@juspay/neurolink 12.51.1 → 12.51.2

package/CHANGELOG.md

@@ -1,8 +1,8 @@
-## [12.51.1](https://github.com/juspay/neurolink/compare/v12.51.0...v12.51.1) (2026-10-12)
+## [12.51.2](https://github.com/juspay/neurolink/compare/v12.51.1...v12.51.2) (2026-10-12)
 
 ### Bug Fixes
 
-- **(workflow):** abort a timed-out model call and hold deadlines at the timer limit ([6315839](https://github.com/juspay/neurolink/commit/63158393d62527f0d0fa70c92b61e95bbd6ffc0a))
+- **(cli):** harden Azure, Vertex and SageMaker setup prompts ([51b8892](https://github.com/juspay/neurolink/commit/51b8892764aa060337e2aff44f0f08fffd8864e5))
 
 ## [11.2.3](https://github.com/juspay/neurolink/compare/v11.2.2...v11.2.3) (2026-08-19)
 

package/dist/cli/commands/setup-azure.js

@@ -290,6 +290,19 @@ function validateApiKey(input) {
     }
     return true;
 }
+const AZURE_OPENAI_HOST_SUFFIX = ".openai.azure.com";
+/**
+ * True only when the parsed hostname is a subdomain of openai.azure.com.
+ * A substring test also accepts `openai.azure.com.evil.example` and
+ * `evilopenai.azure.com`, so the leading dot of the suffix is what pins the
+ * label boundary. The URL class has already lower-cased the host; a single
+ * trailing dot (an absolute DNS name) is the same host and is ignored.
+ */
+function isAzureOpenAIHostname(hostname) {
+    const host = hostname.endsWith(".") ? hostname.slice(0, -1) : hostname;
+    return (host.length > AZURE_OPENAI_HOST_SUFFIX.length &&
+        host.endsWith(AZURE_OPENAI_HOST_SUFFIX));
+}
 /**
  * Validate Azure OpenAI endpoint URL
  */
@@ -300,7 +313,7 @@ function validateEndpoint(input) {
     const trimmed = input.trim();
     try {
         const url = new URL(trimmed);
-        if (!url.hostname.includes("openai.azure.com")) {
+        if (!isAzureOpenAIHostname(url.hostname)) {
             return "Endpoint should be an Azure OpenAI URL (*.openai.azure.com)";
         }
         return true;

package/dist/cli/commands/setup-gcp.js

@@ -469,6 +469,26 @@ function validateServiceAccountJSON(input) {
         return "Invalid JSON format";
     }
 }
+/**
+ * Quote a value for a double-quoted .env entry.
+ *
+ * Line breaks are folded first, whichever way they were typed (a real CR/LF,
+ * or the two characters `\n` a key copied out of a service-account JSON file
+ * carries), and written back as the `\n` escape the .env loaders expand. That
+ * has to come before the backslashes are escaped, or a pasted `\n` would be
+ * doubled into `\\n` and the key would stop being a key. Every other backslash
+ * is then escaped before the quote is: an unescaped one in front of a `"`
+ * cancels the quote's own escape, closes the value early and lets the rest of
+ * the input run as part of the .env line.
+ */
+function quoteEnvValue(value) {
+    const escaped = value
+        .replace(/\\r\\n|\\n|\\r|\r\n|\r/g, "\n")
+        .replace(/\\/g, "\\\\")
+        .replace(/"/g, '\\"')
+        .replace(/\n/g, "\\n");
+    return `"${escaped}"`;
+}
 /**
  * Update .env file with selected authentication method
  */
@@ -524,10 +544,7 @@ async function updateEnvFile(method, config) {
                     existingVars.set("GOOGLE_AUTH_CLIENT_EMAIL", config.clientEmail);
                 }
                 if (config.privateKey) {
-                    const escaped = config.privateKey
-                        .replace(/\r?\n/g, "\\n")
-                        .replace(/"/g, '\\"');
-                    existingVars.set("GOOGLE_AUTH_PRIVATE_KEY", `"${escaped}"`);
+                    existingVars.set("GOOGLE_AUTH_PRIVATE_KEY", quoteEnvValue(config.privateKey));
                 }
                 break;
         }

