@juspay/neurolink 9.25.0 → 9.25.2

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## [9.25.2](https://github.com/juspay/neurolink/compare/v9.25.1...v9.25.2) (2026-03-15)
+
+### Bug Fixes
+
+- **(core):** remove hardcoded Ollama model and unsafe type assertions (BZ-463) ([f12e03b](https://github.com/juspay/neurolink/commit/f12e03bfef007464d27c36b44694c5c4c799c6ea))
+
+## [9.25.1](https://github.com/juspay/neurolink/compare/v9.25.0...v9.25.1) (2026-03-15)
+
+### Bug Fixes
+
+- **(observability):** address code review findings from PR [#860](https://github.com/juspay/neurolink/issues/860) ([1655c7e](https://github.com/juspay/neurolink/commit/1655c7ef6991eb104834e10fa7d21516539ea16d))
+
 ## [9.25.0](https://github.com/juspay/neurolink/compare/v9.24.0...v9.25.0) (2026-03-15)
 
 ### Features

package/dist/core/baseProvider.js

@@ -3,13 +3,9 @@ import { generateText } from "ai";
 import { directAgentTools } from "../agent/directTools.js";
 import { IMAGE_GENERATION_MODELS } from "../core/constants.js";
 import { MiddlewareFactory } from "../middleware/factory.js";
-import { getMetricsAggregator } from "../observability/metricsAggregator.js";
-import { SpanStatus, SpanType } from "../observability/types/spanTypes.js";
-import { SpanSerializer } from "../observability/utils/spanSerializer.js";
 import { ATTR, tracers } from "../telemetry/index.js";
 import { isAbortError } from "../utils/errorHandling.js";
 import { logger } from "../utils/logger.js";
-import { calculateCost } from "../utils/pricing.js";
 import { composeAbortSignals, createTimeoutController, TimeoutError, } from "../utils/timeout.js";
 import { shouldDisableBuiltinTools } from "../utils/toolUtils.js";
 import { getKeyCount, getKeysAsString } from "../utils/transformationUtils.js";
@@ -85,14 +81,6 @@ export class BaseProvider {
      */
     async stream(optionsOrPrompt, analysisSchema) {
         let options = this.normalizeStreamOptions(optionsOrPrompt);
-        // Observability: create metrics span for provider.stream
-        const metricsSpan = SpanSerializer.createSpan(SpanType.MODEL_GENERATION, "provider.stream", {
-            "ai.provider": this.providerName || "unknown",
-            "ai.model": this.modelName || options.model || "unknown",
-            "ai.temperature": options.temperature,
-            "ai.max_tokens": options.maxTokens,
-        }, this._traceContext?.parentSpanId, this._traceContext?.traceId);
-        let metricsSpanRecorded = false;
         // OTEL span for provider-level stream tracing
         const otelStreamSpan = tracers.provider.startSpan("neurolink.provider.stream", {
             kind: SpanKind.CLIENT,
@@ -185,10 +173,6 @@ export class BaseProvider {
             }
         }
         catch (error) {
-            // Observability: record failed stream span
-            metricsSpanRecorded = true;
-            const endedStreamSpan = SpanSerializer.endSpan(metricsSpan, SpanStatus.ERROR, error instanceof Error ? error.message : String(error));
-            getMetricsAggregator().recordSpan(endedStreamSpan);
             otelStreamSpan.setStatus({
                 code: SpanStatusCode.ERROR,
                 message: error instanceof Error ? error.message : String(error),
@@ -197,10 +181,8 @@ export class BaseProvider {
             throw error;
         }
         finally {
-            // Observability: record successful stream span (only if not already ended via error path)
