@juspay/neurolink 12.47.9 → 12.47.10

package/dist/providers/openAI/client.js

@@ -7,8 +7,8 @@ import { redactUrlCredentials } from "../../utils/logSanitize.js";
 import { calculateCost } from "../../utils/pricing.js";
 import { classifyProviderError, DEFAULT_ERROR_RULES, } from "../../utils/errorClassifier.js";
 import { createOpenAIConfig, getProviderModel, validateApiKey, } from "../../utils/providerConfig.js";
-import { MAX_IMAGE_BYTES, readBoundedBuffer } from "../../utils/sizeGuard.js";
-import { assertSafeUrl } from "../../utils/ssrfGuard.js";
+import { safeDownload } from "../../utils/safeFetch.js";
+import { MAX_IMAGE_BYTES } from "../../utils/sizeGuard.js";
 import { createTimeoutController } from "../../utils/timeout.js";
 import { stripTrailingSlash } from "../openaiChatCompletionsClient.js";
 import { OpenAIChatCompletionsProvider } from "../openaiChatCompletionsBase.js";
@@ -453,31 +453,16 @@ export class OpenAIProvider extends OpenAIChatCompletionsProvider {
         // b64_json. If a hosted URL came back instead (e.g. older keys, or
         // url-mode), download it inline so callers always get base64.
         if (!base64 && first.url) {
-            // Guard the API-returned URL before fetching (provider-returned URLs
-            // carry the same SSRF risk as caller-supplied ones).
-            await assertSafeUrl(first.url);
-            const proxyFetch = createProxyFetch();
-            const dlController = new AbortController();
-            const dlTimeoutId = setTimeout(() => dlController.abort(), 60_000);
-            let imgResp;
-            try {
-                imgResp = await proxyFetch(first.url, { signal: dlController.signal });
-            }
-            catch (err) {
-                if (err instanceof Error && err.name === "AbortError") {
-                    throw new Error("OpenAI image URL download timed out after 60s", {
-                        cause: err,
-                    });
-                }
-                throw err;
-            }
-            finally {
-                clearTimeout(dlTimeoutId);
-            }
-            if (!imgResp.ok) {
-                throw new Error(`OpenAI image generation: failed to fetch hosted URL ${first.url} (${imgResp.status})`);
-            }
-            const buf = await readBoundedBuffer(imgResp, MAX_IMAGE_BYTES, "OpenAI image fallback");
+            // The API-returned URL carries the same SSRF risk as a caller-supplied
+            // one, so it is fetched through `safeDownload`: vetted and pinned (or,
+            // when the environment configures a proxy, sent through it), no
+            // redirects, size-capped. Vetting and fetching in two separate steps
+            // left a DNS-rebinding window between them.
+            const buf = await safeDownload(first.url, {
+                maxBytes: MAX_IMAGE_BYTES,
+                label: "OpenAI image fallback",
+                timeoutMs: 60_000,
+            });
             base64 = buf.toString("base64");
         }
         if (!base64) {

package/dist/proxy/proxyFetch.d.ts

@@ -3,6 +3,7 @@
  * Supports HTTP/HTTPS, SOCKS4/5, authentication, and NO_PROXY bypass
  * Lightweight implementation extracted from research of major proxy packages
  */
+import type { ProxyAgent } from "undici";
 import type { GoogleGenAIHttpOptions } from "../types/index.js";
 /**
  * Classify a fetch failure as a transient network error worth retrying.
@@ -21,6 +22,17 @@ import type { GoogleGenAIHttpOptions } from "../types/index.js";
  * Exported for direct coverage by the no-API test suite.
  */
 export declare function isTransientNetworkError(error: unknown): boolean;
+/**
+ * The dispatcher a request to `targetUrl` must use to go through the proxy the
+ * environment configures, or `null` when none applies (no proxy variable for
+ * the URL's scheme, or the host is listed in NO_PROXY).
+ *
+ * Unlike the fetch from {@link createProxyFetch}, a caller that needs a
+ * request to be proxied or refused (a download whose destination was vetted
+ * under proxy rules) gets no fallback to a direct connection from this: a proxy
+ * that cannot be used (an unsupported SOCKS URL, an unparsable URL) throws.
+ */
+export declare function getProxyDispatcherForUrl(targetUrl: string): Promise<ProxyAgent | null>;
 /**
  * Create a proxy-aware fetch function with enhanced capabilities
  * Supports HTTP/HTTPS, SOCKS4/5, authentication, and NO_PROXY bypass

