@juspay/neurolink 12.26.0 → 12.26.2

package/dist/mcp/externalServerManager.js

@@ -1702,11 +1702,25 @@ export class ExternalServerManager extends EventEmitter {
             instance.metrics.averageResponseTime =
                 totalTime / instance.metrics.totalToolCalls;
             if (result.success) {
-                mcpLogger.debug(`[ExternalServerManager] Tool executed successfully: ${toolName} on ${serverId}`, {
+                // A resolved `{ isError: true }` still comes back with success:true so
+                // the caller receives the MCP error payload as-is, but it is a failed
+                // call for telemetry: label mcp_tool_calls_total accordingly instead
+                // of counting every resolved error as a success.
+                const resolvedError = result.isErrorResult === true;
+                if (resolvedError) {
+                    // Keep this instance's totalErrors (and the getStatistics() /
+                    // getExternalMCPStatistics() it feeds) consistent with the breaker,
+                    // TelemetryService and ToolDiscoveryService's failedCalls, all of
+                    // which already count a resolved isError result as a failure.
+                    instance.metrics.totalErrors++;
+                }
+                mcpLogger.debug(resolvedError
+                    ? `[ExternalServerManager] Tool returned a resolved MCP error: ${toolName} on ${serverId}`
+                    : `[ExternalServerManager] Tool executed successfully: ${toolName} on ${serverId}`, {
                     duration,
                 });
                 try {
-                    TelemetryService.getInstance()?.recordMCPToolCall(toolName, duration, true);
+                    TelemetryService.getInstance()?.recordMCPToolCall(toolName, duration, !resolvedError);
                 }
                 catch {
                     /* telemetry should not break execution */

package/dist/mcp/mcpCircuitBreaker.d.ts

@@ -21,9 +21,30 @@ export declare class MCPCircuitBreaker extends EventEmitter {
     private cleanupTimer?;
     constructor(name: string, config?: Partial<CircuitBreakerConfig>);
     /**
-     * Execute an operation with circuit breaker protection
-     */
-    execute<T>(operation: () => Promise<T>): Promise<T>;
+     * Execute an operation with circuit breaker protection.
+     *
+     * `operation` is handed a `recordResolvedFailure` callback so it can flag a
+     * *resolved* result as a logical failure without throwing. This matters for
+     * MCP tool calls: the client does not throw on a protocol error, it
+     * resolves with `{ isError: true, ... }`. Before this callback existed,
+     * such a call always fell through to the success path below — the breaker
+     * could never open for a tool that only ever "fails" by resolving an error
+     * result, and callers still need that resolved value returned as-is (not
+     * replaced by a thrown transport error). Call `recordResolvedFailure()`
+     * from inside `operation` when that resolved value represents a failure;
+     * the call is still counted as a normal, non-throwing success from the
+     * `Promise.race` below, so this callback is what tells `execute()`
+     * otherwise. Callers that never call it see no behavior change.
+     */
+    execute<T>(operation: (recordResolvedFailure: (reason?: string) => void) => Promise<T>): Promise<T>;
+    /**
+     * Shared bookkeeping for a failed outcome — a thrown error, or a resolved
+     * result the caller flagged via `recordResolvedFailure`. Records the call
+     * as a failure, emits `callFailure`, and runs the state transitions that
+     * used to live inline in the `catch` block: half-open failure immediately
+     * re-opens the circuit; closed checks the failure threshold.
+     */
+    private recordFailureOutcome;
     /**
      * Record a call in the history
      */

