@juspay/neurolink 13.4.4 → 13.4.6

package/CHANGELOG.md

@@ -1,8 +1,8 @@
-## [13.4.4](https://github.com/juspay/neurolink/compare/v13.4.3...v13.4.4) (2026-10-18)
+## [13.4.6](https://github.com/juspay/neurolink/compare/v13.4.5...v13.4.6) (2026-10-18)
 
 ### Bug Fixes
 
-- **(types):** keep exceljs types out of the public declarations ([31e4d21](https://github.com/juspay/neurolink/commit/31e4d21ed99f5d4027764edae27128d167037166)), closes [#1999](https://github.com/juspay/neurolink/issues/1999)
+- **(voice):** refuse a cleartext xAI realtime URL to another host unless opted in ([b58347d](https://github.com/juspay/neurolink/commit/b58347d9a6df84cd979a78d8b5676169f10c4e8c))
 
 ## [11.2.3](https://github.com/juspay/neurolink/compare/v11.2.2...v11.2.3) (2026-08-19)
 

package/README.md

@@ -286,7 +286,7 @@ TypeSafe and Laya both configured, TypeSafe runs; with only Laya's key and base
 set, Laya runs.
 
 [**XOR**](docs/getting-started/providers/xor.md) is Juspay's Apache-2.0,
-open-weights decision model (`xor-1.1`); setup is on
+open-weights decision model (`xor-latest` for text, `xor-omni` for images and video); setup is on
 [Hugging Face](https://huggingface.co/juspay/xor). It has no built-in endpoint
 either: set `XOR_API_KEY` and `XOR_BASE_URL` to the origin of a deployment or of
 a LiteLLM proxy route (or pass `credentials.xor`). XOR counts only with both its
@@ -481,36 +481,54 @@ The [guide's limits section](docs/getting-started/providers/cloudflare-clef.md#l
 
 ## Enterprise Security: Human-in-the-Loop (HITL)
 
-NeuroLink includes a **HITL (Human-in-the-Loop) system** for regulated industries and high-stakes AI operations:
+NeuroLink includes a **HITL (Human-in-the-Loop) system** that pauses a tool call until your application approves or rejects it, for high-stakes AI operations:
 
-| Capability                  | Description                                                             | Use Case                                   |
-| --------------------------- | ----------------------------------------------------------------------- | ------------------------------------------ |
-| **Tool Approval Workflows** | Require human approval before AI executes sensitive tools               | Financial transactions, data modifications |
-| **Output Validation**       | Route AI outputs through human review pipelines                         | Medical diagnosis, legal documents         |
-| **Confidence Thresholds**   | Automatically trigger human review below confidence level               | Critical business decisions                |
-| **Complete Audit Trail**    | Audit logging to support your compliance program (HIPAA / SOC 2 / GDPR) | Regulated industries                       |
+| Capability                  | Description                                                                                                                                                               | Use Case                                   |
+| --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------ |
+| **Tool Approval Workflows** | Pause tools whose name matches `dangerousActions`, or that a `customRules` condition selects, until your app answers                                                      | Financial transactions, data modifications |
+| **Argument Review**         | A response can carry `modifiedArguments` and the tool runs with them. `allowArgumentModification` only tells your UI (`allowModification`); NeuroLink does not enforce it | Correcting a path or amount before it runs |
+| **Timeout Policy**          | Reject when nobody answers (default) or auto-approve, with `autoApproveExclusions` for tools that always need an answer                                                   | Unattended and background runs             |
+| **Audit Logging**           | `auditLogging: true` writes each request and decision, with the full tool arguments, to the NeuroLink logger; it is a log, not a compliance control                       | Debugging and your own review records      |
 
 ```typescript
-import { NeuroLink } from "@juspay/neurolink";
+import { NeuroLink, type ConfirmationRequestEvent } from "@juspay/neurolink";
 
 const neurolink = new NeuroLink({
   hitl: {
     enabled: true,
-    requireApproval: ["writeFile", "executeCode", "sendEmail"],
-    confidenceThreshold: 0.85,
-    reviewCallback: async (action, context) => {
-      // Custom review logic - integrate with your approval system
-      return await yourApprovalSystem.requestReview(action);
-    },
+    // Case-insensitive substring match against the tool name
+    dangerousActions: ["writeFile", "executeCode", "sendEmail"],
+    timeout: 30000, // Rejects if nobody answers within 30 seconds
   },
 });
 
-// AI pauses for human approval before executing sensitive tools
+// Approval is event-based: NeuroLink emits a request, your app answers it
+const emitter = neurolink.getEventEmitter();
+emitter.on("hitl:confirmation-request", async (event) => {
+  // The emitter types listener arguments as unknown, so narrow the event
+  const { payload } = event as ConfirmationRequestEvent;
+  const { confirmationId, toolName, arguments: args } = payload;
+  // Integrate with your approval system (UI prompt, Slack, ticketing)
+  const approved = await yourApprovalSystem.requestReview({ toolName, args });
+
+  emitter.emit("hitl:confirmation-response", {
+    type: "hitl:confirmation-response",
+    payload: {
+      confirmationId,
+      approved,
+      reason: approved ? undefined : "Rejected by reviewer",
+    },
+  });
+});
+
+// A tool call to a matching tool pauses until your handler answers
 const result = await neurolink.generate({
   input: { text: "Send quarterly report to stakeholders" },
 });
 ```
 
+The [Enterprise HITL Guide](docs/features/enterprise-hitl.md) also sketches a larger target API (`requireApproval`, `reviewCallback`, `confidenceThreshold`, asynchronous review, escalation policies). None of it is implemented yet, and NeuroLink drops unknown `hitl` keys without an error. See [#752](https://github.com/juspay/neurolink/issues/752).
+
 **[Enterprise HITL Guide](docs/features/enterprise-hitl.md)** | **[Quick Start](docs/features/hitl.md)**
 
 ## 📚 Quick Start Guide