    try {
+        // The temp file is a sibling of the destination, so a missing parent fails
+        // the write rather than the rename — the config is untouched, but the
+        // caller sees an ENOENT naming a path it never asked to write. Creating
+        // the directory first makes a first-run write behave like the plain
+        // writeFileSync it replaced.
+        fs.mkdirSync(dirname(filePath), { recursive: true });
+        fs.writeFileSync(tempPath, contents, { mode: effectiveMode });
+        stage = "chmod";
+        fs.chmodSync(tempPath, effectiveMode);
+        stage = "rename";
+        fs.renameSync(tempPath, filePath);
+    }
+    catch (error) {
+        // Never leave scratch in the user's config directory.
+        try {
+            fs.rmSync(tempPath, { force: true });
+        }
+        catch {
+            // best effort
+        }
+        const reason = error instanceof Error ? error.message : String(error);
+        // The original is attached as `cause`, not discarded: wrapping moves the
+        // errno off the thrown object, and `cause` is where anything that needs
+        // ENOENT/EPERM finds it. No caller reads it today — every call site either
+        // lets this propagate or swallows it — so nothing breaks, but a future one
+        // should not have to re-derive the syscall from a string.
+        throw new Error(`atomic write to ${filePath} failed at the ${stage} step: ${reason}`, { cause: error });
+    }
+}
 //# sourceMappingURL=snapshot.js.map

package/dist/proxy/geminiFormat.d.ts

@@ -22,17 +22,38 @@ import type { ParsedGeminiRequest, StreamSerializerAdapter } from "../types/inde
 /**
  * Parse a `generateContent` body into the shape the translation engine takes.
  *
- * The final user turn becomes `prompt`; everything before it becomes
- * `conversationMessages`, with Google's `model` role mapped to `assistant` so
- * downstream providers see a role they understand.
+ * The final user turn becomes `prompt`, with Google's `model` role mapped to
+ * `assistant` so downstream providers see a role they understand.
+ *
+ * `conversationMessages` carries EVERY turn, the final one included. That
+ * looks redundant next to `prompt`, and it is the contract the shared engine
+ * expects: `buildTranslationOptions` does `conversationMessages.slice(0, -1)`
+ * to derive history, because the final turn is already being sent as `prompt`.
+ * `claudeFormat` and `openaiFormat` both push unconditionally for that reason.
+ * Excluding the last turn here — the intuitive reading of "history" — made the
+ * engine's slice eat one real turn instead, so every multi-turn Gemini request
+ * silently lost its most recent message.
  */
 export declare function parseGeminiRequest(model: string, body: Record<string, unknown>, stream: boolean): ParsedGeminiRequest;
 /** Build a complete `generateContent` response body. */
+/**
+ * Render a tool call as text.
+ *
+ * The proxy does not forward tool calls in Google's `functionCall` part shape:
+ * the CLI drives tools locally, so a `functionCall` it never asked for would be
+ * an unresolvable pending call. Text is what it can act on. Both the streaming
+ * serializer and the non-streaming builder go through here so the two paths
+ * cannot drift.
+ */
+export declare function renderGeminiToolUse(name: string, input: unknown): string;
 export declare function buildGeminiResponse(text: string, finishReason: string, usage: {
     input: number;
     output: number;
     total: number;
-}, modelVersion: string): Record<string, unknown>;
+}, modelVersion: string, toolCalls?: ReadonlyArray<{
+    toolName: string;
+    args: Record<string, unknown>;
+}>): Record<string, unknown>;
 /** Google's error envelope, which the CLI parses to classify failures. */
 export declare function buildGeminiErrorResponse(status: number, message: string, statusText?: string): Response;
 /**

