@juspay/neurolink 13.8.17 → 13.8.18

package/CHANGELOG.md

@@ -1,8 +1,8 @@
-## [13.8.17](https://github.com/juspay/neurolink/compare/v13.8.16...v13.8.17) (2026-10-26)
+## [13.8.18](https://github.com/juspay/neurolink/compare/v13.8.17...v13.8.18) (2026-10-27)
 
 ### Bug Fixes
 
-- **(server):** stop reading an over-limit JSON or form body on Express at the limit ([349a15d](https://github.com/juspay/neurolink/commit/349a15d63c7fdd221a92b92ae3ea6be9d95a6400))
+- **(security):** close the 2026-10 audit findings and pin the toolchain ([f7e105d](https://github.com/juspay/neurolink/commit/f7e105d21e649a05481647aebc80aa767617bcab))
 
 ## [11.2.3](https://github.com/juspay/neurolink/compare/v11.2.2...v11.2.3) (2026-08-19)
 

package/README.md

@@ -1167,7 +1167,7 @@ node your-app.js
 Run AI-powered workflows directly in GitHub Actions with broad provider support and automatic PR/issue commenting.
 
 ```yaml
-- uses: juspay/neurolink@v1
+- uses: juspay/neurolink@e42b4db89fa87946e2dd766cf2ab43929c689b8b # v13.8.16
   with:
     anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
     prompt: "Review this PR for security issues and code quality"

package/dist/action/actionExecutor.d.ts

@@ -12,17 +12,47 @@ export declare function transformCliResponse(cliResponse: CliResponse): Omit<Act
  */
 export declare function buildCliArgs(inputs: ActionInputs): string[];
 /**
- * Install NeuroLink CLI
+ * Install the NeuroLink CLI into a private directory under RUNNER_TEMP and
+ * return the path of its `neurolink` executable.
+ *
+ * Three things changed from the original `npm install -g @juspay/neurolink`:
+ *
+ * - The version is exact unless the consumer opts into `latest`. The action
+ *   runs with the consumer's provider keys in its environment, so a moving tag
+ *   would hand one bad npm publish to every consumer within minutes; pinning
+ *   the action itself by SHA cannot protect against that, only pinning what it
+ *   installs can. `latest` still works, with a warning that names the trade.
+ * - `--ignore-scripts`: no lifecycle script of any package in the tree runs on
+ *   the consumer's runner. NeuroLink has none of its own, and the packages
+ *   whose scripts matter (ffmpeg-static's binary download, sharp's prebuilt
+ *   lookup) are optional dependencies the action's text generation path does
+ *   not use. Video inputs need an ffmpeg on the runner's PATH, which GitHub's
+ *   Ubuntu images provide.
+ * - `npm audit signatures` after the install: every package in the tree must
+ *   carry a valid registry signature, and the ones published with provenance
+ *   (this package is) must carry an attestation that matches. A tarball that
+ *   was swapped or re-signed fails here instead of running.
+ *
+ * A project directory rather than `-g` because `npm audit signatures` reads a
+ * project's lockfile, and because it keeps the install out of the runner's
+ * global prefix, where a later step could find a stale copy.
  */
-export declare function installNeurolink(version: string): Promise<void>;
+export declare function installNeurolink(version: string, installRoot?: string): Promise<string>;
+/**
+ * The exact `npm install` spec for a `neurolink_version` input. Anything that
+ * is neither `latest` nor an exact `x.y.z` is refused: a range or a dist-tag
+ * would quietly reintroduce the moving target the pin exists to remove.
