@juspay/neurolink 12.36.0 → 12.37.0

package/CHANGELOG.md

@@ -1,8 +1,8 @@
-## [12.36.0](https://github.com/juspay/neurolink/compare/v12.35.5...v12.36.0) (2026-09-28)
+## [12.37.0](https://github.com/juspay/neurolink/compare/v12.36.1...v12.37.0) (2026-09-28)
 
 ### Features
 
-- **(proxy):** translate native Codex requests to Anthropic Messages shape ([70c11ea](https://github.com/juspay/neurolink/commit/70c11eaec4f2c792b401d1f1d70d6b24cfe57610))
+- **(proxy):** translate Anthropic responses and tool calls to the Codex wire format ([bef0c19](https://github.com/juspay/neurolink/commit/bef0c19db259cd2d5f6ee4816ef6d9bbf72c8271)), closes [#1842](https://github.com/juspay/neurolink/issues/1842)
 
 ## [11.2.3](https://github.com/juspay/neurolink/compare/v11.2.2...v11.2.3) (2026-08-19)
 

package/dist/agent/directTools.js

@@ -40,6 +40,14 @@ function withRoots(description, policy) {
  * `/home/app-evil` against `/home/app` gets through. A path that does not
  * exist yet is checked on its nearest existing ancestor, which is what a
  * write needs. Relative paths resolve against the first root.
+ *
+ * The result is a REAL path, and every consumer opens it with O_NOFOLLOW (or
+ * O_EXCL), so a link swapped in at the final component after this check is
+ * refused by the kernel — on Windows, which has no O_NOFOLLOW, only the
+ * O_EXCL create path keeps that guarantee. A directory component swapped for
+ * a link in that same window is not caught anywhere: Node exposes no
+ * openat/O_PATH walk, so that race is accepted here exactly as
+ * `FileDetector.loadFromPath` accepts it.
  */
 function resolveWithinFileToolRoots(target, policy) {
     const roots = rootsOf(policy);
@@ -65,6 +73,28 @@ function resolveWithinFileToolRoots(target, policy) {
 }
 /** Unavailable on Windows, where it is 0 and has no effect. */
 const O_NOFOLLOW = fs.constants.O_NOFOLLOW ?? 0;
+const SENSITIVE_SYSTEM_PATH_PREFIXES = [
+    "/etc/",
+    "/sys/",
+    "/proc/",
+    "/dev/",
+    "/root/",
+    "/.ssh/",
+    "/private/etc/",
+    "/private/var/",
+    "c:/windows/",
+    "c:/program files/",
+    "c:/programdata/",
+];
+/**
+ * Denylist of system directories analyzeCSV refuses even inside a permitted
+ * root. Expects an already-resolved real path, so what is judged is where the
+ * file actually lives rather than the name it was asked for by.
+ */
+function isSensitiveSystemPath(realPath) {
+    const normalized = realPath.toLowerCase().replace(/\\/g, "/");
+    return SENSITIVE_SYSTEM_PATH_PREFIXES.some((prefix) => normalized.startsWith(prefix));
+}
 /**
  * Write without following a symlink at the final path component. The root
  * check ran on the resolved path, so a link that appears there afterwards, or
@@ -238,6 +268,7 @@ function createReadFileTool(policy) {
         },
     });
 }
+/** List one directory inside the roots; entries are lstat'd, never followed. */
 function createListDirectoryTool(policy) {
     return tool({
         description: withRoots("List files and directories in a specified directory", policy),
@@ -263,12 +294,20 @@ function createListDirectoryTool(policy) {
                 const filteredItems = includeHidden
                     ? items
                     : items.filter((item) => !item.startsWith("."));
+                // lstat, not stat: an entry that is a symlink is reported as one, with
+                // its own metadata. Following it would leak the size and mtime of a
+                // target outside the roots, and a dangling link would fail the whole
+                // listing with ENOENT.
                 const itemDetails = filteredItems.map((item) => {
                     const itemPath = path.join(resolvedPath, item);
-                    const stats = fs.statSync(itemPath);
+                    const stats = fs.lstatSync(itemPath);
                     return {
                         name: item,
-                        type: stats.isDirectory() ? "directory" : "file",
