@juspay/neurolink 12.41.6 → 12.41.8

package/dist/cli/commands/models.js

@@ -5,6 +5,7 @@
  */
 import { ModelResolver, formatSearchResults, formatRecommendation, formatComparison, } from "../../models/modelResolver.js";
 import { getAllModels, getModelsByProvider, getAvailableProviders, formatModelForDisplay, } from "../../models/modelRegistry.js";
+import { getCatalogJsonEntries } from "../../providers/catalog/loader.js";
 import chalk from "chalk";
 import ora from "ora";
 import { logger } from "../../utils/logger.js";
@@ -334,9 +335,23 @@ export class ModelsCommandFactory {
                 try {
                     const { AIProviderFactory } = await import("../../core/factory.js");
                     const provider = (await AIProviderFactory.createProvider(providerName));
-                    const liveIds = typeof provider.getAvailableModels === "function"
+                    const rawLiveIds = typeof provider.getAvailableModels === "function"
                         ? await provider.getAvailableModels()
                         : [];
+                    // Project against the JSON catalog's non-retired ids, mirroring
+                    // getAllModels()'s listing filter: a catalog-backed provider's
+                    // vendor `/models` endpoint often keeps listing an id long after
+                    // it 404s on chat completions (see e.g. fireworks.json's
+                    // `evidence.liveMatrix`), so an unfiltered live listing would
+                    // print a retired id as a usable "live" result. Providers with no
+                    // catalog entry (litellm, ollama, openai-compatible gateways,
+                    // lm-studio, llamacpp) have nothing to project against, so their
+                    // live discovery stays unrestricted — that is the whole point of
+                    // this fallback for them.
+                    const catalogEntry = getCatalogJsonEntries().find((entry) => entry.id === providerName);
+                    const liveIds = catalogEntry
+                        ? rawLiveIds.filter((id) => catalogEntry.models.catalog[id]?.status !== "retired")
+                        : rawLiveIds;
                     if (liveIds.length > 0) {
                         if (spinner) {
                             spinner.succeed(`Found ${liveIds.length} models (live from ${providerName})`);

package/dist/providers/catalog/fireworks.json

@@ -23,7 +23,7 @@
                 "enumMember": "KIMI_K2P6",
                 "vision": false,
                 "status": "retired",
-                "description": "Retired 2026-09 — still on the Fireworks roster, but a real chat call returns 404 'not deployed' (since the 2026-09-26 nightly)"
+                "description": "Retired 2026-09 — still listed on the Fireworks /models roster, but the chat endpoint 404s 'Model not found, inaccessible, and/or not deployed' (since the 2026-09-26 nightly); superseded by kimi-k3, same Moonshot family"
             },
             "accounts/fireworks/models/gpt-oss-120b": {
                 "enumMember": "GPT_OSS_120B",
@@ -107,7 +107,8 @@
         "topModels": [
             "accounts/fireworks/models/kimi-k3",
             "accounts/fireworks/models/gpt-oss-120b",
-            "accounts/fireworks/models/qwen3p8-max"
+            "accounts/fireworks/models/qwen3p8-max",
+            "accounts/fireworks/models/glm-5p3"
         ]
     },
     "capabilities": {
@@ -146,7 +147,7 @@
         },
         "liveMatrix": {
             "date": "2026-09-28",
-            "result": "kimi-k2p6 is still listed on /models but a real chat call now returns 404 'not deployed', which failed the nightly model-liveness gate from 2026-09-26 and sent the matrix vision test down the text-only fallback. kimi-k3 answers a text call and a call carrying a PNG with 200, so it becomes the default; gpt-oss-120b, qwen3p8-max and glm-5p3 also answer text calls. Earlier (2026-08-30): deepseek-v4-pro was listed but hung past 120s, six ids returned 404 'not deployed', and glm-5p3 answers 'does not support image inputs'."
+            "result": "Issue #1796: the 2026-09-26 nightly model-liveness gate reported the default, kimi-k2p6, as dead, sending the matrix vision test down the text-only fallback. Confirmed live — GET /models still lists kimi-k2p6, but POST /chat/completions 404s 'Model not found, inaccessible, and/or not deployed', the same still-listed-but-unservable pattern deepseek-v4-pro hit in 2026-08 (hung past 120s rather than 404ing). Moved the default to kimi-k3, the same Moonshot family's newest generation: 200 OK on both a text-only call and a call carrying a PNG, and a full-length call returns a proper OpenAI-shaped tool_calls entry with finish_reason=tool_calls, confirming vision and tool support both survive the swap. kimi-k2p6 marked retired rather than deleted, per the frozen-enum rule. gpt-oss-120b, qwen3p8-max and glm-5p3 (the rest of fallbacks/topModels) were re-probed alive at the same time; glm-5p3 still only answers text calls, not image ones, as found 2026-08-30."