package/dist/proxy/geminiFormat.js

@@ -40,9 +40,17 @@ function partsToImages(parts) {
 /**
  * Parse a `generateContent` body into the shape the translation engine takes.
  *
- * The final user turn becomes `prompt`; everything before it becomes
- * `conversationMessages`, with Google's `model` role mapped to `assistant` so
- * downstream providers see a role they understand.
+ * The final user turn becomes `prompt`, with Google's `model` role mapped to
+ * `assistant` so downstream providers see a role they understand.
+ *
+ * `conversationMessages` carries EVERY turn, the final one included. That
+ * looks redundant next to `prompt`, and it is the contract the shared engine
+ * expects: `buildTranslationOptions` does `conversationMessages.slice(0, -1)`
+ * to derive history, because the final turn is already being sent as `prompt`.
+ * `claudeFormat` and `openaiFormat` both push unconditionally for that reason.
+ * Excluding the last turn here — the intuitive reading of "history" — made the
+ * engine's slice eat one real turn instead, so every multi-turn Gemini request
+ * silently lost its most recent message.
  */
 export function parseGeminiRequest(model, body, stream) {
     const contents = Array.isArray(body.contents)
@@ -58,9 +66,9 @@ export function parseGeminiRequest(model, body, stream) {
         content: partsToText(c?.parts),
         images: partsToImages(c?.parts),
     }));
-    // The last user turn is the prompt; anything before it is history. A request
-    // whose final turn is a model turn (the CLI does this when continuing) leaves
-    // an empty prompt rather than replaying the assistant's own words as input.
+    // The last user turn is the prompt. A request whose final turn is a model
+    // turn (the CLI does this when continuing) leaves an empty prompt rather
+    // than replaying the assistant's own words as input.
     let prompt = "";
     let images = [];
     const conversationMessages = [];
@@ -70,12 +78,24 @@ export function parseGeminiRequest(model, body, stream) {
             prompt = turns[i].content;
             images = turns[i].images;
         }
-        else {
-            conversationMessages.push({
-                role: turns[i].role,
-                content: turns[i].content,
-            });
-        }
+        // Unconditional — see the slice-contract note on this function.
+        conversationMessages.push({
+            role: turns[i].role,
+            content: turns[i].content,
+        });
+    }
+    // The engine's `slice(0, -1)` drops the LAST entry on the assumption that it
+    // is the turn already being sent as `prompt`. That holds only when the
+    // request ends with a user turn. The Gemini CLI also continues from a model
+    // turn, and there the last entry is a real assistant reply — so the slice ate
+    // it, which is the same lost-turn bug one case further along.
+    //
+    // A terminal placeholder restores the invariant: the slice removes this
+    // instead of the model turn. It is never sent anywhere — `prompt` is
+    // independently "" in exactly this case, so the placeholder only exists to be
+    // consumed by the slice.
+    if (turns.length > 0 && turns[turns.length - 1].role !== "user") {
+        conversationMessages.push({ role: "user", content: "" });
     }
     const numeric = (v) => typeof v === "number" && Number.isFinite(v) ? v : undefined;
     const stops = generationConfig.stopSequences;
@@ -115,11 +135,31 @@ function usageMetadata(usage) {
     };
 }
 /** Build a complete `generateContent` response body. */
-export function buildGeminiResponse(text, finishReason, usage, modelVersion) {
+/**
+ * Render a tool call as text.
+ *
+ * The proxy does not forward tool calls in Google's `functionCall` part shape:
+ * the CLI drives tools locally, so a `functionCall` it never asked for would be
+ * an unresolvable pending call. Text is what it can act on. Both the streaming
+ * serializer and the non-streaming builder go through here so the two paths
+ * cannot drift.
+ */
+export function renderGeminiToolUse(name, input) {
+    return `\n[tool: ${name} ${JSON.stringify(input)}]\n`;
+}
+export function buildGeminiResponse(text, finishReason, usage, modelVersion, toolCalls) {
+    // A translated result can legitimately carry tool calls and no text — the
+    // engine's hasTranslatedOutput() accepts that. Rendering only `text` there
+    // handed the client parts[0].text === "" with finishReason STOP, which reads
+    // as "the model answered nothing" rather than "the model wants a tool".
+    const rendered = (toolCalls ?? [])
+        .map((call) => renderGeminiToolUse(call.toolName, call.args))
+        .join("");
+    const body = `${text}${rendered}`;
     return {
         candidates: [
             {
-                content: { role: MODEL_ROLE, parts: [{ text }] },
+                content: { role: MODEL_ROLE, parts: [{ text: body }] },
                 finishReason: toGeminiFinishReason(finishReason),
                 index: 0,
             },
@@ -175,7 +215,7 @@ export class GeminiStreamSerializer {
      * that is never coming; rendering it as text keeps the turn terminating.
      */
     pushToolUse(_id, name, input) {
-        return this.pushDelta(`\n[tool: ${name} ${JSON.stringify(input)}]\n`);
+        return this.pushDelta(renderGeminiToolUse(name, input));
     }
     finish(finishReason, usage) {
         return [