-            if (!metricsSpanRecorded) {
-                const endedStreamSpan = SpanSerializer.endSpan(metricsSpan, SpanStatus.OK);
-                getMetricsAggregator().recordSpan(endedStreamSpan);
+            // End OTEL span on success (only if not already ended via error path)
+            if (otelStreamSpan.isRecording()) {
                 otelStreamSpan.setStatus({ code: SpanStatusCode.OK });
                 otelStreamSpan.end();
             }
@@ -495,13 +477,6 @@ export class BaseProvider {
         const options = this.normalizeTextOptions(optionsOrPrompt);
         this.validateOptions(options);
         const startTime = Date.now();
-        // Observability: create metrics span for provider.generate
-        const metricsSpan = SpanSerializer.createSpan(SpanType.MODEL_GENERATION, "provider.generate", {
-            "ai.provider": this.providerName || "unknown",
-            "ai.model": this.modelName || options.model || "unknown",
-            "ai.temperature": options.temperature,
-            "ai.max_tokens": options.maxTokens,
-        }, this._traceContext?.parentSpanId, this._traceContext?.traceId);
         // OTEL span for provider-level generate tracing
         // Use startActiveSpan pattern via context.with() so child spans become descendants
         const otelSpan = tracers.provider.startSpan("neurolink.provider.generate", {
@@ -690,33 +665,9 @@ export class BaseProvider {
                         });
                     }
                 }
-                // Observability: record successful generate span with token/cost data
-                let enrichedGenerateSpan = { ...metricsSpan };
-                if (enhancedResult?.usage) {
-                    enrichedGenerateSpan = SpanSerializer.enrichWithTokenUsage(enrichedGenerateSpan, {
-                        promptTokens: enhancedResult.usage.input || 0,
-                        completionTokens: enhancedResult.usage.output || 0,
-                        totalTokens: enhancedResult.usage.total || 0,
-                    });
-                    const cost = calculateCost(this.providerName, this.modelName, {
-                        input: enhancedResult.usage.input || 0,
-                        output: enhancedResult.usage.output || 0,
-                        total: enhancedResult.usage.total || 0,
-                    });
-                    if (cost && cost > 0) {
-                        enrichedGenerateSpan = SpanSerializer.enrichWithCost(enrichedGenerateSpan, {
-                            totalCost: cost,
-                        });
-                    }
-                }
-                const endedGenerateSpan = SpanSerializer.endSpan(enrichedGenerateSpan, SpanStatus.OK);
-                getMetricsAggregator().recordSpan(endedGenerateSpan);
                 return await this.enhanceResult(enhancedResult, options, startTime);
             }
             catch (error) {
-                // Observability: record failed generate span
-                const endedGenerateSpan = SpanSerializer.endSpan(metricsSpan, SpanStatus.ERROR, error instanceof Error ? error.message : String(error));
-                getMetricsAggregator().recordSpan(endedGenerateSpan);
                 otelSpan.setStatus({
                     code: SpanStatusCode.ERROR,
                     message: error instanceof Error ? error.message : String(error),

