@juspay/neurolink 11.18.1 → 11.18.3

package/dist/cli/commands/proxy.js

@@ -895,6 +895,11 @@ function printProxyBanner(url, strategy) {
     logger.always(chalk.bold("Endpoints:"));
     logger.always(`  ${chalk.blue("POST")} /v1/messages         — Claude proxy (Anthropic format)`);
     logger.always(`  ${chalk.blue("POST")} /v1/chat/completions — OpenAI-compatible proxy`);
+    // The banner listed two of the four inbound doors, so the Codex and Gemini
+    // CLIs looked unsupported to anyone reading start-up output rather than the
+    // docs. Every door the proxy actually answers on belongs here.
+    logger.always(`  ${chalk.blue("POST")} /backend-api/codex/… — Codex proxy (Responses format)`);
+    logger.always(`  ${chalk.blue("POST")} /v1beta/models/…     — Gemini proxy (generateContent)`);
     logger.always(`  ${chalk.green("GET")}  /health              — Health check`);
     logger.always(`  ${chalk.green("GET")}  /status              — Detailed status`);
     logger.always("");
@@ -1149,9 +1154,17 @@ function registerProxyRequestTracking(app, requestMetadata, readiness) {
             throw error;
         }
     };
-    // Cover both the Anthropic (/v1/*) and Codex (/backend-api/*) inbound paths so
-    // drain/reject, lifecycle logging, and concurrency accounting apply to both.
+    // Cover every inbound door so drain/reject, lifecycle logging, and
+    // concurrency accounting apply to all of them.
+    //
+    // `/v1beta/*` is listed separately on purpose: Hono matches wildcards a path
+    // segment at a time, so `/v1/*` does NOT cover `/v1beta/models/...` — the
+    // segment is `v1beta`, not `v1`. When the Gemini door landed it inherited
+    // neither tracker, which meant its requests were absent from the request
+    // log, from per-CLI attribution, and from the in-flight count the graceful
+    // drain waits on. An update could therefore cut a live Gemini stream.
     app.use("/v1/*", trackingHandler);
+    app.use("/v1beta/*", trackingHandler);
     app.use("/backend-api/*", trackingHandler);
 }
 export async function createProxyStartApp(params) {

package/dist/cli/proxy-clients/snapshot.js

@@ -169,6 +169,12 @@ export async function writeFileAtomic(filePath, contents, mode) {
         }
     }
     try {
+        // The temp file is a sibling of the destination, so a missing parent fails
+        // the write rather than the rename — the config is untouched, but the
+        // caller sees an ENOENT naming a path it never asked to write. Creating
+        // the directory first makes a first-run write behave like the plain
+        // writeFileSync it replaced.
+        fs.mkdirSync(dirname(filePath), { recursive: true });
         fs.writeFileSync(tempPath, contents, { mode: effectiveMode });
         stage = "chmod";
         fs.chmodSync(tempPath, effectiveMode);

package/dist/proxy/geminiFormat.d.ts

@@ -22,17 +22,38 @@ import type { ParsedGeminiRequest, StreamSerializerAdapter } from "../types/inde
 /**
  * Parse a `generateContent` body into the shape the translation engine takes.
  *
- * The final user turn becomes `prompt`; everything before it becomes
- * `conversationMessages`, with Google's `model` role mapped to `assistant` so
- * downstream providers see a role they understand.
+ * The final user turn becomes `prompt`, with Google's `model` role mapped to
+ * `assistant` so downstream providers see a role they understand.
+ *
+ * `conversationMessages` carries EVERY turn, the final one included. That
+ * looks redundant next to `prompt`, and it is the contract the shared engine
+ * expects: `buildTranslationOptions` does `conversationMessages.slice(0, -1)`
+ * to derive history, because the final turn is already being sent as `prompt`.
+ * `claudeFormat` and `openaiFormat` both push unconditionally for that reason.
+ * Excluding the last turn here — the intuitive reading of "history" — made the
+ * engine's slice eat one real turn instead, so every multi-turn Gemini request
+ * silently lost its most recent message.
  */
 export declare function parseGeminiRequest(model: string, body: Record<string, unknown>, stream: boolean): ParsedGeminiRequest;
 /** Build a complete `generateContent` response body. */
+/**
+ * Render a tool call as text.
+ *
+ * The proxy does not forward tool calls in Google's `functionCall` part shape:
+ * the CLI drives tools locally, so a `functionCall` it never asked for would be
+ * an unresolvable pending call. Text is what it can act on. Both the streaming
+ * serializer and the non-streaming builder go through here so the two paths
+ * cannot drift.
+ */
+export declare function renderGeminiToolUse(name: string, input: unknown): string;
 export declare function buildGeminiResponse(text: string, finishReason: string, usage: {
     input: number;
     output: number;
     total: number;
-}, modelVersion: string): Record<string, unknown>;
+}, modelVersion: string, toolCalls?: ReadonlyArray<{
+    toolName: string;
+    args: Record<string, unknown>;
+}>): Record<string, unknown>;
 /** Google's error envelope, which the CLI parses to classify failures. */
 export declare function buildGeminiErrorResponse(status: number, message: string, statusText?: string): Response;
 /**