package/dist/proxy/proxyFetch.js

@@ -362,6 +362,38 @@ async function createProxyAgent(proxyUrl) {
             throw new Error(`Unsupported proxy protocol: ${parsed.protocol}`);
     }
 }
+/**
+ * One ProxyAgent per proxy URL for the whole process, so connections to the
+ * proxy are pooled and an agent is not rebuilt per request. The cache key is
+ * a hash of the masked URL: credentials never sit in the map.
+ */
+async function getOrCreateProxyAgent(proxyUrl) {
+    const globalWithCache = globalThis;
+    if (!globalWithCache.__NL_PROXY_AGENT_CACHE__) {
+        globalWithCache.__NL_PROXY_AGENT_CACHE__ = new Map();
+    }
+    const agentCache = globalWithCache.__NL_PROXY_AGENT_CACHE__;
+    const cacheKey = createHash("sha256")
+        .update(maskProxyUrl(proxyUrl) ?? proxyUrl)
+        .digest("hex");
+    const dispatcher = agentCache.get(cacheKey) || (await createProxyAgent(proxyUrl));
+    agentCache.set(cacheKey, dispatcher);
+    return dispatcher;
+}
+/**
+ * The dispatcher a request to `targetUrl` must use to go through the proxy the
+ * environment configures, or `null` when none applies (no proxy variable for
+ * the URL's scheme, or the host is listed in NO_PROXY).
+ *
+ * Unlike the fetch from {@link createProxyFetch}, a caller that needs a
+ * request to be proxied or refused (a download whose destination was vetted
+ * under proxy rules) gets no fallback to a direct connection from this: a proxy
+ * that cannot be used (an unsupported SOCKS URL, an unparsable URL) throws.
+ */
+export async function getProxyDispatcherForUrl(targetUrl) {
+    const proxyUrl = selectProxyUrl(targetUrl);
+    return proxyUrl ? getOrCreateProxyAgent(proxyUrl) : null;
+}
 function sanitizeProxyUrl(url) {
     return maskProxyUrl(url) ?? "NOT_SET";
 }
@@ -469,16 +501,7 @@ async function executeProxiedFetch(input, init, proxyEnv) {
                 aboutToCreateProxyAgent: true,
                 timestamp: new Date().toISOString(),
             });
-            const globalWithCache = globalThis;
-            if (!globalWithCache.__NL_PROXY_AGENT_CACHE__) {
-                globalWithCache.__NL_PROXY_AGENT_CACHE__ = new Map();
-            }
-            const agentCache = globalWithCache.__NL_PROXY_AGENT_CACHE__;
-            const cacheKey = createHash("sha256")
-                .update(maskProxyUrl(proxyUrl) ?? proxyUrl)
-                .digest("hex");
-            const dispatcher = agentCache.get(cacheKey) || (await createProxyAgent(proxyUrl));
-            agentCache.set(cacheKey, dispatcher);
+            const dispatcher = await getOrCreateProxyAgent(proxyUrl);
             logger.debug(`[Proxy Fetch] ✅ ENHANCED PROXY AGENT CREATED`, {
                 requestId,
                 hasDispatcher: !!dispatcher,

package/dist/utils/safeFetch.d.ts

@@ -14,6 +14,12 @@
  * Use this for **every** download of an external (caller-supplied or
  * third-party-returned) URL. Direct `fetch(url)` of such URLs is unsafe.
  *
+ * When the environment configures a proxy for the URL (HTTPS_PROXY / ALL_PROXY,
+ * and the host is not in NO_PROXY) the download goes through that proxy and
+ * nowhere else: there is no fallback to a direct connection. The proxy resolves
+ * the host name, so DNS pinning cannot apply; the URL is vetted by
+ * `assertSafeUrlForProxy` instead (see there for what that covers).
+ *
  * @module utils/safeFetch
  */
 import type { SafeDownloadOptions } from "../types/index.js";