+ */
+export declare function resolveInstallSpec(version: string): string;
 /**
  * Execute NeuroLink CLI command
  * @param args - CLI arguments
  * @param env - Environment variables
  * @param workingDirectory - Working directory for execution
  * @param timeout - Timeout in milliseconds (defaults to 5 minutes)
+ * @param cliPath - The executable to run; defaults to `neurolink` on PATH
  */
-export declare function executeNeurolink(args: string[], env: Record<string, string>, workingDirectory?: string, timeout?: number): Promise<ActionExecutionResult>;
+export declare function executeNeurolink(args: string[], env: Record<string, string>, workingDirectory?: string, timeout?: number, cliPath?: string): Promise<ActionExecutionResult>;
 /**
  * Run complete NeuroLink action
  */

package/dist/action/actionExecutor.js

@@ -8,9 +8,12 @@ import * as core from "@actions/core";
 import * as fs from "fs";
 import * as path from "path";
 import { buildEnvironmentVariables } from "./actionInputs.js";
+import { EXACT_VERSION_PATTERN } from "./cliVersion.js";
 import { withTimeout } from "../utils/errorHandling.js";
 /** Default timeout for CLI execution (5 minutes) */
 const DEFAULT_EXECUTION_TIMEOUT_MS = 300000;
+/** The package the action installs and runs. */
+const CLI_PACKAGE = "@juspay/neurolink";
 /**
  * Transform CLI token usage format to action format
  */
@@ -130,17 +133,69 @@ export function buildCliArgs(inputs) {
     return args;
 }
 /**
- * Install NeuroLink CLI
+ * Install the NeuroLink CLI into a private directory under RUNNER_TEMP and
+ * return the path of its `neurolink` executable.
+ *
+ * Three things changed from the original `npm install -g @juspay/neurolink`:
+ *
+ * - The version is exact unless the consumer opts into `latest`. The action
+ *   runs with the consumer's provider keys in its environment, so a moving tag
+ *   would hand one bad npm publish to every consumer within minutes; pinning
+ *   the action itself by SHA cannot protect against that, only pinning what it
+ *   installs can. `latest` still works, with a warning that names the trade.
+ * - `--ignore-scripts`: no lifecycle script of any package in the tree runs on
+ *   the consumer's runner. NeuroLink has none of its own, and the packages
+ *   whose scripts matter (ffmpeg-static's binary download, sharp's prebuilt
+ *   lookup) are optional dependencies the action's text generation path does
+ *   not use. Video inputs need an ffmpeg on the runner's PATH, which GitHub's
+ *   Ubuntu images provide.
+ * - `npm audit signatures` after the install: every package in the tree must
+ *   carry a valid registry signature, and the ones published with provenance
+ *   (this package is) must carry an attestation that matches. A tarball that
+ *   was swapped or re-signed fails here instead of running.
+ *
+ * A project directory rather than `-g` because `npm audit signatures` reads a
+ * project's lockfile, and because it keeps the install out of the runner's
+ * global prefix, where a later step could find a stale copy.
  */
-export async function installNeurolink(version) {
-    core.info(`Installing @juspay/neurolink@${version}...`);
-    const installArgs = version === "latest"
-        ? ["install", "-g", "@juspay/neurolink"]
-        : ["install", "-g", `@juspay/neurolink@${version}`];
-    await exec.exec("npm", installArgs, {
-        silent: !core.isDebug(),
-    });
-    core.info("NeuroLink CLI installed successfully");
+export async function installNeurolink(version, installRoot = process.env.RUNNER_TEMP || "/tmp") {
+    const spec = resolveInstallSpec(version);
+    const installDir = path.join(installRoot, `neurolink-cli-${process.pid}-${Date.now()}`);
+    fs.mkdirSync(installDir, { recursive: true, mode: 0o700 });
+    fs.writeFileSync(path.join(installDir, "package.json"), JSON.stringify({ name: "neurolink-action-cli", private: true }, null, 2), { mode: 0o600 });
+    core.info(`Installing ${spec}...`);
+    const npmOptions = { cwd: installDir, silent: !core.isDebug() };
+    await exec.exec("npm", [
+        "install",
+        "--ignore-scripts",
+        "--no-fund",
+        "--no-audit",
+        "--save-exact",
+        spec,
+    ], npmOptions);
+    core.info("Verifying registry signatures and provenance attestations...");
+    await exec.exec("npm", ["audit", "signatures"], npmOptions);
+    const binPath = path.join(installDir, "node_modules", ".bin", "neurolink");
+    if (!fs.existsSync(binPath)) {
+        throw new Error(`${spec} installed but exposes no neurolink executable at ${binPath}`);
+    }
+    core.info(`NeuroLink CLI ${version} installed at ${installDir}`);
+    return binPath;
+}
+/**
+ * The exact `npm install` spec for a `neurolink_version` input. Anything that
+ * is neither `latest` nor an exact `x.y.z` is refused: a range or a dist-tag
+ * would quietly reintroduce the moving target the pin exists to remove.
