@juspay/neurolink 13.6.5 → 13.7.0

package/dist/core/redisConversationMemoryManager.js

@@ -16,7 +16,7 @@ import { buildContextFromPointer, getEffectiveTokenThreshold, } from "../utils/c
 import { logger } from "../utils/logger.js";
 import { assistantTurnIdentity, isTurnAlreadyStored, turnMessageFields, userTurnIdentity, } from "../utils/conversationTurnIdentity.js";
 import { extractIsErrorText } from "../utils/toolResultStatus.js";
-import { deserializeConversation, encodeStoredMessages, getSessionMessagesKey, MESSAGES_KEY_SUFFIX, isSessionMessagesKey, parseStoredMessages, serializeConversationMetadata, usesSplitMessageStorage, getNormalizedConfig, getPooledRedisClient, getSessionKey, getUserSessionsKey, releasePooledRedisClient, scanKeys, serializeConversation, } from "../utils/redis.js";
+import { addToSetWithTtl, deserializeConversation, encodeStoredMessages, getSessionMessagesKey, MESSAGES_KEY_SUFFIX, isSessionMessagesKey, parseStoredMessages, serializeConversationMetadata, usesSplitMessageStorage, getNormalizedConfig, getPooledRedisClient, getSessionKey, getUserSessionsKey, releasePooledRedisClient, scanKeys, serializeConversation, setWithTtl, } from "../utils/redis.js";
 const redisTracer = tracers.redis;
 const REDIS_TIMEOUT_MS = 5000;
 /**
@@ -265,10 +265,7 @@ export class RedisConversationMemoryManager {
         }
         try {
             const userSessionsKey = getUserSessionsKey(this.redisConfig, userId);
-            await this.redisClient.sAdd(userSessionsKey, sessionId);
-            if (this.redisConfig.ttl > 0) {
-                await this.redisClient.expire(userSessionsKey, this.redisConfig.ttl);
-            }
+            await addToSetWithTtl(this.redisClient, userSessionsKey, sessionId, this.redisConfig.ttl);
         }
         catch (error) {
             logger.error("[RedisConversationMemoryManager] Failed to add session to user set", {
@@ -420,9 +417,8 @@ export class RedisConversationMemoryManager {
                                 updatedConversation.title = title;
                                 updatedConversation.updatedAt = new Date().toISOString();
                                 const serializedData = serializeConversation(updatedConversation);
-                                await this.redisClient?.set(updatedRedisKey, serializedData);
-                                if (this.redisConfig.ttl > 0) {
-                                    await this.redisClient?.expire(updatedRedisKey, this.redisConfig.ttl);
+                                if (this.redisClient) {
+                                    await setWithTtl(this.redisClient, updatedRedisKey, serializedData, this.redisConfig.ttl);
                                 }
                             }
                         }
@@ -628,10 +624,7 @@ export class RedisConversationMemoryManager {
                             const freshSerialized = usesSplitMessageStorage(latestConversation)
                                 ? serializeConversationMetadata(latestConversation)
                                 : serializeConversation(latestConversation);
-                            await this.redisClient.set(redisKey, freshSerialized);
-                            if (this.redisConfig.ttl > 0) {
-                                await this.redisClient.expire(redisKey, this.redisConfig.ttl);
-                            }
+                            await setWithTtl(this.redisClient, redisKey, freshSerialized, this.redisConfig.ttl);
                         }
                     }
                 }
@@ -1695,10 +1688,7 @@ User message: "${userMessage}"`;
             const serializedData = usesSplitMessageStorage(conversation)
                 ? serializeConversationMetadata(conversation)
                 : serializeConversation(conversation);
-            await withTimeout(this.redisClient.set(redisKey, serializedData), 5000);
-            if (this.redisConfig.ttl > 0) {
-                await withTimeout(this.redisClient.expire(redisKey, this.redisConfig.ttl), 5000);
-            }
+            await withTimeout(setWithTtl(this.redisClient, redisKey, serializedData, this.redisConfig.ttl), 5000);
             logger.info("[RedisConversationMemoryManager] Successfully updated agentic loop report", {
                 sessionId,
                 userId,