package/dist/mcp/mcpCircuitBreaker.js

@@ -46,7 +46,20 @@ export class MCPCircuitBreaker extends EventEmitter {
         this.cleanupTimer = setInterval(() => this.cleanupCallHistory(), 60000);
     }
     /**
-     * Execute an operation with circuit breaker protection
+     * Execute an operation with circuit breaker protection.
+     *
+     * `operation` is handed a `recordResolvedFailure` callback so it can flag a
+     * *resolved* result as a logical failure without throwing. This matters for
+     * MCP tool calls: the client does not throw on a protocol error, it
+     * resolves with `{ isError: true, ... }`. Before this callback existed,
+     * such a call always fell through to the success path below — the breaker
+     * could never open for a tool that only ever "fails" by resolving an error
+     * result, and callers still need that resolved value returned as-is (not
+     * replaced by a thrown transport error). Call `recordResolvedFailure()`
+     * from inside `operation` when that resolved value represents a failure;
+     * the call is still counted as a normal, non-throwing success from the
+     * `Promise.race` below, so this callback is what tells `execute()`
+     * otherwise. Callers that never call it see no behavior change.
      */
     async execute(operation) {
         const startTime = Date.now();
@@ -91,11 +104,29 @@ export class MCPCircuitBreaker extends EventEmitter {
                     });
                 }
             }
+            // resolvedFailureReason is set (via recordResolvedFailure, passed into
+            // operation() below) when operation() resolves normally but represents
+            // a logical failure — e.g. an MCP tool call that resolved
+            // { isError: true } instead of throwing. It is call-scoped (a local,
+            // not instance state), so concurrent execute() calls on the same
+            // breaker (the same tool invoked in parallel) can't cross-contaminate
+            // each other's outcome.
+            let resolvedFailureReason;
+            const recordResolvedFailure = (reason) => {
+                resolvedFailureReason = reason || "Operation resolved a failure result";
+            };
             // Execute operation with timeout
             const result = await Promise.race([
-                operation(),
+                operation(recordResolvedFailure),
                 this.timeoutPromise(this.config.operationTimeout),
             ]);
+            if (resolvedFailureReason !== undefined) {
+                // Same bookkeeping as a thrown error below, but the resolved value
+                // is still returned to the caller unchanged — no transport error is
+                // synthesized for a result the protocol itself resolved successfully.
+                this.recordFailureOutcome(resolvedFailureReason, Date.now() - startTime);
+                return result;
+            }
             // Record successful call
             this.recordCall(true, Date.now() - startTime);
             // Handle half-open success
@@ -111,26 +142,34 @@ export class MCPCircuitBreaker extends EventEmitter {
         catch (error) {
             // Record failed call
             const duration = Date.now() - startTime;
-            this.recordCall(false, duration);
             const errorMessage = error instanceof Error ? error.message : String(error);
-            // Emit failure event
-            this.emit("callFailure", {
-                error: errorMessage,
-                duration,
-                timestamp: new Date(),
-            });
-            // Handle state transitions on failure
-            if (this.state === "half-open") {
-                // Failure in half-open immediately opens circuit
-                this.changeState("open", `Half-open test failed: ${errorMessage}`);
-            }
-            else if (this.state === "closed") {
-                // Check if we should open the circuit
-                this.checkFailureThreshold();
-            }
+            this.recordFailureOutcome(errorMessage, duration);
             throw error;
         }
     }
+    /**
+     * Shared bookkeeping for a failed outcome — a thrown error, or a resolved
+     * result the caller flagged via `recordResolvedFailure`. Records the call
+     * as a failure, emits `callFailure`, and runs the state transitions that
+     * used to live inline in the `catch` block: half-open failure immediately
+     * re-opens the circuit; closed checks the failure threshold.
+     */
+    recordFailureOutcome(reason, duration) {
+        this.recordCall(false, duration);
+        this.emit("callFailure", {
+            error: reason,
+            duration,
+            timestamp: new Date(),
+        });
+        if (this.state === "half-open") {
+            // Failure in half-open immediately opens circuit
+            this.changeState("open", `Half-open test failed: ${reason}`);
+        }
+        else if (this.state === "closed") {
+            // Check if we should open the circuit
+            this.checkFailureThreshold();
+        }
+    }
     /**
      * Record a call in the history
      */