+ */
+export function resolveInstallSpec(version) {
+    if (version === "latest") {
+        core.warning(`neurolink_version is "latest": the action will install whatever ${CLI_PACKAGE} version the registry serves at run time. Pin an exact version (the default) for a reproducible, review-gated install.`);
+        return `${CLI_PACKAGE}@latest`;
+    }
+    if (!EXACT_VERSION_PATTERN.test(version)) {
+        throw new Error(`neurolink_version must be an exact version such as 13.8.16, or the literal "latest"; received "${version}"`);
+    }
+    return `${CLI_PACKAGE}@${version}`;
 }
 /**
  * Execute NeuroLink CLI command
@@ -148,8 +203,9 @@ export async function installNeurolink(version) {
  * @param env - Environment variables
  * @param workingDirectory - Working directory for execution
  * @param timeout - Timeout in milliseconds (defaults to 5 minutes)
+ * @param cliPath - The executable to run; defaults to `neurolink` on PATH
  */
-export async function executeNeurolink(args, env, workingDirectory, timeout = DEFAULT_EXECUTION_TIMEOUT_MS) {
+export async function executeNeurolink(args, env, workingDirectory, timeout = DEFAULT_EXECUTION_TIMEOUT_MS, cliPath = "neurolink") {
     const startTime = Date.now();
     try {
         // Filter out undefined values from process.env
@@ -159,7 +215,7 @@ export async function executeNeurolink(args, env, workingDirectory, timeout = DE
                 processEnv[key] = value;
             }
         }
-        const execPromise = exec.getExecOutput("neurolink", args, {
+        const execPromise = exec.getExecOutput(cliPath, args, {
             cwd: workingDirectory,
             env: { ...processEnv, ...env },
             silent: false,
@@ -251,8 +307,8 @@ export async function executeNeurolink(args, env, workingDirectory, timeout = DE
 export async function runNeurolink(inputs) {
     let credPath;
     try {
-        // Install CLI
-        await installNeurolink(inputs.neurolinkVersion);
+        // Install CLI (exact version unless `latest` was requested)
+        const cliPath = await installNeurolink(inputs.neurolinkVersion);
         // Build environment
         const env = buildEnvironmentVariables(inputs);
         // Handle Google Cloud credentials (base64 decode)
@@ -273,7 +329,7 @@ export async function runNeurolink(inputs) {
         }
         // Execute with timeout (use input timeout or default)
         const executionTimeout = inputs.timeout || DEFAULT_EXECUTION_TIMEOUT_MS;
-        return await executeNeurolink(args, env, inputs.workingDirectory, executionTimeout);
+        return await executeNeurolink(args, env, inputs.workingDirectory, executionTimeout, cliPath);
     }
     finally {
         // Clean up credential file

package/dist/action/actionInputs.js

@@ -6,6 +6,7 @@
 import * as core from "@actions/core";
 import { AIProviderName } from "../constants/enums.js";
 import { ErrorFactory } from "../utils/errorHandling.js";
+import { DEFAULT_NEUROLINK_CLI_VERSION } from "./cliVersion.js";
 const PROVIDER_KEY_MAP = {
     [AIProviderName.OPENAI]: ["openaiApiKey"],
     [AIProviderName.ANTHROPIC]: ["anthropicApiKey"],
@@ -183,7 +184,9 @@ export function parseActionInputs() {
         // Advanced
         timeout: parseNumericInput("timeout", core.getInput("timeout"), 300, parseInt, 10),
         debug: core.getBooleanInput("debug"),
-        neurolinkVersion: core.getInput("neurolink_version") || "latest",
+        // Empty means the pinned version this action was released with; `latest`
+        // is an explicit opt-in to a moving target (see ./cliVersion.ts).
+        neurolinkVersion: core.getInput("neurolink_version") || DEFAULT_NEUROLINK_CLI_VERSION,
         workingDirectory: core.getInput("working_directory") || ".",
     };
 }

package/dist/action/cliVersion.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The NeuroLink CLI version the GitHub Action installs when the
+ * `neurolink_version` input is left empty.