package/dist/telemetry/attributes.d.ts

@@ -137,7 +137,7 @@ export declare function recordsSpanContent(): boolean;
  */
 export declare function isFinishedAttribute(value: string): boolean;
 /**
- * @description Returns a copy of a value with credentials masked: values under keys such as `access_token`, `password`, `authorization` or `set-cookie`, bearer tokens, and `name=value` credentials inside text. Purely numeric values after a credential-looking name (e.g. `max_tokens: 4096`) are left alone.
+ * @description Returns a copy of a value with credentials masked: values under keys such as `access_token`, `password`, `authorization` or `set-cookie`, bearer tokens, and `name=value` credentials inside text. Purely numeric values after a credential-looking name (e.g. `max_tokens: 4096`) are left alone. With `NEUROLINK_MASK_CREDENTIAL_ENTRIES=true` it also masks the value of a `{ name, value }` or `{ key, value }` entry whose name is such a key (a setting such as `max_tokens`, `password_policy` or `secret_version` is not, and the value is not consulted, so a numeric PIN is masked) and a credential inside an object key; unset, it does neither, as in the released build.
  * @param value {JsonValue | object} - Content to redact; objects and arrays are walked recursively.
  * @returns {JsonValue | object} A redacted copy, serializing exactly as the input when nothing in it is sensitive.
  * @throws {Error} When the value cannot be walked; tracing callers use `spanContentAttribute`, which turns that into an omitted value.