package/dist/utils/safeFetch.js

@@ -14,10 +14,16 @@
  * Use this for **every** download of an external (caller-supplied or
  * third-party-returned) URL. Direct `fetch(url)` of such URLs is unsafe.
  *
+ * When the environment configures a proxy for the URL (HTTPS_PROXY / ALL_PROXY,
+ * and the host is not in NO_PROXY) the download goes through that proxy and
+ * nowhere else: there is no fallback to a direct connection. The proxy resolves
+ * the host name, so DNS pinning cannot apply; the URL is vetted by
+ * `assertSafeUrlForProxy` instead (see there for what that covers).
+ *
  * @module utils/safeFetch
  */
 import { readBoundedBuffer } from "./sizeGuard.js";
-import { validateAndResolveUrl } from "./ssrfGuard.js";
+import { assertSafeUrlForProxy, validateAndResolveUrl } from "./ssrfGuard.js";
 const DEFAULT_TIMEOUT_MS = 60_000;
 /**
  * Build a once-off undici Agent whose connect lookup resolves `hostname` to
@@ -80,6 +86,24 @@ function isBoundedBufferResponse(value) {
         candidate.headers !== null &&
         typeof candidate.headers.get === "function");
 }
+/**
+ * Check the response the same way for both transports, then read it under the
+ * size cap.
+ */
+async function readDownloadResponse(response, url, options) {
+    if (response.status >= 300 && response.status < 400) {
+        throw new Error(`safeDownload(${options.label}): refused to follow redirect ${response.status} → ${response.headers.get("location") ?? "<no-location>"} (for ${url})`);
+    }
+    if (!response.ok) {
+        throw new Error(`safeDownload(${options.label}) failed: HTTP ${response.status} for ${url}`);
+    }
+    // readBoundedBuffer expects a Response that exposes Content-Length and
+    // arrayBuffer(). undici Response satisfies both.
+    if (!isBoundedBufferResponse(response)) {
+        throw new Error(`safeDownload(${options.label}): response is missing headers.get()/arrayBuffer()`);
+    }
+    return readBoundedBuffer(response, options.maxBytes, options.label);
+}
 /**
  * Safely download a binary asset from an external URL.
  *
@@ -87,14 +111,30 @@ function isBoundedBufferResponse(value) {
  *   is encountered, or the HTTP status indicates failure.
  */
 export async function safeDownload(url, options) {
-    const { url: validatedUrl, addresses } = await validateAndResolveUrl(url);
-    const parsed = new URL(validatedUrl);
-    const hostname = parsed.hostname.replace(/^\[|\]$/g, "");
-    // Dynamic import keeps undici off the package's static import graph — it
-    // is only needed once a download actually happens. See
+    // Dynamic imports keep undici and the proxy module off the package's static
+    // import graph — they are only needed once a download actually happens. See
     // test/continuous-test-suite-import-cost.ts.
+    const { getProxyDispatcherForUrl } = await import("../proxy/proxyFetch.js");
+    const proxyDispatcher = await getProxyDispatcherForUrl(url);
     const { fetch: undiciFetch } = await import("undici");
-    const agent = await buildPinnedAgent(hostname, addresses);
+    // Resolve and vet the destination, and pick the transport. Through a proxy
+    // the proxy resolves the name, so only the URL text can be vetted; without
+    // one the connection is pinned to the addresses the guard cleared.
+    let validatedUrl;
+    let dispatcher;
+    let closeDispatcher = false;
+    if (proxyDispatcher) {
+        assertSafeUrlForProxy(url);
+        validatedUrl = url;
+        dispatcher = proxyDispatcher;
+    }
+    else {
+        const resolved = await validateAndResolveUrl(url);
+        validatedUrl = resolved.url;
+        const hostname = new URL(validatedUrl).hostname.replace(/^\[|\]$/g, "");
+        dispatcher = await buildPinnedAgent(hostname, resolved.addresses);
+        closeDispatcher = true;
+    }
     const timeoutCtrl = new AbortController();
     const timeoutId = setTimeout(() => timeoutCtrl.abort(), options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
     const composedSignal = options.signal
@@ -106,24 +146,16 @@ export async function safeDownload(url, options) {
             method: "GET",
             signal: composedSignal,
             redirect: "manual", // a 3xx → private-IP redirect would bypass the guard
-            dispatcher: agent,
+            dispatcher,
         });
     }
     finally {
         clearTimeout(timeoutId);
-        // Close the per-request agent so the pinned connection isn't pooled.
-        agent.close().catch(() => undefined);
-    }
-    if (response.status >= 300 && response.status < 400) {
-        throw new Error(`safeDownload(${options.label}): refused to follow redirect ${response.status} → ${response.headers.get("location") ?? "<no-location>"} (for ${url})`);
+        if (closeDispatcher) {
+            // Close the per-request agent so the pinned connection isn't pooled.
+            // The proxy agent is shared process-wide and stays open.
+            dispatcher.close().catch(() => undefined);
+        }
     }
-    if (!response.ok) {
-        throw new Error(`safeDownload(${options.label}) failed: HTTP ${response.status} for ${url}`);
-    }
-    // readBoundedBuffer expects a Response that exposes Content-Length and
-    // arrayBuffer(). undici Response satisfies both.
-    if (!isBoundedBufferResponse(response)) {
-        throw new Error(`safeDownload(${options.label}): response is missing headers.get()/arrayBuffer()`);
-    }
-    return readBoundedBuffer(response, options.maxBytes, options.label);
+    return readDownloadResponse(response, url, options);
 }