+ *
+ * This is a deliberate, reviewed pin and not `latest`. The action runs with the
+ * consumer's provider keys and `github.token` in its environment, so an
+ * unpinned install would hand a single bad npm publish of `@juspay/neurolink`
+ * to every consumer's workflow within minutes — and pinning the ACTION by SHA
+ * would buy them nothing, because the code that actually runs is whatever the
+ * install fetched. pnpm's `minimumReleaseAge` cooldown does not apply here
+ * either: the action installs with npm.
+ *
+ * Why a committed constant and not the version in package.json: semantic-release
+ * derives the published version from git tags and no longer commits the bump,
+ * so `package.json#version` in this repository lags the registry by major
+ * versions and would pin consumers to an ancient CLI.
+ *
+ * Bump it in a reviewed change (`pnpm run build:action` afterwards — the
+ * committed bundle is diffed against a fresh build in CI). The supply-chain
+ * suite checks that it is an exact `x.y.z` and that the version exists on the
+ * registry with a provenance attestation.
+ */
+export declare const DEFAULT_NEUROLINK_CLI_VERSION = "13.8.16";
+/** An exact `x.y.z` (optionally pre-release) — the only shape the installer accepts besides `latest`. */
+export declare const EXACT_VERSION_PATTERN: RegExp;

package/dist/action/cliVersion.js

@@ -0,0 +1,26 @@
+// src/lib/action/cliVersion.ts
+/**
+ * The NeuroLink CLI version the GitHub Action installs when the
+ * `neurolink_version` input is left empty.
+ *
+ * This is a deliberate, reviewed pin and not `latest`. The action runs with the
+ * consumer's provider keys and `github.token` in its environment, so an
+ * unpinned install would hand a single bad npm publish of `@juspay/neurolink`
+ * to every consumer's workflow within minutes — and pinning the ACTION by SHA
+ * would buy them nothing, because the code that actually runs is whatever the
+ * install fetched. pnpm's `minimumReleaseAge` cooldown does not apply here
+ * either: the action installs with npm.
+ *
+ * Why a committed constant and not the version in package.json: semantic-release
+ * derives the published version from git tags and no longer commits the bump,
+ * so `package.json#version` in this repository lags the registry by major
+ * versions and would pin consumers to an ancient CLI.
+ *
+ * Bump it in a reviewed change (`pnpm run build:action` afterwards — the
+ * committed bundle is diffed against a fresh build in CI). The supply-chain
+ * suite checks that it is an exact `x.y.z` and that the version exists on the
+ * registry with a provenance attestation.
+ */
+export const DEFAULT_NEUROLINK_CLI_VERSION = "13.8.16";
+/** An exact `x.y.z` (optionally pre-release) — the only shape the installer accepts besides `latest`. */
+export const EXACT_VERSION_PATTERN = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;

package/dist/action/index.d.ts

@@ -3,5 +3,6 @@
  * @module action
  */
 export { parseActionInputs, validateProviderKey, buildEnvironmentVariables, validateActionInputs, maskSecrets, } from "./actionInputs.js";
-export { buildCliArgs, installNeurolink, executeNeurolink, runNeurolink, transformCliResponse, } from "./actionExecutor.js";
+export { buildCliArgs, installNeurolink, resolveInstallSpec, executeNeurolink, runNeurolink, transformCliResponse, } from "./actionExecutor.js";
+export { DEFAULT_NEUROLINK_CLI_VERSION, EXACT_VERSION_PATTERN, } from "./cliVersion.js";
 export { postResultComment, writeJobSummary, setActionOutputs, getActionOutputs, } from "./githubIntegration.js";

package/dist/action/index.js