package/dist/mcp/toolDiscoveryService.js

@@ -435,8 +435,13 @@ export class ToolDiscoveryService extends EventEmitter {
                 resetTimeout: 30000,
                 operationTimeout: effectiveTimeout,
             });
-            // Execute tool with circuit breaker protection
-            const result = await circuitBreaker.execute(async () => {
+            // Execute tool with circuit breaker protection. `recordResolvedFailure`
+            // lets the callback below tell the breaker that a *resolved* MCP
+            // isError result is a failure — the MCP client does not throw on a
+            // protocol error, so without this the breaker would only ever see a
+            // clean resolve and could never open for a tool that fails this way.
+            let isErrorResultDetected = false;
+            const result = await circuitBreaker.execute(async (recordResolvedFailure) => {
                 return mcpTracer.startActiveSpan("neurolink.mcp.callTool", {
                     kind: SpanKind.CLIENT,
                     attributes: {
@@ -479,6 +484,11 @@ export class ToolDiscoveryService extends EventEmitter {
                                 code: SpanStatusCode.ERROR,
                                 message: errorText || `Tool ${toolName} returned isError`,
                             });
+                            // NLK: count a resolved isError result as a breaker failure
+                            // and label completion telemetry as error below — without
+                            // throwing, so the protocol result is still returned as-is.
+                            isErrorResultDetected = true;
+                            recordResolvedFailure(errorText || `Tool ${toolName} returned isError`);
                         }
                         else {
                             callSpan.setStatus({ code: SpanStatusCode.OK });
@@ -528,8 +538,13 @@ export class ToolDiscoveryService extends EventEmitter {
                 });
             });
             const duration = Date.now() - startTime;
-            // Update tool statistics
-            this.updateToolStats(toolKey, true, duration);
+            // Update tool statistics. A resolved isError result is a failed call
+            // for completion telemetry purposes even though the wrapper below
+            // still returns success:true / data:result unchanged — flipping
+            // `success` here would make externalServerManager.executeTool() throw
+            // instead of returning the resolved MCP error, which is exactly the
+            // "thrown transport error" this fix must not introduce.
+            this.updateToolStats(toolKey, !isErrorResultDetected, duration);
             // Validate output if requested
             if (options.validateOutput !== false) {
                 this.validateToolOutput(result);
@@ -541,6 +556,7 @@ export class ToolDiscoveryService extends EventEmitter {
             return {
                 success: true,
                 data: result,
+                isErrorResult: isErrorResultDetected,
                 duration,
                 metadata: {
                     toolName,