package/dist/lib/core/baseProvider.js

@@ -3,13 +3,9 @@ import { generateText } from "ai";
 import { directAgentTools } from "../agent/directTools.js";
 import { IMAGE_GENERATION_MODELS } from "../core/constants.js";
 import { MiddlewareFactory } from "../middleware/factory.js";
-import { getMetricsAggregator } from "../observability/metricsAggregator.js";
-import { SpanStatus, SpanType } from "../observability/types/spanTypes.js";
-import { SpanSerializer } from "../observability/utils/spanSerializer.js";
 import { ATTR, tracers } from "../telemetry/index.js";
 import { isAbortError } from "../utils/errorHandling.js";
 import { logger } from "../utils/logger.js";
-import { calculateCost } from "../utils/pricing.js";
 import { composeAbortSignals, createTimeoutController, TimeoutError, } from "../utils/timeout.js";
 import { shouldDisableBuiltinTools } from "../utils/toolUtils.js";
 import { getKeyCount, getKeysAsString } from "../utils/transformationUtils.js";
@@ -85,14 +81,6 @@ export class BaseProvider {
      */
     async stream(optionsOrPrompt, analysisSchema) {
         let options = this.normalizeStreamOptions(optionsOrPrompt);
-        // Observability: create metrics span for provider.stream
-        const metricsSpan = SpanSerializer.createSpan(SpanType.MODEL_GENERATION, "provider.stream", {
-            "ai.provider": this.providerName || "unknown",
-            "ai.model": this.modelName || options.model || "unknown",
-            "ai.temperature": options.temperature,
-            "ai.max_tokens": options.maxTokens,
-        }, this._traceContext?.parentSpanId, this._traceContext?.traceId);
-        let metricsSpanRecorded = false;
         // OTEL span for provider-level stream tracing
         const otelStreamSpan = tracers.provider.startSpan("neurolink.provider.stream", {
             kind: SpanKind.CLIENT,
@@ -185,10 +173,6 @@ export class BaseProvider {
             }
         }
         catch (error) {
-            // Observability: record failed stream span
-            metricsSpanRecorded = true;
-            const endedStreamSpan = SpanSerializer.endSpan(metricsSpan, SpanStatus.ERROR, error instanceof Error ? error.message : String(error));
-            getMetricsAggregator().recordSpan(endedStreamSpan);
             otelStreamSpan.setStatus({
                 code: SpanStatusCode.ERROR,
                 message: error instanceof Error ? error.message : String(error),
@@ -197,10 +181,8 @@ export class BaseProvider {
             throw error;
         }
         finally {
-            // Observability: record successful stream span (only if not already ended via error path)
-            if (!metricsSpanRecorded) {
-                const endedStreamSpan = SpanSerializer.endSpan(metricsSpan, SpanStatus.OK);
-                getMetricsAggregator().recordSpan(endedStreamSpan);
+            // End OTEL span on success (only if not already ended via error path)
+            if (otelStreamSpan.isRecording()) {
                 otelStreamSpan.setStatus({ code: SpanStatusCode.OK });
                 otelStreamSpan.end();
             }
@@ -495,13 +477,6 @@ export class BaseProvider {
         const options = this.normalizeTextOptions(optionsOrPrompt);
         this.validateOptions(options);
         const startTime = Date.now();
-        // Observability: create metrics span for provider.generate
-        const metricsSpan = SpanSerializer.createSpan(SpanType.MODEL_GENERATION, "provider.generate", {
-            "ai.provider": this.providerName || "unknown",
-            "ai.model": this.modelName || options.model || "unknown",
-            "ai.temperature": options.temperature,
-            "ai.max_tokens": options.maxTokens,
-        }, this._traceContext?.parentSpanId, this._traceContext?.traceId);
         // OTEL span for provider-level generate tracing
         // Use startActiveSpan pattern via context.with() so child spans become descendants
         const otelSpan = tracers.provider.startSpan("neurolink.provider.generate", {
@@ -690,33 +665,9 @@ export class BaseProvider {
                         });
                     }
                 }
-                // Observability: record successful generate span with token/cost data
-                let enrichedGenerateSpan = { ...metricsSpan };
-                if (enhancedResult?.usage) {
-                    enrichedGenerateSpan = SpanSerializer.enrichWithTokenUsage(enrichedGenerateSpan, {
-                        promptTokens: enhancedResult.usage.input || 0,
-                        completionTokens: enhancedResult.usage.output || 0,
-                        totalTokens: enhancedResult.usage.total || 0,
-                    });
-                    const cost = calculateCost(this.providerName, this.modelName, {
-                        input: enhancedResult.usage.input || 0,
-                        output: enhancedResult.usage.output || 0,
-                        total: enhancedResult.usage.total || 0,
-                    });
-                    if (cost && cost > 0) {
-                        enrichedGenerateSpan = SpanSerializer.enrichWithCost(enrichedGenerateSpan, {
-                            totalCost: cost,
-                        });
-                    }
-                }
-                const endedGenerateSpan = SpanSerializer.endSpan(enrichedGenerateSpan, SpanStatus.OK);
-                getMetricsAggregator().recordSpan(endedGenerateSpan);
                 return await this.enhanceResult(enhancedResult, options, startTime);
             }
             catch (error) {
-                // Observability: record failed generate span
-                const endedGenerateSpan = SpanSerializer.endSpan(metricsSpan, SpanStatus.ERROR, error instanceof Error ? error.message : String(error));
-                getMetricsAggregator().recordSpan(endedGenerateSpan);
                 otelSpan.setStatus({
                     code: SpanStatusCode.ERROR,
                     message: error instanceof Error ? error.message : String(error),