@@ -6,7 +6,8 @@
 // Input handling
 export { parseActionInputs, validateProviderKey, buildEnvironmentVariables, validateActionInputs, maskSecrets, } from "./actionInputs.js";
 // Execution
-export { buildCliArgs, installNeurolink, executeNeurolink, runNeurolink, transformCliResponse, } from "./actionExecutor.js";
+export { buildCliArgs, installNeurolink, resolveInstallSpec, executeNeurolink, runNeurolink, transformCliResponse, } from "./actionExecutor.js";
+export { DEFAULT_NEUROLINK_CLI_VERSION, EXACT_VERSION_PATTERN, } from "./cliVersion.js";
 // GitHub integration
 export { postResultComment, writeJobSummary, setActionOutputs, getActionOutputs, } from "./githubIntegration.js";
 // Re-export types for convenience

package/dist/adapters/video/directorPipeline.js

@@ -14,6 +14,8 @@
 import pLimit from "p-limit";
 import { ErrorCategory, ErrorSeverity } from "../../constants/enums.js";
 import { logger } from "../../utils/logger.js";
+import { downloadAttachment, getAttachmentPolicy, readAttachmentFile, } from "../../utils/attachmentPolicy.js";
+import { MAX_IMAGE_BYTES } from "../../utils/sizeGuard.js";
 import { validateImageForVideo } from "../../utils/parameterValidation.js";
 import { VIDEO_ERROR_CODES } from "../../constants/videoErrors.js";
 import { extractFirstFrame, extractLastFrame } from "./frameExtractor.js";
@@ -44,14 +46,14 @@ const DEFAULT_TRANSITION_DURATION = 4;
  *
  * @throws {VideoError} If the image cannot be resolved
  */
-async function resolveImageToBuffer(image, segmentIndex) {
+async function resolveImageToBuffer(image, segmentIndex, policy) {
     if (Buffer.isBuffer(image)) {
         return image;
     }
     if (typeof image === "string") {
         return image.startsWith("http://") || image.startsWith("https://")
-            ? fetchImageFromUrl(image, segmentIndex)
-            : readImageFromDisk(image, segmentIndex);
+            ? fetchImageFromUrl(image, segmentIndex, policy)
+            : readImageFromDisk(image, segmentIndex, policy);
     }
     // ImageWithAltText
     if (typeof image === "object" && "data" in image) {
@@ -62,7 +64,7 @@ async function resolveImageToBuffer(image, segmentIndex) {
         if (typeof imgData === "string") {
             // Handle HTTP(S) URLs
             if (imgData.startsWith("http://") || imgData.startsWith("https://")) {
-                return fetchImageFromUrl(imgData, segmentIndex);
+                return fetchImageFromUrl(imgData, segmentIndex, policy);
             }
             // Handle data URIs (e.g., "data:image/png;base64,iVBORw0KG...")
             if (imgData.startsWith("data:")) {
@@ -82,7 +84,7 @@ async function resolveImageToBuffer(image, segmentIndex) {
             }
             // Try as file path
             try {
-                return await readImageFromDisk(imgData, segmentIndex);
+                return await readImageFromDisk(imgData, segmentIndex, policy);
             }
             catch (fileError) {
                 // Not a valid file path - throw clear error instead of silently treating as base64
@@ -114,47 +116,52 @@ async function resolveImageToBuffer(image, segmentIndex) {
         context: { segmentIndex },
     });
 }
-/** Fetch an image from an HTTP(S) URL with timeout. */
-async function fetchImageFromUrl(url, segmentIndex) {
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), IMAGE_IO_TIMEOUT_MS);
+/**
+ * Fetch an image from an HTTP(S) URL under the attachment policy: HTTPS to a
+ * public host unless the policy says otherwise, DNS-pinned, redirects
+ * re-validated per hop, body bounded while streaming.