package/dist/server/routes/claudeProxyRoutes.js

@@ -531,6 +531,46 @@ function claimTransientRateLimitRetry(accountKey, coolingUntil, now = Date.now()
     budget.retriesClaimed += 1;
     return budget.retriesClaimed;
 }
+/**
+ * Claims one same-account retry after a transient rate limit and returns its
+ * delay, or undefined once this request's retries or the account's shared
+ * budget are spent. Both the HTTP 429 and the in-stream rate-limit paths use
+ * it, so a burst is paced the same way however it arrives.
+ */
+function claimTransientRateLimitRetryDelay(accountKey, coolingUntil, retryAfterMs, retriesThisRequest) {
+    const slot = claimTransientRateLimitRetry(accountKey, coolingUntil);
+    if (retryAfterMs === undefined ||
+        retriesThisRequest >= MAX_RATE_LIMIT_SAME_ACCOUNT_RETRIES ||
+        slot === undefined) {
+        return undefined;
+    }
+    const base = Math.min(retryAfterMs || 1_000, MAX_RATE_LIMIT_RETRY_DELAY_MS);
+    // Stagger the two shared slots, then cap after jitter so the final sleep
+    // never exceeds the configured maximum.
+    return {
+        slot,
+        delayMs: Math.min(MAX_RATE_LIMIT_RETRY_DELAY_MS, jitteredDelay(base * slot)),
+    };
+}
+/**
+ * A same-account retry that was served shows the burst is over. Without this
+ * the burst cooldown outlives it, the session's next request goes to another
+ * account and loses its prompt cache — the A→B→A bounce this retry exists to
+ * prevent. Only a transient cooldown is lifted: an exhaustion cooldown that a
+ * concurrent request recorded meanwhile stays.
+ */
+function liftTransientCooldownAfterServedRetry(account, state) {
+    transientRateLimitRetryBudgets.delete(account.key);
+    if (state.coolingReason !== "transient" || !state.coolingUntil) {
+        return;
+    }
+    const previousCoolingUntil = state.coolingUntil;
+    state.coolingUntil = undefined;
+    state.coolingReason = undefined;
+    clearAccountCooldown(account.key, previousCoolingUntil).catch(() => {
+        // Best-effort: routing already reads the cleared in-memory state.
+    });
+}
 function claimTransientCooldownAdmission(accountKey, coolingUntil, now = Date.now()) {
     if (coolingUntil <= now) {
         return 0;
@@ -4978,8 +5018,10 @@ async function handleAnthropicStreamingSuccessResponse(args) {
         const logicalStatus = isRateLimit ? 429 : 502;
         const quota = parseQuotaHeaders(responseHeaders, { model: body.model });
         const now = Date.now();
+        let sameAccountRetry;
         if (isRateLimit) {
-            const cooldownPlan = planCooldownFor429(quota, parseRetryAfterMs(responseHeaders["retry-after"] ?? null), now, getUnifiedRateLimitStatus(responseHeaders), overagePolicy, typeof body.model === "string" ? body.model : undefined);
+            const retryAfterMs = parseRetryAfterMs(responseHeaders["retry-after"] ?? null);
+            const cooldownPlan = planCooldownFor429(quota, retryAfterMs, now, getUnifiedRateLimitStatus(responseHeaders), overagePolicy, typeof body.model === "string" ? body.model : undefined);
             accountState.quota = quota
                 ? mergeQuotaSnapshot(accountState.quota, quota)
                 : accountState.quota;
@@ -4999,6 +5041,12 @@ async function handleAnthropicStreamingSuccessResponse(args) {
                 rateLimitKind,
                 cooldownReason: cooldownPlan.reason,
             });
+            if (!cooldownPlan.rotateImmediately) {
+                sameAccountRetry = {
+                    coolingUntil: cooldownPlan.coolingUntil,
+                    retryAfterMs,
+                };
+            }
         }
         else {
             recordAttemptError(account.label, account.type, logicalStatus);
@@ -5006,7 +5054,7 @@ async function handleAnthropicStreamingSuccessResponse(args) {
                 retryable: true,
             });
         }
-        logger.always(`[proxy] immediate SSE ${preflight.errorType} account=${account.label}: ${preflight.message}; rotating before client commit`);
+        logger.always(`[proxy] immediate SSE ${preflight.errorType} account=${account.label}: ${preflight.message}; ${sameAccountRetry ? "transient, same account may retry" : "rotating"} before client commit`);
         tracer?.recordRetry(account.label, isRateLimit
             ? "stream_rate_limit_before_commit"
             : "stream_error_before_commit");
@@ -5035,6 +5083,7 @@ async function handleAnthropicStreamingSuccessResponse(args) {
                 ...(preflight.errorType === "overloaded_error"