package/dist/telemetry/attributes.js

@@ -227,7 +227,74 @@ function redactText(text) {
     });
     return redacted;
 }
-function redactNode(value, ancestors) {
+// Opt-in stricter masking (`NEUROLINK_MASK_CREDENTIAL_ENTRIES=true`): the value
+// of a `{ name, value }` or `{ key, value }` entry whose name is a credential,
+// and a credential inside an object key. The released masker reads keys and
+// text only, so with the variable unset the output is exactly what it was.
+function masksCredentialEntries() {
+    return (process.env.NEUROLINK_MASK_CREDENTIAL_ENTRIES?.trim().toLowerCase() ===
+        "true");
+}
+// A name that says how many, how long or what kind of thing rather than
+// holding the credential (`max_tokens`, `password_policy`, `credential_type`,
+// `secret_version`, `password_min_length`). A name that merely ends in `tokens`
+// is not one: `access_tokens` and `refresh_tokens` are credentials, so only a
+// bare `tokens` and the count-like names of a model's token budget and usage
+// (`max_tokens`, `prompt_tokens`, `cache_read_input_tokens`, ...) are exempt.
+// Decided on the name's segments, not with a pattern: a key comes from content
+// and may be very long, so the check must stay linear in its length.
+const MEASUREMENT_SUFFIXES = new Set([
+    "policy",
+    "type",
+    "algorithm",
+    "count",
+    "limit",
+    "version",
+    "length",
+]);
+const TOKEN_COUNT_PREFIXES = new Set([
+    "max",
+    "min",
+    "prompt",
+    "completion",
+    "input",
+    "output",
+    "total",
+    "cache",
+    "cached",
+    "reasoning",
+    "thinking",
+    "budget",
+    "context",
+]);
+function isMeasurementEntryName(name) {
+    const segments = snakeCased(name).split("_");
+    const last = segments[segments.length - 1];
+    if (segments.length === 1) {
+        return last === "tokens";
+    }
+    return (MEASUREMENT_SUFFIXES.has(last) ||
+        (last === "tokens" && TOKEN_COUNT_PREFIXES.has(segments[0])));
+}
+function snakeCased(name) {
+    return name
+        .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
+        .replace(/[\s.-]+/g, "_")
+        .toLowerCase();
+}
+// Headers, environment variables and form fields are often lists of
+// `{ name, value }` or `{ key, value }` entries; when the name is a credential
+// the value is one, exactly as if it were stored under that key, whatever the
+// value looks like (a numeric PIN is a credential). Only the name decides: a
+// setting that merely mentions a credential is not one.
+function credentialEntryName(node) {
+    const name = "name" in node ? node.name : "key" in node ? node.key : undefined;
+    if (typeof name !== "string" || !("value" in node) || !isSensitiveKey(name)) {
+        return undefined;
+    }
+    return isMeasurementEntryName(name) ? undefined : name;
+}
+function redactNode(value, ancestors, strict) {
     if (typeof value === "string") {
         return redactText(describeDataUrls(value));
     }
@@ -243,25 +310,34 @@ function redactNode(value, ancestors) {
     ancestors.add(value);
     try {
         if ("toJSON" in value && typeof value.toJSON === "function") {
-            return redactNode(value.toJSON(), ancestors);
+            return redactNode(value.toJSON(), ancestors, strict);
         }
         if (Array.isArray(value)) {
-            return value.map((entry) => redactNode(entry, ancestors));
+            return value.map((entry) => redactNode(entry, ancestors, strict));
         }
         // No prototype, so a key named __proto__ is data rather than an assignment.
         const redacted = Object.create(null);
         const mimeType = declaredMimeType(value);
+        const entryName = strict ? credentialEntryName(value) : undefined;
         for (const [key, entry] of Object.entries(value)) {
-            if (isSensitiveKey(key) &&
+            // Opt-in: a key can carry a credential too, such as a URL with an
+            // api_key parameter used as a map key.
+            const safeKey = strict ? redactText(key) : key;
+            const sensitiveName = key === "value" && entryName !== undefined
+                ? entryName
+                : isSensitiveKey(key)
+                    ? key
+                    : undefined;
+            if (sensitiveName !== undefined &&
                 (typeof entry === "string" ||
                     (typeof entry === "object" && entry !== null))) {
-                redacted[key] = redactSensitiveEntry(key, entry);
+                redacted[safeKey] = redactSensitiveEntry(sensitiveName, entry);
                 continue;
             }
             const placeholder = isBinaryKey(key)
                 ? binaryPlaceholder(entry, mimeType)
                 : undefined;
-            redacted[key] = placeholder ?? redactNode(entry, ancestors);
+            redacted[safeKey] = placeholder ?? redactNode(entry, ancestors, strict);
         }
         return redacted;
     }
@@ -270,13 +346,13 @@ function redactNode(value, ancestors) {
     }
 }
 /**
- * @description Returns a copy of a value with credentials masked: values under keys such as `access_token`, `password`, `authorization` or `set-cookie`, bearer tokens, and `name=value` credentials inside text. Purely numeric values after a credential-looking name (e.g. `max_tokens: 4096`) are left alone.
+ * @description Returns a copy of a value with credentials masked: values under keys such as `access_token`, `password`, `authorization` or `set-cookie`, bearer tokens, and `name=value` credentials inside text. Purely numeric values after a credential-looking name (e.g. `max_tokens: 4096`) are left alone. With `NEUROLINK_MASK_CREDENTIAL_ENTRIES=true` it also masks the value of a `{ name, value }` or `{ key, value }` entry whose name is such a key (a setting such as `max_tokens`, `password_policy` or `secret_version` is not, and the value is not consulted, so a numeric PIN is masked) and a credential inside an object key; unset, it does neither, as in the released build.
  * @param value {JsonValue | object} - Content to redact; objects and arrays are walked recursively.
  * @returns {JsonValue | object} A redacted copy, serializing exactly as the input when nothing in it is sensitive.
  * @throws {Error} When the value cannot be walked; tracing callers use `spanContentAttribute`, which turns that into an omitted value.
  */
 export function redactSpanContent(value) {
-    return redactNode(value, new WeakSet());
+    return redactNode(value, new WeakSet(), masksCredentialEntries());
 }
 function redactSafely(value) {
     try {