package/dist/proxy/geminiFormat.js

@@ -40,9 +40,17 @@ function partsToImages(parts) {
 /**
  * Parse a `generateContent` body into the shape the translation engine takes.
  *
- * The final user turn becomes `prompt`; everything before it becomes
- * `conversationMessages`, with Google's `model` role mapped to `assistant` so
- * downstream providers see a role they understand.
+ * The final user turn becomes `prompt`, with Google's `model` role mapped to
+ * `assistant` so downstream providers see a role they understand.
+ *
+ * `conversationMessages` carries EVERY turn, the final one included. That
+ * looks redundant next to `prompt`, and it is the contract the shared engine
+ * expects: `buildTranslationOptions` does `conversationMessages.slice(0, -1)`
+ * to derive history, because the final turn is already being sent as `prompt`.
+ * `claudeFormat` and `openaiFormat` both push unconditionally for that reason.
+ * Excluding the last turn here — the intuitive reading of "history" — made the
+ * engine's slice eat one real turn instead, so every multi-turn Gemini request
+ * silently lost its most recent message.
  */
 export function parseGeminiRequest(model, body, stream) {
     const contents = Array.isArray(body.contents)
@@ -58,9 +66,9 @@ export function parseGeminiRequest(model, body, stream) {
         content: partsToText(c?.parts),
         images: partsToImages(c?.parts),
     }));
-    // The last user turn is the prompt; anything before it is history. A request
-    // whose final turn is a model turn (the CLI does this when continuing) leaves
-    // an empty prompt rather than replaying the assistant's own words as input.
+    // The last user turn is the prompt. A request whose final turn is a model
+    // turn (the CLI does this when continuing) leaves an empty prompt rather
+    // than replaying the assistant's own words as input.
     let prompt = "";
     let images = [];
     const conversationMessages = [];
@@ -70,12 +78,24 @@ export function parseGeminiRequest(model, body, stream) {
             prompt = turns[i].content;
             images = turns[i].images;
         }
-        else {
-            conversationMessages.push({
-                role: turns[i].role,
-                content: turns[i].content,
-            });
-        }
+        // Unconditional — see the slice-contract note on this function.
+        conversationMessages.push({
+            role: turns[i].role,
+            content: turns[i].content,
+        });
+    }
+    // The engine's `slice(0, -1)` drops the LAST entry on the assumption that it
+    // is the turn already being sent as `prompt`. That holds only when the
+    // request ends with a user turn. The Gemini CLI also continues from a model
+    // turn, and there the last entry is a real assistant reply — so the slice ate
+    // it, which is the same lost-turn bug one case further along.
+    //
+    // A terminal placeholder restores the invariant: the slice removes this
+    // instead of the model turn. It is never sent anywhere — `prompt` is
+    // independently "" in exactly this case, so the placeholder only exists to be
+    // consumed by the slice.
+    if (turns.length > 0 && turns[turns.length - 1].role !== "user") {
+        conversationMessages.push({ role: "user", content: "" });
     }
     const numeric = (v) => typeof v === "number" && Number.isFinite(v) ? v : undefined;
     const stops = generationConfig.stopSequences;
@@ -115,11 +135,31 @@ function usageMetadata(usage) {
     };
 }
 /** Build a complete `generateContent` response body. */
-export function buildGeminiResponse(text, finishReason, usage, modelVersion) {
+/**
+ * Render a tool call as text.
+ *
+ * The proxy does not forward tool calls in Google's `functionCall` part shape:
+ * the CLI drives tools locally, so a `functionCall` it never asked for would be
+ * an unresolvable pending call. Text is what it can act on. Both the streaming
+ * serializer and the non-streaming builder go through here so the two paths
+ * cannot drift.
+ */
+export function renderGeminiToolUse(name, input) {
+    return `\n[tool: ${name} ${JSON.stringify(input)}]\n`;
+}
+export function buildGeminiResponse(text, finishReason, usage, modelVersion, toolCalls) {
+    // A translated result can legitimately carry tool calls and no text — the
+    // engine's hasTranslatedOutput() accepts that. Rendering only `text` there
+    // handed the client parts[0].text === "" with finishReason STOP, which reads
+    // as "the model answered nothing" rather than "the model wants a tool".
+    const rendered = (toolCalls ?? [])
+        .map((call) => renderGeminiToolUse(call.toolName, call.args))
+        .join("");
+    const body = `${text}${rendered}`;
     return {
         candidates: [
             {
-                content: { role: MODEL_ROLE, parts: [{ text }] },
+                content: { role: MODEL_ROLE, parts: [{ text: body }] },
                 finishReason: toGeminiFinishReason(finishReason),
                 index: 0,
             },
@@ -175,7 +215,7 @@ export class GeminiStreamSerializer {
      * that is never coming; rendering it as text keeps the turn terminating.
      */
     pushToolUse(_id, name, input) {
-        return this.pushDelta(`\n[tool: ${name} ${JSON.stringify(input)}]\n`);
+        return this.pushDelta(renderGeminiToolUse(name, input));
     }
     finish(finishReason, usage) {
         return [