                     ? { retryDelayMs: getOverloadRotationDelayMs(attemptNumber) }
                     : {}),
+                ...(sameAccountRetry ? { sameAccountRetry } : {}),
             },
         };
     }
@@ -7371,21 +7420,13 @@ async function handleAnthropicRoutedClaudeRequest(args) {
                             // Transient retries are budgeted across all concurrent requests for
                             // this account/window. Exhaustion plans rotate immediately and never
                             // claim this budget.
-                            const sharedRetrySlot = fetchResult.retrySameAccount
-                                ? claimTransientRateLimitRetry(account.key, plan.coolingUntil)
+                            const retry = fetchResult.retrySameAccount
+                                ? claimTransientRateLimitRetryDelay(account.key, plan.coolingUntil, fetchResult.retryAfterMs, rateLimitSameAccountRetries)
                                 : undefined;
-                            if (fetchResult.retrySameAccount &&
-                                fetchResult.retryAfterMs !== undefined &&
-                                rateLimitSameAccountRetries <
-                                    MAX_RATE_LIMIT_SAME_ACCOUNT_RETRIES &&
-                                sharedRetrySlot !== undefined) {
+                            if (retry) {
                                 rateLimitSameAccountRetries += 1;
-                                const base = Math.min(fetchResult.retryAfterMs || 1_000, MAX_RATE_LIMIT_RETRY_DELAY_MS);
-                                // Stagger the two shared slots, then cap after jitter so the final
-                                // sleep never exceeds the configured maximum.
-                                const delayMs = Math.min(MAX_RATE_LIMIT_RETRY_DELAY_MS, jitteredDelay(base * sharedRetrySlot));
-                                logger.always(`[proxy] retrying same account=${account.label} after transient 429 (shared slot ${sharedRetrySlot}/${MAX_RATE_LIMIT_SAME_ACCOUNT_RETRIES}) in ${delayMs}ms`);
-                                await sleep(delayMs);
+                                logger.always(`[proxy] retrying same account=${account.label} after transient 429 (shared slot ${retry.slot}/${MAX_RATE_LIMIT_SAME_ACCOUNT_RETRIES}) in ${retry.delayMs}ms`);
+                                await sleep(retry.delayMs);
                                 continue;
                             }
                             // Exhaustion, or the shared transient retry budget being used up:
@@ -7560,6 +7601,16 @@ async function handleAnthropicRoutedClaudeRequest(args) {
                             loopState.sawRateLimit ||= successResult.failure.rateLimit;
                             loopState.sawTransientFailure ||=
                                 !successResult.failure.rateLimit;
+                            const { sameAccountRetry } = successResult.failure;
+                            const retry = sameAccountRetry
+                                ? claimTransientRateLimitRetryDelay(account.key, sameAccountRetry.coolingUntil, sameAccountRetry.retryAfterMs, rateLimitSameAccountRetries)
+                                : undefined;
+                            if (retry) {
+                                rateLimitSameAccountRetries += 1;
+                                logger.always(`[proxy] retrying same account=${account.label} after transient in-stream rate limit (shared slot ${retry.slot}/${MAX_RATE_LIMIT_SAME_ACCOUNT_RETRIES}) in ${retry.delayMs}ms`);
+                                await sleep(retry.delayMs);
+                                continue;
+                            }
                             if (hasNextAccount && successResult.failure.retryDelayMs) {
                                 logger.always(`[proxy] pacing cross-account SSE overload rotation for ${successResult.failure.retryDelayMs}ms`);
                                 await sleep(successResult.failure.retryDelayMs);
@@ -7569,6 +7620,9 @@ async function handleAnthropicRoutedClaudeRequest(args) {
                     }
                     admissionTransferredToStream =
                         successResult.holdsAccountAdmission === true;
+                    if (successResult.served && rateLimitSameAccountRetries > 0) {
+                        liftTransientCooldownAfterServedRetry(account, accountState);
+                    }
                     if (bindServedSession && successResult.served) {
                         bindServedSession(account.key);
                     }