package/dist/lib/neurolink.js

@@ -1263,18 +1263,42 @@ Current user's request: ${currentInput}`;
                     }
                     // Filter and validate models before comparison
                     const validModels = models.filter((m) => m && typeof m === "object" && typeof m.name === "string");
-                    const targetModel = route.model || "llama3.2:latest";
-                    const modelIsAvailable = validModels.some((m) => m.name === targetModel);
-                    if (!modelIsAvailable) {
+                    const targetModel = route.model;
+                    if (targetModel) {
+                        // Check if the specific routed model is available
+                        const modelIsAvailable = validModels.some((m) => m.name === targetModel);
+                        if (!modelIsAvailable) {
+                            logger.debug("Orchestration provider validation failed", {
+                                taskType: classification.type,
+                                routedProvider: route.provider,
+                                routedModel: route.model,
+                                reason: `Ollama model '${targetModel}' not found`,
+                                orchestrationTime: `${Date.now() - startTime}ms`,
+                            });
+                            // Fall back to first available model instead of abandoning orchestration
+                            if (validModels.length > 0) {
+                                route.model = validModels[0].name;
+                            }
+                            else {
+                                return {}; // No models at all — preserve existing fallback behavior
+                            }
+                        }
+                    }
+                    else if (validModels.length === 0) {
+                        // No model specified and none available
                         logger.debug("Orchestration provider validation failed", {
                             taskType: classification.type,
                             routedProvider: route.provider,
                             routedModel: route.model,
-                            reason: `Ollama model '${route.model || "llama3.2:latest"}' not found`,
+                            reason: "No Ollama models available",
                             orchestrationTime: `${Date.now() - startTime}ms`,
                         });
                         return {}; // Return empty object to preserve existing fallback behavior
                     }
+                    else {
+                        // No model specified but models are available — use the first one
+                        route.model = validModels[0].name;
+                    }
                 }
                 catch (error) {
                     logger.debug("Orchestration provider validation failed", {
@@ -1377,18 +1401,42 @@ Current user's request: ${currentInput}`;
                     }
                     // Filter and validate models before comparison
                     const validModels = models.filter((m) => m && typeof m === "object" && typeof m.name === "string");
-                    const targetModel = route.model || "llama3.2:latest";
-                    const modelIsAvailable = validModels.some((m) => m.name === targetModel);
-                    if (!modelIsAvailable) {
+                    const targetModel = route.model;
+                    if (targetModel) {
+                        // Check if the specific routed model is available
+                        const modelIsAvailable = validModels.some((m) => m.name === targetModel);
+                        if (!modelIsAvailable) {
+                            logger.debug("Stream orchestration provider validation failed", {
+                                taskType: classification.type,
+                                routedProvider: route.provider,
+                                routedModel: route.model,
+                                reason: `Ollama model '${targetModel}' not found`,
+                                orchestrationTime: `${Date.now() - startTime}ms`,
+                            });
+                            // Fall back to first available model instead of abandoning orchestration
+                            if (validModels.length > 0) {
+                                route.model = validModels[0].name;
+                            }
+                            else {
+                                return {}; // No models at all — preserve existing fallback behavior
+                            }
+                        }
+                    }
+                    else if (validModels.length === 0) {
+                        // No model specified and none available
                         logger.debug("Stream orchestration provider validation failed", {
                             taskType: classification.type,
                             routedProvider: route.provider,
                             routedModel: route.model,
-                            reason: `Ollama model '${route.model || "llama3.2:latest"}' not found`,
+                            reason: "No Ollama models available",
                             orchestrationTime: `${Date.now() - startTime}ms`,
                         });
                         return {}; // Return empty object to preserve existing fallback behavior
                     }
+                    else {
+                        // No model specified but models are available — use the first one
+                        route.model = validModels[0].name;
+                    }
                 }
                 catch (error) {
                     logger.debug("Stream orchestration provider validation failed", {
@@ -1693,7 +1741,11 @@ Current user's request: ${currentInput}`;
                     span.spanId = traceCtx.parentSpanId;
                     span.parentSpanId = undefined;
                 }
-                span = SpanSerializer.endSpan(span, SpanStatus.OK);
+                // Mark failed generations with ERROR status so metrics count them correctly
+                const spanStatus = data.success === false || data.error
+                    ? SpanStatus.ERROR
+                    : SpanStatus.OK;
+                span = SpanSerializer.endSpan(span, spanStatus, data.error ? String(data.error) : undefined);
                 span.durationMs = responseTime;
                 if (usage) {
                     span = SpanSerializer.enrichWithTokenUsage(span, {
@@ -2261,19 +2313,14 @@ Current user's request: ${currentInput}`;
                             evaluation: textResult.evaluation
                                 ? {