package/dist/proxy/proxyTranslationEngine.js

@@ -598,7 +598,7 @@ export async function handleTranslatedJsonRequest(args) {
                 return serializeClaudeResponse(internal, requestModel);
             }
             if (format === "gemini") {
-                return buildGeminiResponse(internal.content, internal.finishReason ?? defaultFinishReason(format), resolvedUsage, internal.model ?? requestModel);
+                return buildGeminiResponse(internal.content, internal.finishReason ?? defaultFinishReason(format), resolvedUsage, internal.model ?? requestModel, internal.toolCalls);
             }
             return serializeOpenAIResponse(internal, requestModel);
         }

package/dist/server/routes/geminiProxyRoutes.js

@@ -184,7 +184,12 @@ export function createGeminiProxyRoutes(modelRouter, basePath = "", _loopbackPor
                     // --- Dispatch via shared translation engine ---
                     try {
                         if (stream) {
-                            return handleTranslatedStreamRequest({
+                            // Awaited, not returned bare: `handleTranslatedStreamRequest` is
+                            // async, so a rejection raised before the Response exists would
+                            // escape this try/catch and land in `app.onError`, which answers
+                            // in Anthropic's error shape. A Gemini client parsing that finds
+                            // no `error.message` and reports an empty failure.
+                            return await handleTranslatedStreamRequest({
                                 ctx,
                                 format: "gemini",
                                 requestModel: modelId,

package/dist/types/proxy.d.ts

@@ -2773,15 +2773,6 @@ export type OpenAIErrorResponse = {
     };
 };
 /** Parsed OpenAI request — intermediate form for NeuroLink pipeline. */
-/**
- * A Gemini `generateContent` request, reduced to what translation needs.
- *
- * Google's shape differs from both others in three ways that matter here:
- * roles are `user`/`model` rather than `user`/`assistant`, the system prompt
- * lives in a sibling `systemInstruction` rather than in the turn list, and
- * generation settings are nested under `generationConfig` instead of sitting
- * at the top level.
- */
 /** One part of a Gemini `contents[].parts[]` entry. */
 export type ProxyGeminiPart = {
     text?: string;
@@ -2794,6 +2785,15 @@ export type ProxyGeminiContent = {
     role?: string;
     parts?: ProxyGeminiPart[];
 };
+/**
+ * A Gemini `generateContent` request, reduced to what translation needs.
+ *
+ * Google's shape differs from both others in three ways that matter here:
+ * roles are `user`/`model` rather than `user`/`assistant`, the system prompt
+ * lives in a sibling `systemInstruction` rather than in the turn list, and
+ * generation settings are nested under `generationConfig` instead of sitting
+ * at the top level.
+ */
 export type ParsedGeminiRequest = {
     model: string;
     maxTokens?: number;