+                        type: stats.isSymbolicLink()
+                            ? "symlink"
+                            : stats.isDirectory()
+                                ? "directory"
+                                : "file",
                         size: stats.isFile() ? stats.size : undefined,
                         lastModified: stats.mtime.toISOString(),
                     };
@@ -336,6 +375,10 @@ function createWriteFileTool(policy) {
         },
     });
 }
+/**
+ * Execute one analyzeCSV call: contain the path, parse the file without
+ * following a final-component link, then run the requested aggregation.
+ */
 async function runAnalyzeCSV({ filePath, operation, column, maxRows = 1000 }, policy) {
     const startTime = Date.now();
     logger.info(`[analyzeCSV] 🚀 START: file=${filePath}, operation=${operation}, column=${column}, maxRows=${maxRows}`);
@@ -353,7 +396,9 @@ async function runAnalyzeCSV({ filePath, operation, column, maxRows = 1000 }, po
         logger.info(`[analyzeCSV] Starting CSV parsing (max ${maxRows} rows)...`);
         // #384: parseCSVFile now returns validated Record<string, string |
         // undefined>[] rows, so the previous unchecked cast is unnecessary.
-        const rows = await CSVProcessor.parseCSVFile(resolvedPath, maxRows);
+        // The root check ran on the real path; O_NOFOLLOW refuses a link swapped
+        // in at the final component afterwards, as readFile does.
+        const rows = await CSVProcessor.parseCSVFile(resolvedPath, maxRows, undefined, { followSymlinks: false });
         logger.info(`[analyzeCSV] ✅ CSV parsing complete: ${rows.length} rows`);
         if (rows.length === 0) {
             logger.warn(`[analyzeCSV] No data rows found`);
@@ -557,6 +602,7 @@ async function runAnalyzeCSV({ filePath, operation, column, maxRows = 1000 }, po
         };
     }
 }
+/** The analyzeCSV tool bound to `policy`; its schema refuses paths the roots would. */
 function createAnalyzeCsvTool(policy) {
     return tool({
         description: withRoots("Analyze CSV file for accurate counting, aggregation, and statistical analysis. Use this for precise data operations like counting rows by column, calculating sums/averages, finding min/max values, etc. The tool reads the file directly - do NOT pass CSV content.", policy),
@@ -564,25 +610,13 @@ function createAnalyzeCsvTool(policy) {
             filePath: z
                 .string()
                 .refine((inputPath) => {
-                const resolvedPath = path.resolve(inputPath);
-                const normalizedPath = resolvedPath
-                    .toLowerCase()
-                    .replace(/\\/g, "/");
-                const sensitivePatterns = [
-                    "/etc/",
-                    "/sys/",
-                    "/proc/",
-                    "/dev/",
-                    "/root/",
-                    "/.ssh/",
-                    "/private/etc/",
-                    "/private/var/",
-                    "c:/windows/",
-                    "c:/program files/",
-                    "c:/programdata/",
-                ];
-                return (!sensitivePatterns.some((pattern) => normalizedPath.startsWith(pattern)) &&
-                    resolveWithinFileToolRoots(inputPath, policy).path !== undefined);
+                // Contain first, then apply the system-directory denylist to the
+                // REAL path the guard resolved: a relative path is thereby judged
+                // against the tool root rather than process.cwd(), and a symlink
+                // into /etc under a wide root is seen for where it points.
+                const contained = resolveWithinFileToolRoots(inputPath, policy);
+                return (contained.path !== undefined &&
+                    !isSensitiveSystemPath(contained.path));
             }, {
                 message: "Invalid file path: access to system directories or paths outside the tool roots is not allowed",
             })