package/dist/types/externalMcp.d.ts

@@ -234,6 +234,13 @@ export type ExternalMCPToolResult = {
     data?: unknown;
     /** Error message if failed */
     error?: string;
+    /**
+     * True when the call completed at the transport level but the MCP result
+     * itself is `{ isError: true }`. `success` stays true for such results so
+     * the resolved MCP error payload still reaches the caller unchanged; this
+     * flag is what lets stats and telemetry count the call as a failure.
+     */
+    isErrorResult?: boolean;
     /** Execution duration in milliseconds */
     duration: number;
     /** Tool execution metadata */

package/dist/types/proxy.d.ts

@@ -1128,6 +1128,15 @@ export type AnthropicSuccessResult = {
         message: string;
         rateLimit: boolean;
         retryDelayMs?: number;
+        /**
+         * Set only for a transient (burst) rate limit: the attempt loop may
+         * retry the same account within the shared budget before rotating,
+         * exactly as it does for an HTTP 429.
+         */
+        sameAccountRetry?: {
+            coolingUntil: number;
+            retryAfterMs: number;
+        };
     };
 } | {
     response: Response | unknown;

package/docs-site/static/search-index.json

@@ -2884,7 +2884,7 @@
 {"objectID":"d3e03ca160a62086a328b7f6782dd27a4cc252801bd4ebbf6c6b15961a0dd314","title":"Account 3: API key for fallback","url":"/docs/features/claude-proxy#account-3-api-key-for-fallback","content":"neurolink auth login anthropic --method api-key --add --label api\n`","hierarchy":{"lvl0":"Features","lvl1":"Claude Proxy","lvl2":"Account 3: API key for fallback","lvl3":""}},
 {"objectID":"2167cdac36707378e3d95b4ae7f07988af5ef02cf9d09b8809b897263316efcc","title":"How accounts are selected","url":"/docs/features/claude-proxy#how-accounts-are-selected","content":"The proxy discovers accounts in this order:\nCompound keys from TokenStore (e.g., , )\nLegacy credentials file (if no compound keys exist)\nenvironment variable (if no other accounts exist)\n\nWhen  is configured, this discovery happens only within the allowed set. A disabled or unavailable TokenStore account does not cause the proxy to activate a legacy file or environment key while TokenStore entries still exist.\n\nWithin the account pool, the proxy uses fill-first routing: it always tries the first non-cooling account and only switches on failure. This avoids unnecessary identity switches that could confuse Claude Code's session state.","hierarchy":{"lvl0":"Features","lvl1":"Claude Proxy","lvl2":"How accounts are selected","lvl3":""}},
 {"objectID":"8c3a17a43510fb3eeca918e6c91dd4f38f37f0392e1440e021488aefa1e56b80","title":"Model-scoped weekly limits","url":"/docs/features/claude-proxy#model-scoped-weekly-limits","content":"Some plans cap a specific model separately from the overall weekly window — a\nFable-only weekly allowance, for instance. Anthropic reports that cap as its own\nheader family (), sent only on responses\nfor the model it applies to, so the proxy learns about it from live traffic\nrather than needing a refresh.\n\nRouting treats a spent model-scoped cap as per-model, never per-account:\nAn account whose cap for the requested model is spent is skipped for that\n  model only. It stays fully available for every other model, and no cooldown\n  is set — cooling is account-wide and would wrongly withhold a healthy account.\nAmong accounts that do have headroom, the one closest to spending its\n  allowance is preferred, so the pool finishes an allowance rather than spreading\n  across all of them. This rung only applies when both candidates report a window\n  for the model.\nIf every account has spent the cap, the request is not attempted. The\n  client gets a  naming the model, the real reset time, and that other\n  models remain available — switch model, or add an account with headroom.\nA scoped window older than the quota freshness budget is ignored, so stale or\n  mis-parsed data can never take the pool down. Routing falls back to attempting\n  the request.\n\n shows any scoped window under its account, and\n returns the full  array.","hierarchy":{"lvl0":"Features","lvl1":"Claude Proxy","lvl2":"Model-scoped weekly limits","lvl3":""}},
-{"objectID":"971d8917e081ed8fe1f30633edee82462617b534a0645dd9f370c37c0769494f","title":"Cooldown and backoff","url":"/docs/features/claude-proxy#cooldown-and-backoff","content":"When an account encounters an error, it enters a cooldown period based on the error type:\n\n| Failure                                                | Cooldown                                           | Behavior                                         |\n| ------------------------------------------------------ | -------------------------------------------------- | ------------------------------------------------ |\n| Authoritative unified, 5-hour, or 7-day rejection      | Upstream reset or , capped per reason | Persist cooldown and rotate immediately          |\n| Transient burst 429                                    | Upstream delay, capped at 15 minutes               | At most 2 same-account retries, then rotate      |\n| Refresh credential rejection (///) | Disabled until explicit login                      | Rotate without retrying an invalid refresh token |\n| Refresh network, , or                        | 30 seconds to 5 minutes                            | Persist auth cooldown and rotate                 |\n| Upstream  or network error                        | Bounded same-account retries                       | Rotate after retry budget                        |\n\nCooldown updates are extend-only: a late concurrent response cannot shorten a longer known reset window.