         },
         "addedInPR": "https://github.com/juspay/neurolink/pull/1587"
     }

package/dist/providers/googleVertex/client.d.ts

@@ -172,6 +172,38 @@ export declare class GoogleVertexProvider extends BaseProvider {
      * This bypasses @ai-sdk/google-vertex to properly handle thought_signature
      */
     private executeNativeGemini3Stream;
+    /**
+     * Resolve the text a native Vertex *generate* call actually sends, for
+     * both `executeNativeGemini3Generate` and `executeNativeAnthropicGenerate`.
+     *
+     * The baseline here is the same `input.text || prompt || "Please
+     * respond."` chain both call sites have always used — `input.text` wins
+     * when set because the file preprocessors (`processUnifiedFilesArray`,
+     * `processCSVFilesForNativeSDK`) append attached-file content to it while
+     * `options.prompt` stays the pre-attachment snapshot; `prompt` is the
+     * fallback for the legacy prompt-only `generateText()` convention, which
+     * never sets `input` at all; the literal is the last resort when neither
+     * is set.
+     *
+     * That `||` chain alone has a gap model middleware falls into:
+     * `applyTurnParamsRewrite` writes every rewritten turn back onto
+     * `options.input.text`, including an *emptied* one (a redaction). `||`
+     * treats that empty string exactly like an unset `input.text` and falls
+     * through to `options.prompt` — which middleware never touched, since it
+     * is a plain snapshot taken before middleware ran — so a redaction a
+     * middleware applied is silently discarded and the ORIGINAL text still
+     * reaches Vertex.
+     *
+     * The fix is narrow: when `input.text` is *set* (not undefined) and
+     * differs from `prompt`, something deliberately changed it since the
+     * snapshot was taken — a middleware rewrite, or a file preprocessor's
+     * attachment-content append — and that divergence itself is the signal to
+     * trust `input.text` outright, empty string included. When the two agree
+     * (the untouched, no-middleware case, including the STT-silence
+     * `input.text === prompt === ""` placeholder) there is no divergence to
+     * trust, so the original fallback chain still applies unchanged.
+     */
+    private resolveNativeGenerateText;
     /**
      * Execute generate using native @google/genai SDK for Gemini 3 models on Vertex AI
      * This bypasses @ai-sdk/google-vertex to properly handle thought_signature
@@ -293,15 +325,196 @@ export declare class GoogleVertexProvider extends BaseProvider {
      * `hasLifecycleErrorFired`) skips its own fire for the same failure.
      */
     private wrapStreamResultWithLifecycle;
+    /**
+     * The text a native Vertex turn is built from before any model middleware
+     * rewrite — `options.input.text` when the caller set it (the normal
+     * `generate()`/`stream()` convention), else `options.prompt` (the legacy
+     * prompt-only `generateText()` convention, where `input` is never
+     * populated — see `generateTextInInstanceScope` in `src/lib/neurolink.ts`,
+     * which validates `options.prompt` and never touches `options.input`).
+     *
+     * `buildTurnPromptForMiddleware` and `applyTurnParamsRewrite` both read
+     * this so they agree on one baseline: the first so a prompt-only caller
+     * shows middleware its real text instead of an empty turn, the second so
+     * a middleware-rewritten turn is compared against what middleware actually
+     * started from — not a baseline that ignores `prompt` entirely, which
+     * would make a prompt-only call look "unedited" no matter what middleware
+     * did to it. `StreamOptions` carries no top-level `prompt` field, hence
+     * the `"prompt" in options` guard instead of a cast.
+     */
+    private vertexTurnBaselineText;
+    /**
+     * Build the V3 entry-turn prompt middleware sees for a native call.
+     * Native Vertex loops build their own multi-turn conversation internally
+     * once they run — this is only the caller's system prompt + text input,
+     * the one turn middleware is given visibility into before that loop
+     * starts.
+     *
+     * The user turn is an array of text parts rather than a bare string. That
+     * is the V3 prompt shape, and prompt-editing middleware is written against
+     * it: one that spreads `content` into a longer array turns a string into
+     * one element per character, and one that calls `.map` / `.filter` on it
+     * throws. The AI Studio path already hands its middleware parts
+     * (`geminiContentsToV3Prompt`); this makes Vertex agree with it.