package/dist/utils/fileDetector.js

@@ -5,7 +5,8 @@
  */
 import { open, readFile, realpath } from "fs/promises";
 import { basename, isAbsolute as isAbsolutePath, relative as relativePath, resolve as resolvePath, sep, } from "path";
-import { getGlobalDispatcher, interceptors, request } from "undici";
+import { request } from "undici";
+import { redirectFollowingDispatcher } from "./redirectDispatcher.js";
 // Lazy-loaded processor singletons — avoids loading heavy media deps
 // (mediabunny, fluent-ffmpeg, music-metadata, adm-zip) on every generate() call.
 async function getVideoProcessor() {
@@ -1519,7 +1520,7 @@ export class FileDetector {
         if (getCachedUrlContentType(url, Date.now()) === undefined) {
             try {
                 const head = await request(url, {
-                    dispatcher: getGlobalDispatcher().compose(interceptors.redirect({ maxRedirections: 5 })),
+                    dispatcher: redirectFollowingDispatcher(5),
                     method: "HEAD",
                     headersTimeout: FileDetector.DEFAULT_HEAD_TIMEOUT,
                     bodyTimeout: FileDetector.DEFAULT_HEAD_TIMEOUT,
@@ -1550,7 +1551,7 @@ export class FileDetector {
         return withRetry(async () => {
             try {
                 const response = await request(url, {
-                    dispatcher: getGlobalDispatcher().compose(interceptors.redirect({ maxRedirections: 5 })),
+                    dispatcher: redirectFollowingDispatcher(5),
                     method: "GET",
                     headersTimeout: timeout,
                     bodyTimeout: timeout,
@@ -2283,7 +2284,7 @@ class MimeTypeStrategy {
                 // dump() can't hang detection, per the project's async-timeout guideline.
                 contentType = await withTimeout((async () => {
                     const response = await request(input, {
-                        dispatcher: getGlobalDispatcher().compose(interceptors.redirect({ maxRedirections: 5 })),
+                        dispatcher: redirectFollowingDispatcher(5),
                         method: "HEAD",
                         headersTimeout: FileDetector.DEFAULT_HEAD_TIMEOUT,
                         bodyTimeout: FileDetector.DEFAULT_HEAD_TIMEOUT,

package/dist/utils/messageBuilder.js

@@ -1,6 +1,7 @@
 import { existsSync, readFileSync, statSync } from "fs";
 import { readFile as readFileAsync, stat as statAsync } from "fs/promises";
-import { getGlobalDispatcher, interceptors, request } from "undici";
+import { request } from "undici";
+import { redirectFollowingDispatcher } from "./redirectDispatcher.js";
 import { MultimodalLogger, ProviderImageAdapter, } from "../adapters/providerImageAdapter.js";
 import { CONVERSATION_INSTRUCTIONS, STRUCTURED_OUTPUT_INSTRUCTIONS, } from "../config/conversationMemory.js";
 import { getAvailableInputTokens } from "../constants/contextWindows.js";
@@ -1660,7 +1661,7 @@ async function downloadImageFromUrl(url) {
     await urlDownloadRateLimiter.acquire();
     try {
         const response = await request(url, {
-            dispatcher: getGlobalDispatcher().compose(interceptors.redirect({ maxRedirections: 5 })),
+            dispatcher: redirectFollowingDispatcher(5),
             method: "GET",
             headersTimeout: 10000, // 10 second timeout for headers
             bodyTimeout: 30000, // 30 second timeout for body,