\n\nEach cooldown is also capped by what its reason can mean — a  cooldown\ndescribes a 5-hour window, so it can never run for days no matter what reset the\nupstream reports. The cap is applied when the cooldown is written and again when\nit is read back from disk, so an entry written by an older build heals itself on\nload and logs that it did:\n\nUse  to see what is currently parked, and\n to release one.","hierarchy":{"lvl0":"Features","lvl1":"Claude Proxy","lvl2":"Cooldown and backoff","lvl3":""}},
+{"objectID":"971d8917e081ed8fe1f30633edee82462617b534a0645dd9f370c37c0769494f","title":"Cooldown and backoff","url":"/docs/features/claude-proxy#cooldown-and-backoff","content":"When an account encounters an error, it enters a cooldown period based on the error type:\n\n| Failure                                                         | Cooldown                                           | Behavior                                         |\n| --------------------------------------------------------------- | -------------------------------------------------- | ------------------------------------------------ |\n| Authoritative unified, 5-hour, or 7-day rejection               | Upstream reset or , capped per reason | Persist cooldown and rotate immediately          |\n| Transient burst 429, as a status or as the stream's first event | Upstream delay, capped at 15 minutes               | At most 2 same-account retries, then rotate      |\n| Refresh credential rejection (///)          | Disabled until explicit login                      | Rotate without retrying an invalid refresh token |\n| Refresh network, , or                                 | 30 seconds to 5 minutes                            | Persist auth cooldown and rotate                 |\n| Upstream  or network error                                 | Bounded same-account retries                       | Rotate after retry budget                        |\n\nCooldown updates are extend-only: a late concurrent response cannot shorten a longer known reset window.\n\nThe one exception is a transient burst. When a same-account retry is served, the\nburst is over, so its cooldown is lifted and the session's next request stays on\nthat account instead of moving away and losing its prompt cache. An exhaustion\ncooldown recorded in the meantime is left in place.\n\nEach cooldown is also capped by what its reason can mean — a  cooldown\ndescribes a 5-hour window, so it can never run for days no matter what reset the\nupstream reports. The cap is applied when the cooldown is written and again when\nit is read back from disk, so an entry written by an older build heals itself on\nload and logs that it did:\n\nUse  to se","hierarchy":{"lvl0":"Features","lvl1":"Claude Proxy","lvl2":"Cooldown and backoff","lvl3":""}},
 {"objectID":"c95cca165ca71f8c198ba1ad405ec47ab1666e20d2d9ad4120139306226f26f0","title":"Error Handling","url":"/docs/features/claude-proxy#error-handling","content":"The proxy classifies upstream errors and applies different strategies:","hierarchy":{"lvl0":"Features","lvl1":"Claude Proxy","lvl2":"Error Handling","lvl3":""}},
 {"objectID":"7a743b6bb13366c925cd238d4853826a08f0b161659bcb0575d5b2e83709a2e5","title":"429 Rate Limit","url":"/docs/features/claude-proxy#429-rate-limit","content":"Treat top-level  as authoritative, even if sub-windows still say .\nPrefer the rejected 5-hour or 7-day reset and otherwise use .\nPersist the cooldown and rotate immediately for authoritative exhaustion.\nReturn the earliest recovery timestamp without another upstream request when all accounts are cooling.","hierarchy":{"lvl0":"Features","lvl1":"Claude Proxy","lvl2":"429 Rate Limit","lvl3":""}},
 {"objectID":"1522c22c8467bae6a5a51e9e4c4dca5792a7b45c457b0628ef5536d068d642b3","title":"401/402/403 Authentication Errors","url":"/docs/features/claude-proxy#401402403-authentication-errors","content":"OAuth accounts with refresh token: Serialize refresh, persist the new rotating token, and retry. A rejected refresh credential disables the account until re-authentication; transient refresh infrastructure errors cool and rotate.\nOAuth accounts without refresh token: Disable until re-authentication and rotate.\nAPI key accounts: Rotate after authentication failure.","hierarchy":{"lvl0":"Features","lvl1":"Claude Proxy","lvl2":"401/402/403 Authentication Errors","lvl3":""}},