+     *
+     * The text itself comes from `vertexTurnBaselineText`, not
+     * `options.input?.text` alone — a prompt-only `generateText()` caller
+     * never sets `input`, and without the `options.prompt` fallback middleware
+     * would be shown an empty turn and have nothing of the caller's to inspect
+     * or build on.
+     */
+    private buildTurnPromptForMiddleware;
+    /** Sampling params a native call already honors, carried onto the V3 view. */
+    private buildTurnV3Params;
+    /**
+     * Read a middleware-transformed prompt back into the two things a native
+     * Vertex turn can carry: one system instruction and one user text.
+     *
+     * Every system message counts (joined with a blank line, the way
+     * `v3PromptToGeminiContents` joins them for AI Studio) and so does every
+     * user message, not just the last. A middleware that appends or prepends
+     * context leaves the caller's own text in the prompt beside it; reading
+     * only the last user message would send the addition without the question
+     * it was meant to qualify, or drop it and send the question bare. Text
+     * blocks — across messages and across the parts of one message — are joined
+     * with a blank line for the same reason: they are separate blocks, and
+     * gluing them runs the last word of one into the first of the next.
+     *
+     * `unmapped` counts what a native turn has no place for — non-text user
+     * parts (files, images) and assistant or tool messages — so the caller can
+     * say it was dropped rather than drop it silently.
+     */
+    private readTurnFromPrompt;
+    /**
+     * Apply a middleware-transformed turn back onto the native call options.
+     *
+     * The system instruction and the user text are each written back only when
+     * they differ from what middleware actually started from — `systemPrompt`
+     * against `options.systemPrompt`, user text against
+     * `vertexTurnBaselineText(options)`, not `options.input?.text` alone — so a
+     * middleware that touches neither leaves both exactly as they were. An
+     * edit is honoured in every direction — a changed, added or removed system
+     * message, an appended or prepended user message, a user message emptied
+     * outright (a redaction) — because every native generate/stream executor
+     * resolves its wire text through `options.input.text` once this write-back
+     * has run (`resolveNativeGenerateText` on the generate paths, which
+     * special-cases exactly this divergence so an emptied `input.text` is not
+     * mistaken for an unset one and does not fall back to the stale
+     * `options.prompt` snapshot; a direct `options.input.text` read on the
+     * stream paths, which have no such fallback to fall into). Comparing
+     * against `options.input?.text` alone — ignoring `options.prompt` — would
+     * make a prompt-only `generateText()` caller's untouched turn look
+     * "changed" the first time middleware ran (nothing to compare `turn.text`
+     * against but `""`), writing the real prompt into `input.text` as a
+     * spurious edit on every such call even when no middleware did anything.
+     *
+     * Sampling params are written back the same way and can be removed as well
+     * as changed: a middleware that drops `temperature` or `topP` from the
+     * params must reach the wire as "not sent", not as the caller's original
+     * value kept because the key went missing.
+     *
+     * `tools` is offered to middleware read-only — a middleware that rewrites
+     * it gets a WARN rather than a silent drop, matching the OpenAI-compatible
+     * streaming path's contract: native tool wiring is derived independently
+     * of this V3 view, and re-deriving it here would diverge from it.
+     */
+    private applyTurnParamsRewrite;
+    /**
+     * Strip the lifecycle middleware from the options handed to
+     * `applyMiddlewareToModel` for a native Vertex call, when something else is
+     * already firing the same callbacks.
+     *
+     * NeuroLink's `applyGenerateLifecycleMiddleware` /
+     * `applyStreamLifecycleMiddleware` (neurolink.ts) mirror a caller's
+     * top-level `onFinish` / `onError` / `onChunk` into
+     * `options.middleware.middlewareConfig.lifecycle.config` — the exact same
+     * callback references — before this provider sees `options`. Left enabled,
+     * the built-in lifecycle middleware would fire them again from inside the
+     * bridge, and with malformed payloads: it reads the legacy `textDelta` chunk
+     * field and a bare `finishReason`, neither of which a V3 model produces.
+     *
+     * Who else fires them differs by path, so the exclusion does too:
+     *
+     * - generate: only `fireGenerateOnFinish` / `fireGenerateOnError`, which read
+     *   the TOP-LEVEL callbacks. The entry is stripped only when one is present.
+     *   A caller who configures `middlewareConfig.lifecycle` directly has no
+     *   other firer here, so that middleware applies exactly once, unmodified.