                                     ...textResult.evaluation,
-                                    isOffTopic: textResult.evaluation
-                                        .isOffTopic ?? false,
-                                    alertSeverity: textResult.evaluation
-                                        .alertSeverity ?? "none",
-                                    reasoning: textResult.evaluation
-                                        .reasoning ?? "No evaluation provided",
-                                    evaluationModel: textResult.evaluation
-                                        .evaluationModel ?? "unknown",
-                                    evaluationTime: textResult.evaluation
-                                        .evaluationTime ?? Date.now(),
-                                    // Include evaluationDomain from original options
-                                    evaluationDomain: textResult.evaluation
-                                        .evaluationDomain ??
+                                    isOffTopic: textResult.evaluation.isOffTopic ?? false,
+                                    alertSeverity: textResult.evaluation.alertSeverity ??
+                                        "none",
+                                    reasoning: textResult.evaluation.reasoning ??
+                                        "No evaluation provided",
+                                    evaluationModel: textResult.evaluation.evaluationModel ?? "unknown",
+                                    evaluationTime: textResult.evaluation.evaluationTime ?? Date.now(),
+                                    evaluationDomain: textResult.evaluation.evaluationDomain ??
                                         textOptions.evaluationDomain ??
                                         factoryResult.domainType,
                                 }
@@ -2304,6 +2351,27 @@ Current user's request: ${currentInput}`;
                         code: SpanStatusCode.ERROR,
                         message: error instanceof Error ? error.message : String(error),
                     });
+                    // Emit generation:end on error so metrics listeners still record the failure.
+                    // Note: variables declared inside try blocks are not accessible in error
+                    // handlers, so we extract what we can from the original input.
+                    const errProvider = typeof optionsOrPrompt === "object"
+                        ? optionsOrPrompt.provider || "unknown"
+                        : "unknown";
+                    const errModel = typeof optionsOrPrompt === "object"
+                        ? optionsOrPrompt.model || "unknown"
+                        : "unknown";
+                    try {
+                        this.emitter.emit("generation:end", {
+                            provider: errProvider,
+                            model: errModel,
+                            responseTime: 0,
+                            error: error instanceof Error ? error.message : String(error),
+                            success: false,
+                        });
+                    }
+                    catch (emitError) {
+                        void emitError; // non-blocking — error event emission is best-effort
+                    }
                     throw error;
                 }
                 finally {
@@ -4363,7 +4431,7 @@ Current user's request: ${currentInput}`;
         // Accept audio when frames are present; sampleRateHz is optional (defaults applied later)
         const hasAudio = !!(options?.input?.audio &&
             options.input.audio.frames &&
-            typeof options.input.audio.frames[Symbol.asyncIterator] !== "undefined");
+            typeof options.input.audio.frames[Symbol.asyncIterator] === "function");
         if (!hasText && !hasAudio) {
             throw new Error("Stream options must include either input.text or input.audio");
         }
@@ -5085,8 +5153,7 @@ Current user's request: ${currentInput}`;
         }
         // Check if the memory manager is Redis-backed (has updateAgenticLoopReport method)
         if (!("updateAgenticLoopReport" in this.conversationMemory) ||
-            typeof this.conversationMemory
-                .updateAgenticLoopReport !== "function") {
+            typeof this.conversationMemory.updateAgenticLoopReport !== "function") {
             throw new ConversationMemoryError("updateAgenticLoopReport is only supported with Redis conversation memory.", "CONFIG_ERROR");
         }
         await withTimeout(this
@@ -5787,7 +5854,6 @@ Current user's request: ${currentInput}`;
                         }
                         const responseData = await response.json();
                         const models = responseData?.models;
-                        const defaultOllamaModel = "llama3.2:latest";
                         // Runtime-safe guard: ensure models is an array with valid objects
                         if (!Array.isArray(models)) {
                             logger.warn("Ollama API returned invalid models format in testProvider", {
@@ -5798,15 +5864,14 @@ Current user's request: ${currentInput}`;
                         }
                         // Filter and validate models before comparison
                         const validModels = models.filter((m) => m && typeof m === "object" && typeof m.name === "string");
-                        const modelIsAvailable = validModels.some((m) => m.name === defaultOllamaModel);
-                        if (modelIsAvailable) {
+                        if (validModels.length > 0) {
                             return {
                                 provider: providerName,
                                 status: "working",
                                 configured: true,
                                 authenticated: true,
                                 responseTime: Date.now() - startTime,
-                                model: defaultOllamaModel,
+                                model: validModels[0].name,
                             };
                         }
                         else {
@@ -5815,7 +5880,7 @@ Current user's request: ${currentInput}`;
                                 status: "failed",
                                 configured: true,
                                 authenticated: false,
-                                error: `Ollama service running but model '${defaultOllamaModel}' not found`,
+                                error: "Ollama service running but no models installed",
                                 responseTime: Date.now() - startTime,
                             };
                         }