package/dist/utils/redis.d.ts

@@ -81,6 +81,23 @@ export declare function deserializeConversation(data: string | Buffer | null): R
  * Checks if Redis client is healthy
  */
 export declare function isRedisHealthy(client: RedisClient): Promise<boolean>;
+/**
+ * SET a string key together with its expiry, as a single command.
+ *
+ * A plain SET clears any TTL the key had, so SET followed by a separate
+ * EXPIRE leaves a window — and a dropped connection inside it — in which the
+ * key has no expiry at all and never ages out. A `ttlSeconds` of zero or less
+ * means "no expiry", exactly as the two-command form treated it.
+ */
+export declare function setWithTtl(client: RedisClient, key: string, value: string, ttlSeconds: number): Promise<void>;
+/**
+ * SADD a member and give the set its expiry in one MULTI/EXEC.
+ *
+ * SADD on a missing key creates it without a TTL, so a separate EXPIRE leaves
+ * the same unbounded-lifetime window as SET followed by EXPIRE. A
+ * `ttlSeconds` of zero or less adds the member and sets no expiry.
+ */
+export declare function addToSetWithTtl(client: RedisClient, key: string, member: string, ttlSeconds: number): Promise<void>;
 /**
  * Scan Redis keys matching a pattern without blocking the server
  * This is a non-blocking alternative to the KEYS command

package/dist/utils/redis.js

@@ -399,6 +399,37 @@ export async function isRedisHealthy(client) {
         return false;
     }
 }
+/**
+ * SET a string key together with its expiry, as a single command.
+ *
+ * A plain SET clears any TTL the key had, so SET followed by a separate
+ * EXPIRE leaves a window — and a dropped connection inside it — in which the
+ * key has no expiry at all and never ages out. A `ttlSeconds` of zero or less
+ * means "no expiry", exactly as the two-command form treated it.
+ */
+export async function setWithTtl(client, key, value, ttlSeconds) {
+    if (ttlSeconds > 0) {
+        await client.set(key, value, {
+            expiration: { type: "EX", value: ttlSeconds },
+        });
+        return;
+    }
+    await client.set(key, value);
+}
+/**
+ * SADD a member and give the set its expiry in one MULTI/EXEC.
+ *
+ * SADD on a missing key creates it without a TTL, so a separate EXPIRE leaves
+ * the same unbounded-lifetime window as SET followed by EXPIRE. A
+ * `ttlSeconds` of zero or less adds the member and sets no expiry.
+ */
+export async function addToSetWithTtl(client, key, member, ttlSeconds) {
+    if (ttlSeconds > 0) {
+        await client.multi().sAdd(key, member).expire(key, ttlSeconds).exec();
+        return;
+    }
+    await client.sAdd(key, member);
+}
 /**
  * Scan Redis keys matching a pattern without blocking the server
  * This is a non-blocking alternative to the KEYS command

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@juspay/neurolink",
-  "version": "13.6.5",
+  "version": "13.7.0",
   "packageManager": "pnpm@10.15.1",
   "description": "The pipe layer of an AI nervous system: one interface connecting provider neurons to your application, across three inference types — generate, stream and decide. `decide` returns typed, calibrated judgements from a non-generative model (~400ms, ~$0.00002/call) for routing, tool selection and context budgeting. MCP-native (4 transports), voice TTS/STT/realtime, RAG, agents, memory, compaction, 9 observability exporters. OpenAI · Anthropic · Gemini · Bedrock · Azure · Ollama · TypeSafe Jev and more.",
   "author": {
@@ -115,6 +115,7 @@
     "test:forced-tool-declared": "pnpm exec tsx test/continuous-test-suite-forced-tool-declared.ts",
     "test:span-content-redaction": "pnpm exec tsx test/continuous-test-suite-span-content-redaction.ts",
     "test:voice-turn-memory": "pnpm exec tsx test/continuous-test-suite-voice-turn-memory.ts",
+    "test:redis-atomic-expiry": "pnpm exec tsx test/continuous-test-suite-redis-atomic-expiry.ts",
     "test:realtime-voice": "pnpm exec tsx test/continuous-test-suite-realtime-voice.ts",
     "test:error-classification-e2e": "pnpm exec tsx test/continuous-test-suite-error-classification-e2e.ts",
     "test:error-classifier-contract": "pnpm exec tsx test/continuous-test-suite-error-classifier-contract.ts",