+ */
+async function fetchImageFromUrl(url, segmentIndex, policy) {
     try {
-        const response = await fetch(url, { signal: controller.signal });
-        if (!response.ok) {
-            throw new VideoError({
-                code: VIDEO_ERROR_CODES.INVALID_INPUT,
-                message: `Failed to fetch image for segment ${segmentIndex}: HTTP ${response.status}`,
-                category: ErrorCategory.EXECUTION,
-                severity: ErrorSeverity.HIGH,
-                retriable: response.status >= 500,
-                context: { segmentIndex, url: url.substring(0, 100) },
-            });
-        }
-        return Buffer.from(await response.arrayBuffer());
+        const downloaded = await downloadAttachment(url, {
+            policy,
+            maxBytes: MAX_IMAGE_BYTES,
+            label: `segment ${segmentIndex} image URL`,
+            timeoutMs: IMAGE_IO_TIMEOUT_MS,
+        });
+        return downloaded.buffer;
     }
     catch (error) {
         if (error instanceof VideoError) {
             throw error;
         }
+        const message = error instanceof Error ? error.message : String(error);
+        const status = /HTTP (\d{3})/.exec(message)?.[1];
+        const refused = error?.code === "ATTACHMENT_URL_REFUSED";
         throw new VideoError({
             code: VIDEO_ERROR_CODES.INVALID_INPUT,
-            message: `Failed to fetch image for segment ${segmentIndex}: ${error instanceof Error ? error.message : String(error)}`,
+            message: `Failed to fetch image for segment ${segmentIndex}: ${message}`,
             category: ErrorCategory.EXECUTION,
             severity: ErrorSeverity.HIGH,
-            retriable: true,
-            context: { segmentIndex },
+            retriable: !refused && (status === undefined || Number(status) >= 500),
+            context: { segmentIndex, url: url.substring(0, 100) },
             originalError: error instanceof Error ? error : undefined,
         });
     }
-    finally {
-        clearTimeout(timeout);
-    }
 }
-/** Read an image from the local filesystem. */
-async function readImageFromDisk(filePath, segmentIndex) {
-    const { readFile } = await import("node:fs/promises");
+/**
+ * Read an image from the local filesystem under the attachment policy: roots
+ * containment when configured, O_NOFOLLOW open of the real path, regular
+ * files only, bounded at the image cap.
+ */
+async function readImageFromDisk(filePath, segmentIndex, policy) {
     try {
-        return await readFile(filePath);
+        const read = await readAttachmentFile(filePath, {
+            policy,
+            maxBytes: MAX_IMAGE_BYTES,
+            label: `segment ${segmentIndex} image file`,
+        });
+        return read.buffer;
     }
     catch (error) {
         throw new VideoError({
@@ -206,7 +213,7 @@ function processOrderedCompletions(state) {
  *
  * @throws {VideoError} On generation failure or circuit breaker trip
  */
-async function generateSingleClip(segment, index, videoOptions, region, state) {
+async function generateSingleClip(segment, index, videoOptions, region, state, policy) {
     if (state.circuitOpen) {
         throw new VideoError({
             code: VIDEO_ERROR_CODES.DIRECTOR_CLIP_FAILED,
@@ -219,7 +226,7 @@ async function generateSingleClip(segment, index, videoOptions, region, state) {
     }
     const clipStart = Date.now();
     try {
-        const imageBuffer = await resolveImageToBuffer(segment.image, index);
+        const imageBuffer = await resolveImageToBuffer(segment.image, index, policy);
         // Validate image buffer (type, dimensions, size limits) before generation
         const imageValidation = validateImageForVideo(imageBuffer);
         if (imageValidation) {
@@ -273,7 +280,7 @@ async function generateSingleClip(segment, index, videoOptions, region, state) {
  * @returns Ordered array of clip results (indexed by segment number)
  * @throws {VideoError} On any clip failure (all clips are mandatory)
  */
-async function generateClips(segments, videoOptions, region) {
+async function generateClips(segments, videoOptions, region, policy) {
     const limit = pLimit(CLIP_CONCURRENCY);
     const state = {
         consecutiveFailures: 0,
@@ -282,7 +289,7 @@ async function generateClips(segments, videoOptions, region) {
         completions: new Array(segments.length).fill({ status: "pending" }),
         nextExpectedIndex: 0,
     };
-    const clipPromises = segments.map((segment, i) => limit(() => generateSingleClip(segment, i, videoOptions, region, state)));
+    const clipPromises = segments.map((segment, i) => limit(() => generateSingleClip(segment, i, videoOptions, region, state, policy)));
     // Collect results — any failure is fatal
     const settled = await Promise.allSettled(clipPromises);
     const failures = settled.filter((r) => r.status === "rejected");
@@ -449,8 +456,11 @@ export async function executeDirectorPipeline(segments, videoOptions = {}, direc
         clipDuration,
         resolution: videoOptions.resolution ?? "720p",
     });
+    // The instance's attachment policy for segment images given as URLs or
+    // paths; the environment-derived default when the caller stamped none.