+     * - stream: `BaseProvider.stream()` wraps every stream in
+     *   `wrapStreamWithLifecycleCallbacks`, which fires whatever sits in
+     *   `lifecycle.config` however it got there — top-level shorthand or direct
+     *   config. The entry is stripped whenever it exists, or a direct-config
+     *   caller would get every callback twice (and `onChunk` a third time, for
+     *   the `finish` part the middleware also reports).
+     *
+     * Only the `lifecycle` entry is disabled, so every other configured
+     * middleware (guardrails, transformParams, custom hooks, analytics, ...)
+     * applies normally.
+     */
+    private excludeAutoLifecycleMiddleware;
+    /**
+     * Run the native Gemini generate loop and, when Vertex rejects an
+     * over-constrained `responseSchema`, retry once without it.
+     *
+     * The retry sits inside the function `runNativeGenerateWithMiddleware` hands
+     * to the model bridge rather than around the bridge, because it is
+     * provider-internal recovery: model middleware must see one `doGenerate`
+     * that succeeds. Retrying outside would show every middleware the failed
+     * first call — the lifecycle middleware would report an `onError` for a
+     * request that then succeeded, and `transformParams` would run twice.
+     */
+    private executeNativeGemini3GenerateWithSchemaFallback;
+    /**
+     * Apply the configured middleware chain around a native Vertex generate
+     * loop. `callNative` is `executeNativeAnthropicGenerate` or
+     * `executeNativeGemini3Generate` — a self-contained black box that runs
+     * its own multi-step tool loop and returns a fully-resolved
+     * `EnhancedGenerateResult`. Wrapping happens around that call, not inside
+     * it: `transformParams` can rewrite the entry turn before the loop starts,
+     * and `wrapGenerate` can observe the result or replace it outright (a
+     * guardrail that blocks the call entirely never reaches `callNative`, so
+     * `nativeResult` stays unset and a settled result is synthesized purely
+     * from what middleware produced, then run through `enhanceResult` like any
+     * other result so `enableAnalytics` / `enableEvaluation` still apply).
+     */
+    private runNativeGenerateWithMiddleware;
+    /**
+     * Apply the configured middleware chain around a native Vertex stream
+     * loop. `callNative` is `executeNativeAnthropicStream` or
+     * `executeNativeGemini3Stream`. Both are bridged through the same lazy V3
+     * `ReadableStream` (`nativeChunksToV3Stream` / `v3StreamToNativeChunks`)
+     * regardless of whether the underlying loop is genuinely live (Anthropic)
+     * or already fully resolved (Gemini3) by the time it returns — pulling one
+     * item at a time is correct for both, and never turns a live stream into
+     * collect-then-replay.
+     *
+     * A guardrail that blocks the call never invokes `doStream`, so
+     * `nativeResult` stays unset; a `StreamResult` is synthesized instead,
+     * with `usage` / `finishReason` resolving once the merged stream is fully
+     * drained (the same late-resolving-getter contract
+     * `preserveStreamResultAccessors` already exists for).
+     */
+    private runNativeStreamWithMiddleware;
     /**
      * Re-apply getter-based accessor properties from a source StreamResult onto
      * a wrapper copy. Wrapper spreads (`{ ...result }`) invoke and SNAPSHOT
      * enumerable getters at wrap time — for background-loop streams (the native
      * Anthropic path) that resolve finishReason / structuredOutput / toolCalls
-     * only as the consumer drains, the snapshot is permanently undefined/empty.
-     * Copying the accessor descriptors keeps the wrapped result live. Results
-     * built from plain data properties (the buffered Gemini paths) have no
-     * getters and pass through untouched.
+     * / usage only as the consumer drains, the snapshot is permanently
+     * undefined/empty. Copying the accessor descriptors keeps the wrapped
+     * result live. Results built from plain data properties (the buffered
+     * Gemini paths, and the native Anthropic stream's own `usage` — a mutable
+     * object reference rather than a getter, so a spread keeps its identity
+     * and later mutations stay visible) have no matching getter here and pass
+     * through untouched.
+     *
+     * The re-applied property also accepts a direct write: NeuroLink.stream()
+     * backstops a missing `usage` from analytics once the outer stream drains
+     * by assigning `mcpStreamOutcome.usage = resolvedUsage` on whatever result
+     * object it was handed. Copying the bare getter-only descriptor verbatim
+     * would turn that assignment into a TypeError ("Cannot set property usage
+     * of #<Object> which has only a getter"), so each re-applied accessor is
+     * rebuilt with a setter that remembers an override and prefers it over the
+     * live source getter once one has been written.
      */
     private preserveStreamResultAccessors;
     /**