@juspay/neurolink 12.26.2 → 12.26.3

package/dist/cli/index.js

@@ -10,6 +10,7 @@ process.env.DOTENV_CONFIG_QUIET = "true";
 import { initializeCliParser } from "./parser.js";
 import chalk from "chalk";
 import { initializeCliLifecycle, cleanupCliLifecycle } from "./lifecycle.js";
+import { loadProcessDotenv } from "../utils/dotenvBootstrap.js";
 // Clean up pnpm-specific environment variables that cause npm warnings
 // These variables are set by pnpm but cause "Unknown env config" warnings in npm
 if (process.env.npm_config_verify_deps_before_run) {
@@ -18,17 +19,11 @@ if (process.env.npm_config_verify_deps_before_run) {
 if (process.env.npm_config__jsr_registry) {
     delete process.env.npm_config__jsr_registry;
 }
-// Load environment variables from .env file
-// Suppress dotenv v17's stdout banner before importing — it pollutes CLI JSON output
-process.env.DOTENV_CONFIG_QUIET = "true";
-try {
-    const { config } = await import("dotenv");
-    config({ quiet: true });
-}
-catch {
-    // dotenv is not available (dev dependency only) - this is fine for production
-    // Environment variables should be set externally in production
-}
+// Load environment variables from .env file. Shared with the SDK entry
+// point; see dotenvBootstrap for why DOTENV_CONFIG_PATH has to be honoured
+// here too — a suite that drives the built CLI inherits the stripped
+// environment, and this is the process that would otherwise undo it.
+await loadProcessDotenv();
 // Enhanced CLI with Professional UX
 const cli = initializeCliParser();
 initializeCliLifecycle(async () => {

package/dist/neurolink.js

@@ -5,16 +5,12 @@
  * Enhanced AI provider system with natural MCP tool access.
  * Uses real MCP infrastructure for tool discovery and execution.
  */
-// Load environment variables from .env file (critical for SDK usage)
-// Suppress dotenv v17 stdout banner — it pollutes CLI JSON output
-try {
-    process.env.DOTENV_CONFIG_QUIET = process.env.DOTENV_CONFIG_QUIET ?? "true";
-    const { config: dotenvConfig } = await import("dotenv");
-    dotenvConfig({ quiet: true });
-}
-catch {
-    // Environment variables should be set externally in production
-}
+// Load environment variables from .env file (critical for SDK usage).
+// Shared with the CLI so the two implicit loads cannot drift apart again.
+// Neither honoured DOTENV_CONFIG_PATH, and they had already drifted in how
+// each suppressed dotenv's banner — one conditional, one unconditional.
+import { loadProcessDotenv } from "./utils/dotenvBootstrap.js";
+await loadProcessDotenv();
 import { SpanKind, SpanStatusCode, context, trace } from "@opentelemetry/api";
 import { AsyncLocalStorage } from "async_hooks";
 import { EventEmitter } from "events";

package/dist/utils/dotenvBootstrap.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Implicit `.env` bootstrap, shared by the SDK entry point and the CLI.
+ *
+ * Both sites used to call dotenv's `config()` with no options beyond
+ * `quiet`, and a direct `config()` call does NOT read `DOTENV_CONFIG_PATH`
+ * — only dotenv's own `dotenv/config` preload entry does. So the strip this
+ * repo documents and uses to vet suites,
+ *
+ *     env -i HOME=… PATH=… CI=true DOTENV_CONFIG_PATH=/dev/null …
+ *
+ * stripped nothing the moment a suite imported the built SDK: importing
+ * `dist/index.js` loads `src/lib/neurolink.ts`, which loaded `.env` from the
+ * working directory regardless. A credential the strip was supposed to
+ * remove was present at every read site, and a suite that only passes
+ * because of it looks identical to one that does not need it. See #1744;
+ * the CI-only failure in #1735 is what surfaced it.
+ *
+ * Honouring the variable here makes that strip real. It is additive: with
+ * `DOTENV_CONFIG_PATH` unset — which is every existing caller, SDK consumers
+ * included — this does exactly what it did before, loading `.env` from the
+ * current working directory. Only a caller that explicitly sets the variable
+ * sees a difference, and what it then sees is dotenv's own documented
+ * meaning for it.
+ */
+export declare function loadProcessDotenv(): Promise<void>;

package/dist/utils/dotenvBootstrap.js

@@ -0,0 +1,46 @@
+/**
+ * Implicit `.env` bootstrap, shared by the SDK entry point and the CLI.
+ *
+ * Both sites used to call dotenv's `config()` with no options beyond
+ * `quiet`, and a direct `config()` call does NOT read `DOTENV_CONFIG_PATH`
+ * — only dotenv's own `dotenv/config` preload entry does. So the strip this
+ * repo documents and uses to vet suites,
+ *
+ *     env -i HOME=… PATH=… CI=true DOTENV_CONFIG_PATH=/dev/null …
+ *
+ * stripped nothing the moment a suite imported the built SDK: importing
+ * `dist/index.js` loads `src/lib/neurolink.ts`, which loaded `.env` from the
+ * working directory regardless. A credential the strip was supposed to
+ * remove was present at every read site, and a suite that only passes
+ * because of it looks identical to one that does not need it. See #1744;
+ * the CI-only failure in #1735 is what surfaced it.
+ *
+ * Honouring the variable here makes that strip real. It is additive: with
+ * `DOTENV_CONFIG_PATH` unset — which is every existing caller, SDK consumers
+ * included — this does exactly what it did before, loading `.env` from the
+ * current working directory. Only a caller that explicitly sets the variable
+ * sees a difference, and what it then sees is dotenv's own documented
+ * meaning for it.
+ */
+export async function loadProcessDotenv() {
+    try {
+        // Suppress dotenv v17's stdout banner — it pollutes CLI JSON output.
+        // Redundant next to the explicit `quiet` below, which is what actually
+        // silences a direct `config()` call; kept because both call sites set it
+        // and something downstream may still read it.
+        process.env.DOTENV_CONFIG_QUIET = process.env.DOTENV_CONFIG_QUIET ?? "true";
+        const { config } = await import("dotenv");
+        const path = process.env.DOTENV_CONFIG_PATH;
+        // Pass `path` only when set: `{ path: undefined }` is not the same as
+        // omitting it for every dotenv version, and the default must stay
+        // byte-for-byte what it was.
+        config(path ? { quiet: true, path } : { quiet: true });
+    }
+    catch {
+        // dotenv ships as a normal runtime dependency (see package.json), so this
+        // branch should not be reachable in a standard install. It stays as a
+        // defensive fallback for an install that has pruned or bundled
+        // dependencies unusually, so a missing module degrades to "no .env
+        // loaded" instead of crashing the SDK/CLI entry point.
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@juspay/neurolink",
-  "version": "12.26.2",
+  "version": "12.26.3",
   "packageManager": "pnpm@10.15.1",
   "description": "The pipe layer of an AI nervous system: one interface connecting provider neurons to your application, across three inference types — generate, stream and decide. `decide` returns typed, calibrated judgements from a non-generative model (~400ms, ~$0.00002/call) for routing, tool selection and context budgeting. MCP-native (4 transports), voice TTS/STT/realtime, RAG, agents, memory, compaction, 9 observability exporters. OpenAI · Anthropic · Gemini · Bedrock · Azure · Ollama · TypeSafe Jev and more.",
   "author": {