+    const attachmentPolicy = getAttachmentPolicy(directorOptions);
     // Phase 1: Generate all clips
-    const clipResults = await generateClips(segments, videoOptions, region);
+    const clipResults = await generateClips(segments, videoOptions, region, attachmentPolicy);
     logger.info("Phase 1 complete — all clips generated", {
         clipCount: clipResults.length,
         elapsedMs: Date.now() - pipelineStart,

package/dist/adapters/video/ffmpegAdapter.d.ts

@@ -25,6 +25,23 @@ export declare const JPEG_QUALITY = "2";
 export declare const LAST_FRAME_SEEK_OFFSET = "0.5";
 /** Minimum valid MP4 buffer size in bytes (ftyp header = 8 bytes minimum) */
 export declare const MIN_VIDEO_BUFFER_SIZE = 12;
+/**
+ * Input-side options every ffmpeg run here gets, placed before the first
+ * `-i` so they apply to the inputs.
+ *
+ * `-protocol_whitelist file,crypto,data` pins the demuxer to local files: a
+ * playlist or container that references `http://`, `concat:` or `subfile:`
+ * cannot make ffmpeg fetch or read anything else, whatever the installed
+ * build's defaults are. `-nostdin` keeps a child from ever waiting on a
+ * terminal. Passed explicitly rather than relied on, because the whitelist a
+ * build ships with is the build's choice, not ours.
+ */
+export declare const FFMPEG_INPUT_HARDENING: readonly string[];
+/**
+ * Prepend {@link FFMPEG_INPUT_HARDENING} to an argv that names an input, once.
+ * An argv without `-i` (a version probe) is returned as given.
+ */
+export declare function withInputHardening(args: readonly string[]): string[];
 /**
  * Create a tracked temporary directory for FFmpeg operations.
  *

package/dist/adapters/video/ffmpegAdapter.js

@@ -9,9 +9,8 @@
  *
  * @module adapters/video/ffmpegAdapter
  */
-import { randomUUID } from "node:crypto";
 import { readdirSync, rmdirSync, unlinkSync } from "node:fs";
-import { mkdir, readFile, rm, unlink, writeFile } from "node:fs/promises";
+import { mkdtemp, readFile, rm, unlink, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { logger } from "../../utils/logger.js";
@@ -34,6 +33,32 @@ export const LAST_FRAME_SEEK_OFFSET = "0.5";
 export const MIN_VIDEO_BUFFER_SIZE = 12;
 /** MP4 ftyp box magic bytes at offset 4: "ftyp" */
 const FTYP_MAGIC = Buffer.from([0x66, 0x74, 0x79, 0x70]);
+/**
+ * Input-side options every ffmpeg run here gets, placed before the first
+ * `-i` so they apply to the inputs.
+ *
+ * `-protocol_whitelist file,crypto,data` pins the demuxer to local files: a
+ * playlist or container that references `http://`, `concat:` or `subfile:`
+ * cannot make ffmpeg fetch or read anything else, whatever the installed
+ * build's defaults are. `-nostdin` keeps a child from ever waiting on a
+ * terminal. Passed explicitly rather than relied on, because the whitelist a
+ * build ships with is the build's choice, not ours.
+ */
+export const FFMPEG_INPUT_HARDENING = [
+    "-nostdin",
+    "-protocol_whitelist",
+    "file,crypto,data",
+];
+/**
+ * Prepend {@link FFMPEG_INPUT_HARDENING} to an argv that names an input, once.
+ * An argv without `-i` (a version probe) is returned as given.
+ */
+export function withInputHardening(args) {
+    if (!args.includes("-i") || args.includes("-protocol_whitelist")) {
+        return [...args];
+    }
+    return [...FFMPEG_INPUT_HARDENING, ...args];
+}
 // ============================================================================
 // TEMP DIRECTORY MANAGEMENT
 // ============================================================================
@@ -80,8 +105,9 @@ function ensureCleanupRegistered() {
  */
 export async function createTrackedTempDir(prefix) {
     ensureCleanupRegistered();
-    const dir = join(tmpdir(), `neurolink-${prefix}-${randomUUID()}`);
-    await mkdir(dir, { recursive: true });
+    // mkdtemp: an unguessable name AND 0o700, atomically — nothing else on the
+    // host can read the frames or clips that land here.