package/dist/cli/factories/sagemakerCommandFactory.js

@@ -1,3 +1,4 @@
+import { randomBytes } from "node:crypto";
 import chalk from "chalk";
 import ora from "ora";
 import inquirer from "inquirer";
@@ -134,7 +135,7 @@ export class SageMakerCommandFactory {
      * Create secure configuration without exposing credentials to process.env
      */
     static createSecureConfiguration(config) {
-        const sessionId = `sagemaker_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
+        const sessionId = `sagemaker_${Date.now()}_${randomBytes(16).toString("hex")}`;
         const secureConfig = {
             ...config,
             sessionId,
@@ -143,9 +144,12 @@ export class SageMakerCommandFactory {
         // Store temporarily in secure memory store
         this.secureCredentialStore.set(sessionId, secureConfig);
         // Auto-cleanup after 5 minutes for security
-        setTimeout(() => {
+        const expiry = setTimeout(() => {
             this.secureCredentialStore.delete(sessionId);
         }, 5 * 60 * 1000);
+        // Setup also deletes the entry itself when it finishes; the timer is only
+        // the backstop and must not hold the CLI open for the rest of its window.
+        expiry.unref();
         return secureConfig;
     }
     /**
@@ -505,7 +509,7 @@ export class SageMakerCommandFactory {
                 "📖 Learn more: https://docs.aws.amazon.com/general/latest/gr/aws-access-keys-best-practices.html\n"));
             spinner.start("Setting up SageMaker configuration...");
             // Secure credential management without process.env exposure
-            const secureConfig = this.createSecureConfiguration({
+            const secureConfig = SageMakerCommandFactory.createSecureConfiguration({
                 accessKeyId: answers.accessKeyId,
                 secretAccessKey: answers.secretAccessKey,
                 region: answers.region,
@@ -516,7 +520,7 @@ export class SageMakerCommandFactory {
             // Clear cache and test configuration with secure config
             clearConfigurationCache();
             try {
-                await this.validateSecureConfiguration(secureConfig); // Validate configuration is loadable
+                await SageMakerCommandFactory.validateSecureConfiguration(secureConfig); // Validate configuration is loadable
                 spinner.succeed("✅ Configuration validated successfully");
                 logger.always(chalk.green("\n🎉 SageMaker setup complete!"));
                 logger.always(chalk.yellow("\n💡 Next steps:"));
@@ -544,13 +548,13 @@ export class SageMakerCommandFactory {
                     "  • Consider using AWS credential rotation policies\n" +
                     "  • Monitor AWS CloudTrail for unauthorized access attempts"));
                 // Clear secure credentials from memory after successful setup
-                this.clearSecureCredentials(secureConfig.sessionId);
+                SageMakerCommandFactory.clearSecureCredentials(secureConfig.sessionId);
             }
             catch (configError) {
                 spinner.fail("❌ Configuration validation failed");
                 logger.error(chalk.red(`Error: ${configError instanceof Error ? configError.message : String(configError)}`));
                 // Clear secure credentials from memory on error
-                this.clearSecureCredentials(secureConfig.sessionId);
+                SageMakerCommandFactory.clearSecureCredentials(secureConfig.sessionId);
                 process.exit(1);
             }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@juspay/neurolink",
-  "version": "12.51.1",
+  "version": "12.51.2",
   "packageManager": "pnpm@10.15.1",
   "description": "The pipe layer of an AI nervous system: one interface connecting provider neurons to your application, across three inference types — generate, stream and decide. `decide` returns typed, calibrated judgements from a non-generative model (~400ms, ~$0.00002/call) for routing, tool selection and context budgeting. MCP-native (4 transports), voice TTS/STT/realtime, RAG, agents, memory, compaction, 9 observability exporters. OpenAI · Anthropic · Gemini · Bedrock · Azure · Ollama · TypeSafe Jev and more.",
   "author": {