package/dist/lib/observability/exporters/langfuseExporter.js

@@ -118,7 +118,9 @@ export class LangfuseExporter extends BaseExporter {
             name: span.name,
             userId: span.attributes["user.id"],
             sessionId: span.attributes["session.id"],
-            metadata: span.attributes,
+            // Only pick safe, non-PII attributes for metadata — intentionally excludes
+            // input, output, error.stack, and other user content to match Braintrust exporter
+            metadata: filterSafeMetadata(span.attributes),
             release: this.release,
             tags: this.extractTags(span),
         };
@@ -197,4 +199,6 @@ export class LangfuseExporter extends BaseExporter {
         return tags;
     }
 }
+// Safe metadata filtering imported from shared module to avoid duplication
+import { filterSafeMetadata } from "../utils/safeMetadata.js";
 //# sourceMappingURL=langfuseExporter.js.map

package/dist/lib/observability/metricsAggregator.js

@@ -35,8 +35,12 @@ export class MetricsAggregator {
     recordSpan(span) {
         // Enforce maximum spans limit
         if (this.spans.length >= this.config.maxSpansRetained) {
-            this.spans.shift(); // Remove oldest span
-            // Note: We keep aggregated metrics, only raw spans are trimmed
+            const evicted = this.spans.shift(); // Remove oldest span
+            // Only trim latencyValues when the evicted span had a duration recorded
+            if (evicted?.durationMs !== undefined) {
+                this.latencyValues.shift();
+            }
+            // Note: We keep aggregated metrics, only raw spans and latency values are trimmed
         }
         this.spans.push(span);
         // Update timestamps