+    const dir = await mkdtemp(join(tmpdir(), `neurolink-${prefix}-`));
     activeTempDirs.add(dir);
     return dir;
 }
@@ -172,8 +198,9 @@ export async function runFfmpeg(args, options = {}) {
     const ffmpegPath = options.binaryPath ?? (await getFfmpegPath());
     const timeoutMs = options.timeoutMs ?? FFMPEG_FRAME_TIMEOUT_MS;
     const maxBuffer = options.maxBuffer ?? FFMPEG_FRAME_MAX_BUFFER;
+    const hardenedArgs = withInputHardening(args);
     return new Promise((resolve, reject) => {
-        const proc = execFile(ffmpegPath, args, { timeout: timeoutMs, maxBuffer }, (error, stdout, stderr) => {
+        const proc = execFile(ffmpegPath, hardenedArgs, { timeout: timeoutMs, maxBuffer }, (error, stdout, stderr) => {
             if (error) {
                 // execFile's callback error carries no output, but ffmpeg prints a
                 // stream's input report before it exits non-zero on a stream it

package/dist/adapters/video/frameExtractor.js

@@ -59,7 +59,7 @@ async function extractFrame(videoBuffer, position) {
     const inputPath = join(tempDir, "input.mp4");
     const outputPath = join(tempDir, `${position}_frame.jpg`);
     try {
-        await writeFile(inputPath, videoBuffer);
+        await writeFile(inputPath, videoBuffer, { mode: 0o600, flag: "wx" });
         const args = position === "first"
             ? [
                 "-y",

package/dist/adapters/video/videoMerger.js

@@ -27,13 +27,16 @@ async function writeClipsAndBuildConcatList(videoBuffers, tempDir, concatListPat
     const concatLines = [];
     for (let i = 0; i < videoBuffers.length; i++) {
         const inputPath = join(tempDir, `clip_${i}.mp4`);
-        await writeFile(inputPath, videoBuffers[i]);
+        await writeFile(inputPath, videoBuffers[i], { mode: 0o600, flag: "wx" });
         inputPaths.push(inputPath);
         // Normalize backslashes to forward slashes for FFmpeg, then escape single quotes
         const safePath = inputPath.replace(/\\/g, "/").replace(/'/g, "'\\''");
         concatLines.push(`file '${safePath}'`);
     }
-    await writeFile(concatListPath, concatLines.join("\n"));
+    await writeFile(concatListPath, concatLines.join("\n"), {
+        mode: 0o600,
+        flag: "wx",
+    });
     return inputPaths;
 }
 /**

package/dist/agent/arithmeticEvaluator.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Arithmetic evaluator for the built-in `calculateMath` tool.
+ *
+ * The expression is MODEL output. It is parsed by a small recursive-descent
+ * parser and evaluated over numbers only: there is no `Function`, no `eval`,
+ * no property access and no identifier that is not on the fixed allow-list
+ * below. Anything the grammar does not cover is reported as an error.
+ *
+ * Grammar (precedence low → high):
+ *
+ *   expression := term (("+" | "-") term)*
+ *   term       := unary (("*" | "/" | "%") unary)*
+ *   unary      := ("-" | "+") unary | power
+ *   power      := primary ("**" unary)?            right-associative
+ *   primary    := number | constant | function "(" args ")" | "(" expression ")"
+ *
+ * Numbers are decimal literals (`12`, `3.5`, `.5`, `1e-3`). Functions and
+ * constants are the listed `Math` members, accepted with or without the
+ * `Math.` prefix. Unary minus binds looser than `**`, so `-2 ** 2` is `-4`,
+ * as in mathematics (JavaScript rejects that spelling outright).
+ */
+import type { ArithmeticEvaluation } from "../types/index.js";
+/** The names the model may use, for the error text and the tool description. */
+export declare const ARITHMETIC_FUNCTION_NAMES: readonly string[];
+export declare const ARITHMETIC_CONSTANT_NAMES: readonly string[];
+/**
+ * Evaluate an arithmetic expression without executing it as code.
+ *
+ * Total: every failure — unsupported syntax, an unknown name, a result that is
+ * not a finite number — comes back as `{ ok: false, error }`, never a throw.
+ */
+export declare function evaluateArithmetic(expression: string): ArithmeticEvaluation;