package/dist/proxy/proxyTranslationEngine.js

@@ -598,7 +598,7 @@ export async function handleTranslatedJsonRequest(args) {
                 return serializeClaudeResponse(internal, requestModel);
             }
             if (format === "gemini") {
-                return buildGeminiResponse(internal.content, internal.finishReason ?? defaultFinishReason(format), resolvedUsage, internal.model ?? requestModel);
+                return buildGeminiResponse(internal.content, internal.finishReason ?? defaultFinishReason(format), resolvedUsage, internal.model ?? requestModel, internal.toolCalls);
             }
             return serializeOpenAIResponse(internal, requestModel);
         }

package/dist/server/routes/geminiProxyRoutes.js

@@ -184,7 +184,12 @@ export function createGeminiProxyRoutes(modelRouter, basePath = "", _loopbackPor
                     // --- Dispatch via shared translation engine ---
                     try {
                         if (stream) {
-                            return handleTranslatedStreamRequest({
+                            // Awaited, not returned bare: `handleTranslatedStreamRequest` is
+                            // async, so a rejection raised before the Response exists would
+                            // escape this try/catch and land in `app.onError`, which answers
+                            // in Anthropic's error shape. A Gemini client parsing that finds
+                            // no `error.message` and reports an empty failure.
+                            return await handleTranslatedStreamRequest({
                                 ctx,
                                 format: "gemini",
                                 requestModel: modelId,

package/dist/types/proxy.d.ts

@@ -2773,15 +2773,6 @@ export type OpenAIErrorResponse = {
     };
 };
 /** Parsed OpenAI request — intermediate form for NeuroLink pipeline. */
-/**
- * A Gemini `generateContent` request, reduced to what translation needs.
- *
- * Google's shape differs from both others in three ways that matter here:
- * roles are `user`/`model` rather than `user`/`assistant`, the system prompt
- * lives in a sibling `systemInstruction` rather than in the turn list, and
- * generation settings are nested under `generationConfig` instead of sitting
- * at the top level.
- */
 /** One part of a Gemini `contents[].parts[]` entry. */
 export type ProxyGeminiPart = {
     text?: string;
@@ -2794,6 +2785,15 @@ export type ProxyGeminiContent = {
     role?: string;
     parts?: ProxyGeminiPart[];
 };
+/**
+ * A Gemini `generateContent` request, reduced to what translation needs.
+ *
+ * Google's shape differs from both others in three ways that matter here:
+ * roles are `user`/`model` rather than `user`/`assistant`, the system prompt
+ * lives in a sibling `systemInstruction` rather than in the turn list, and
+ * generation settings are nested under `generationConfig` instead of sitting
+ * at the top level.
+ */
 export type ParsedGeminiRequest = {
     model: string;
     maxTokens?: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@juspay/neurolink",
-  "version": "11.18.0",
+  "version": "11.18.2",
   "packageManager": "pnpm@10.15.1",
   "description": "TypeScript AI SDK with 24+ LLM providers behind one consistent API. MCP-native (connect any MCP server), voice TTS/STT/realtime, RAG, agents, memory, context compaction. OpenAI · Anthropic · Gemini · Bedrock · Azure · Ollama · DeepSeek · NVIDIA NIM and more.",
   "author": {