package/dist/lib/observability/spanProcessor.js

@@ -66,6 +66,8 @@ export class RedactionProcessor {
             "credentials",
             "private_key",
             "privateKey",
+            "stack",
+            "error.stack",
         ]);
         this.redactedValue = config?.redactedValue ?? "[REDACTED]";
     }
@@ -228,11 +230,25 @@ export class BatchProcessor {
             this.flush();
         }, this.flushIntervalMs);
     }
+    // Note: flush() is intentionally synchronous. The onBatchReady callback is
+    // typed as `(spans: SpanData[]) => void` — callers must not pass async
+    // exporters. If async export is needed, the callback should handle its own
+    // error reporting (e.g. fire-and-forget with promise error handlers).
     flush() {
         if (this.batch.length > 0 && this.onBatchReady) {
             const spans = [...this.batch];
-            this.batch = [];
-            this.onBatchReady(spans);
+            try {
+                this.onBatchReady(spans);
+                this.batch = [];
+            }
+            catch (flushError) {
+                // Keep spans for next flush attempt, but cap backlog growth
+                void flushError; // acknowledged — error is expected during exporter outages
+                const maxBacklog = this.batchSize * 20;
+                if (this.batch.length > maxBacklog) {
+                    this.batch = this.batch.slice(this.batch.length - maxBacklog);
+                }
+            }
         }
     }
     async shutdown() {

package/dist/lib/observability/utils/safeMetadata.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Safe metadata filtering for observability exporters.
+ *
+ * Only these attribute keys are forwarded to third-party backends as trace
+ * metadata. User prompts (input), LLM responses (output), error stacks, and
+ * any other potentially sensitive data are excluded to prevent PII leaks.
+ */
+import type { SpanAttributes } from "../types/spanTypes.js";
+export declare const SAFE_METADATA_KEYS: Set<string>;
+export declare function filterSafeMetadata(attributes: SpanAttributes): Record<string, unknown>;

package/dist/lib/observability/utils/safeMetadata.js

@@ -0,0 +1,26 @@
+/**
+ * Safe metadata filtering for observability exporters.
+ *
+ * Only these attribute keys are forwarded to third-party backends as trace
+ * metadata. User prompts (input), LLM responses (output), error stacks, and
+ * any other potentially sensitive data are excluded to prevent PII leaks.
+ */
+// Only ai.* keys are forwarded as metadata. Stream metrics (chunk_count,
+// content_length) should be accessed via span attributes directly, not via
+// metadata sent to third-party backends.
+export const SAFE_METADATA_KEYS = new Set([
+    "ai.provider",
+    "ai.model",
+    "ai.temperature",
+    "ai.max_tokens",
+]);
+export function filterSafeMetadata(attributes) {
+    const filtered = {};
+    for (const key of SAFE_METADATA_KEYS) {
+        if (attributes[key] !== undefined) {
+            filtered[key] = attributes[key];
+        }
+    }
+    return filtered;
+}
+//# sourceMappingURL=safeMetadata.js.map

package/dist/lib/observability/utils/spanSerializer.js

@@ -104,7 +104,9 @@ export class SpanSerializer {
             name: span.name,
             startTime: span.startTime,
             endTime: span.endTime,
-            metadata: { ...span.attributes },
+            // Only pick safe, non-PII attributes for metadata — intentionally excludes
+            // input, output, error.stack, and other user content for PII safety
+            metadata: filterSafeMetadata(span.attributes),
             level: span.status === SpanStatus.ERROR ? "ERROR" : "DEFAULT",
             statusMessage: span.statusMessage,
             input: span.attributes["input"],
@@ -284,4 +286,6 @@ export class SpanSerializer {
         });
     }
 }
+// Safe metadata filtering imported from shared module to avoid duplication
+import { filterSafeMetadata } from "./safeMetadata.js";
 //# sourceMappingURL=spanSerializer.js.map