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@juspay/neurolink",
-  "version": "12.26.0",
+  "version": "12.26.2",
   "packageManager": "pnpm@10.15.1",
   "description": "The pipe layer of an AI nervous system: one interface connecting provider neurons to your application, across three inference types — generate, stream and decide. `decide` returns typed, calibrated judgements from a non-generative model (~400ms, ~$0.00002/call) for routing, tool selection and context budgeting. MCP-native (4 transports), voice TTS/STT/realtime, RAG, agents, memory, compaction, 9 observability exporters. OpenAI · Anthropic · Gemini · Bedrock · Azure · Ollama · TypeSafe Jev and more.",
   "author": {
@@ -181,7 +181,7 @@
     "// CI tier — fast, no live AI calls, safe for every commit (test:unit; also see the separate provider-safety-net CI job, which runs build + test:providers-mocked + test:provider-structure + test:error-classifier-contract on every PR)": "",
     "test:tool-routing": "pnpm exec tsx test/continuous-test-suite-tool-routing.ts",
     "test:tool-routing-semantic": "pnpm exec tsx test/continuous-test-suite-tool-routing-semantic.ts",
-    "test:unit": "pnpm run test:bugfixes && pnpm run test:mcp:infra && pnpm run test:mcp:spans && pnpm run test:tool-routing && pnpm run test:tool-routing-cli && pnpm run test:tool-dedup && pnpm run test:model-pool && pnpm run test:classifier-router && pnpm run test:tool-routing-semantic && pnpm run test:mcp-result-cache && pnpm run test:mcp-direct-name-repair && pnpm run test:model-not-found-retryable && pnpm run test:archive:security && pnpm run test:office:security && pnpm run test:vector-chroma && pnpm run test:vector-pgvector && pnpm run test:vector-pinecone && pnpm run test:provider-wiring && pnpm run test:docs-mcp",
+    "test:unit": "pnpm run test:bugfixes && pnpm run test:mcp:infra && pnpm run test:mcp:spans && pnpm run test:tool-routing && pnpm run test:tool-routing-cli && pnpm run test:tool-dedup && pnpm run test:model-pool && pnpm run test:classifier-router && pnpm run test:tool-routing-semantic && pnpm run test:mcp-result-cache && pnpm run test:mcp-direct-name-repair && pnpm run test:mcp-breaker-resolved-errors && pnpm run test:model-not-found-retryable && pnpm run test:archive:security && pnpm run test:office:security && pnpm run test:vector-chroma && pnpm run test:vector-pgvector && pnpm run test:vector-pinecone && pnpm run test:provider-wiring && pnpm run test:docs-mcp",
     "// CI tier — live providers, runs only when API keys are present (test:credentials and test:dynamic make real provider calls when keys are set, so they live here, not in test:unit; test:matrix, a different suite covering the full provider capability matrix, runs nightly via .github/workflows/live-matrix.yml — test:providers itself is still only wired into test:live, not any GitHub Actions workflow)": "",
     "test:live": "pnpm run test:providers && pnpm run test:mcp:http && pnpm run test:mcp:sdk && pnpm run test:mcp:cli && pnpm run test:observability && pnpm run test:context && pnpm run test:memory && pnpm run test:tool-reliability && pnpm run test:evaluation && pnpm run test:autoresearch && pnpm run test:credentials && pnpm run test:dynamic",
     "// CI tier — product output (image/video/TTS/PPT) — costs $$ per run (not wired into any GitHub Actions workflow as of this comment; run manually or add to live-matrix.yml if nightly coverage is needed)": "",
@@ -243,6 +243,7 @@
     "test:multimodal": "pnpm run test:file-formats && pnpm run test:multimodal:sdk",
     "test:multimodal:sdk": "pnpm exec tsx test/continuous-test-suite-multimodal-sdk.ts",
     "test:mcp-result-cache": "pnpm exec tsx test/continuous-test-suite-mcp-result-cache.ts",
+    "test:mcp-breaker-resolved-errors": "pnpm exec tsx test/continuous-test-suite-mcp-breaker-resolved-errors.ts",
     "test:archive:security": "pnpm exec tsx test/continuous-test-suite-archive-security.ts",
     "test:office:security": "pnpm exec tsx test/continuous-test-suite-office-security.ts",
     "test:vision-image-format": "pnpm exec tsx test/continuous-test-suite-vision-image-format.ts",