package/dist/utils/ssrfGuard.d.ts

@@ -35,6 +35,22 @@ import type { PinnedAddress } from "../types/index.js";
  *   IP at the actual fetch).
  */
 export declare function assertSafeUrl(url: string): Promise<void>;
+/**
+ * Validate `url` for a download that goes through an HTTP proxy.
+ *
+ * The proxy, not this process, resolves the host name and opens the
+ * connection, so there is no local DNS answer to check or to pin. What can be
+ * judged from the URL alone is judged: HTTPS only, blocked IP literals in any
+ * encoding, and host names that can only mean something local or private (a
+ * single-label name such as `intranet`, and the internal suffixes above).
+ * What the proxy resolves any other name to is the proxy's egress policy to
+ * enforce; that is the trade for using a proxy at all, and why this is only
+ * used when one applies. Without a proxy {@link validateAndResolveUrl} runs
+ * instead and the connection is pinned to the addresses it cleared.
+ *
+ * Same throw semantics as {@link assertSafeUrl}.
+ */
+export declare function assertSafeUrlForProxy(url: string): void;
 /**
  * Validate `url` and return the resolved address set that should be used for
  * the actual fetch (companion to `safeFetch.ts:safeDownload`).

package/dist/utils/ssrfGuard.js

@@ -367,6 +367,61 @@ async function resolveAndValidateHost(url, host) {
     }
     return { v4: v4Addresses, v6: v6Addresses };
 }
+/**
+ * Host-name endings that can only name a local or private target: the
+ * special-use domains of RFC 6761 and RFC 8375 plus the common internal
+ * suffix. `.invalid` and `.test` are deliberately absent: they never resolve
+ * on the public internet and test fixtures use them.
+ */
+const INTERNAL_HOST_SUFFIXES = [
+    "localhost",
+    "local",
+    "localdomain",
+    "internal",
+    "home.arpa",
+];
+/**
+ * Validate `url` for a download that goes through an HTTP proxy.
+ *
+ * The proxy, not this process, resolves the host name and opens the
+ * connection, so there is no local DNS answer to check or to pin. What can be
+ * judged from the URL alone is judged: HTTPS only, blocked IP literals in any
+ * encoding, and host names that can only mean something local or private (a
+ * single-label name such as `intranet`, and the internal suffixes above).
+ * What the proxy resolves any other name to is the proxy's egress policy to
+ * enforce; that is the trade for using a proxy at all, and why this is only
+ * used when one applies. Without a proxy {@link validateAndResolveUrl} runs
+ * instead and the connection is pinned to the addresses it cleared.
+ *
+ * Same throw semantics as {@link assertSafeUrl}.
+ */
+export function assertSafeUrlForProxy(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new Error(`Invalid URL: "${url}"`);
+    }
+    if (parsed.protocol !== "https:") {
+        throw new Error(`Only HTTPS URLs are permitted; got "${parsed.protocol}//" in "${url}"`);
+    }
+    const host = stripBrackets(parsed.hostname).toLowerCase();
+    const literalCheck = checkHostLiteral(host);
+    if (literalCheck === null) {
+        return; // routable IP literal
+    }
+    if (literalCheck !== "not-an-ip") {
+        throw new Error(`URL "${url}" rejected: ${literalCheck}`);
+    }
+    const name = host.endsWith(".") ? host.slice(0, -1) : host;
+    if (!name.includes(".")) {
+        throw new Error(`URL "${url}" rejected: "${name}" is a single-label host name`);
+    }
+    if (INTERNAL_HOST_SUFFIXES.some((suffix) => name === suffix || name.endsWith(`.${suffix}`))) {
+        throw new Error(`URL "${url}" rejected: "${name}" is an internal host name`);
+    }
+}
 /**
  * Validate `url` and return the resolved address set that should be used for
  * the actual fetch (companion to `safeFetch.ts:safeDownload`).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@juspay/neurolink",
-  "version": "12.47.9",
+  "version": "12.47.10",
   "packageManager": "pnpm@10.15.1",
   "description": "The pipe layer of an AI nervous system: one interface connecting provider neurons to your application, across three inference types — generate, stream and decide. `decide` returns typed, calibrated judgements from a non-generative model (~400ms, ~$0.00002/call) for routing, tool selection and context budgeting. MCP-native (4 transports), voice TTS/STT/realtime, RAG, agents, memory, compaction, 9 observability exporters. OpenAI · Anthropic · Gemini · Bedrock · Azure · Ollama · TypeSafe Jev and more.",
   "author": {