package/dist/utils/redirectDispatcher.d.ts

@@ -0,0 +1,28 @@
+import type { Dispatcher } from "undici";
+/**
+ * A dispatcher that follows redirects, when composing one is safe here.
+ *
+ * `getGlobalDispatcher()` returns Node's **built-in** undici dispatcher, whose
+ * major tracks the runtime rather than this package's dependency. The composed
+ * result is then passed to the **npm** undici's `request()`, and the two majors
+ * do not share a handler contract:
+ *
+ *   node 24   built-in 7.24.4 + npm 7.28.0   request() succeeds
+ *   node 22   built-in 6.28.0 + npm 7.28.0   throws "invalid onError method"
+ *
+ * Node 22 is this package's declared minimum, so the broken combination is not
+ * exotic — it is the floor. The throw happens at request time rather than at
+ * compose(), which is why it surfaces as an opaque runtime error instead of
+ * something recognisably about versions.
+ *
+ * When the majors disagree, return the global dispatcher uncomposed. That drops
+ * redirect-following from the pre-flight HEAD only. Callers already treat any
+ * non-2xx HEAD — a redirect included — as untrustworthy and fall through to the
+ * streaming size guard on the GET, so the size protection is unchanged and the
+ * cost is one extra round trip.
+ *
+ * Composing onto the global dispatcher rather than a fresh `Agent` is
+ * deliberate: it preserves whatever the host application configured globally,
+ * such as a corporate ProxyAgent.
+ */
+export declare function redirectFollowingDispatcher(maxRedirections: number): Dispatcher;

package/dist/utils/redirectDispatcher.js

@@ -0,0 +1,43 @@
+import { getGlobalDispatcher, interceptors } from "undici";
+/**
+ * The major of the `undici` this package depends on.
+ *
+ * `dependencies.undici` is `>=7.24.0 <8.0.0`, and `pnpm.overrides` maps
+ * `undici@>=8.0.0` back into that same range, so major 7 is a declared
+ * invariant rather than an observation. Update both together if it ever moves.
+ */
+const NPM_UNDICI_MAJOR = 7;
+/**
+ * A dispatcher that follows redirects, when composing one is safe here.
+ *
+ * `getGlobalDispatcher()` returns Node's **built-in** undici dispatcher, whose
+ * major tracks the runtime rather than this package's dependency. The composed
+ * result is then passed to the **npm** undici's `request()`, and the two majors
+ * do not share a handler contract:
+ *
+ *   node 24   built-in 7.24.4 + npm 7.28.0   request() succeeds
+ *   node 22   built-in 6.28.0 + npm 7.28.0   throws "invalid onError method"
+ *
+ * Node 22 is this package's declared minimum, so the broken combination is not
+ * exotic — it is the floor. The throw happens at request time rather than at
+ * compose(), which is why it surfaces as an opaque runtime error instead of
+ * something recognisably about versions.
+ *
+ * When the majors disagree, return the global dispatcher uncomposed. That drops
+ * redirect-following from the pre-flight HEAD only. Callers already treat any
+ * non-2xx HEAD — a redirect included — as untrustworthy and fall through to the
+ * streaming size guard on the GET, so the size protection is unchanged and the
+ * cost is one extra round trip.
+ *
+ * Composing onto the global dispatcher rather than a fresh `Agent` is
+ * deliberate: it preserves whatever the host application configured globally,
+ * such as a corporate ProxyAgent.
+ */
+export function redirectFollowingDispatcher(maxRedirections) {
+    const globalDispatcher = getGlobalDispatcher();
+    const builtinMajor = Number.parseInt(process.versions.undici?.split(".")[0] ?? "", 10);
+    if (!Number.isFinite(builtinMajor) || builtinMajor !== NPM_UNDICI_MAJOR) {
+        return globalDispatcher;
+    }
+    return globalDispatcher.compose(interceptors.redirect({ maxRedirections }));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@juspay/neurolink",
-  "version": "11.18.1",
+  "version": "11.18.3",
   "packageManager": "pnpm@10.15.1",
   "description": "TypeScript AI SDK with 24+ LLM providers behind one consistent API. MCP-native (connect any MCP server), voice TTS/STT/realtime, RAG, agents, memory, context compaction. OpenAI · Anthropic · Gemini · Bedrock · Azure · Ollama · DeepSeek · NVIDIA NIM and more.",
   "author": {