package/dist/lib/providers/googleVertex.js

@@ -1259,9 +1259,7 @@ export class GoogleVertexProvider extends BaseProvider {
                     },
                     {
                         role: "model",
-                        parts: [
-                            { text: "Understood. I will follow these instructions." },
-                        ],
+                        parts: [{ text: "OK" }],
                     },
                     ...currentContents,
                 ];
@@ -1435,9 +1433,7 @@ export class GoogleVertexProvider extends BaseProvider {
                     },
                     {
                         role: "model",
-                        parts: [
-                            { text: "Understood. I will follow these instructions." },
-                        ],
+                        parts: [{ text: "OK" }],
                     },
                     ...currentContents,
                 ];

package/dist/neurolink.js

@@ -1263,18 +1263,42 @@ Current user's request: ${currentInput}`;
                     }
                     // Filter and validate models before comparison
                     const validModels = models.filter((m) => m && typeof m === "object" && typeof m.name === "string");
-                    const targetModel = route.model || "llama3.2:latest";
-                    const modelIsAvailable = validModels.some((m) => m.name === targetModel);
-                    if (!modelIsAvailable) {
+                    const targetModel = route.model;
+                    if (targetModel) {
+                        // Check if the specific routed model is available
+                        const modelIsAvailable = validModels.some((m) => m.name === targetModel);
+                        if (!modelIsAvailable) {
+                            logger.debug("Orchestration provider validation failed", {
+                                taskType: classification.type,
+                                routedProvider: route.provider,
+                                routedModel: route.model,
+                                reason: `Ollama model '${targetModel}' not found`,
+                                orchestrationTime: `${Date.now() - startTime}ms`,
+                            });
+                            // Fall back to first available model instead of abandoning orchestration
+                            if (validModels.length > 0) {
+                                route.model = validModels[0].name;
+                            }
+                            else {
+                                return {}; // No models at all — preserve existing fallback behavior
+                            }
+                        }
+                    }
+                    else if (validModels.length === 0) {
+                        // No model specified and none available
                         logger.debug("Orchestration provider validation failed", {
                             taskType: classification.type,
                             routedProvider: route.provider,
                             routedModel: route.model,
-                            reason: `Ollama model '${route.model || "llama3.2:latest"}' not found`,
+                            reason: "No Ollama models available",
                             orchestrationTime: `${Date.now() - startTime}ms`,
                         });
                         return {}; // Return empty object to preserve existing fallback behavior
                     }
+                    else {
+                        // No model specified but models are available — use the first one
+                        route.model = validModels[0].name;
+                    }
                 }
                 catch (error) {
                     logger.debug("Orchestration provider validation failed", {
@@ -1377,18 +1401,42 @@ Current user's request: ${currentInput}`;
                     }
                     // Filter and validate models before comparison
                     const validModels = models.filter((m) => m && typeof m === "object" && typeof m.name === "string");
-                    const targetModel = route.model || "llama3.2:latest";
-                    const modelIsAvailable = validModels.some((m) => m.name === targetModel);
-                    if (!modelIsAvailable) {
+                    const targetModel = route.model;
+                    if (targetModel) {
+                        // Check if the specific routed model is available
+                        const modelIsAvailable = validModels.some((m) => m.name === targetModel);
+                        if (!modelIsAvailable) {
+                            logger.debug("Stream orchestration provider validation failed", {
+                                taskType: classification.type,
+                                routedProvider: route.provider,
+                                routedModel: route.model,
+                                reason: `Ollama model '${targetModel}' not found`,
+                                orchestrationTime: `${Date.now() - startTime}ms`,
+                            });
+                            // Fall back to first available model instead of abandoning orchestration
+                            if (validModels.length > 0) {
+                                route.model = validModels[0].name;
+                            }
+                            else {
+                                return {}; // No models at all — preserve existing fallback behavior
+                            }
+                        }
+                    }
+                    else if (validModels.length === 0) {
+                        // No model specified and none available
                         logger.debug("Stream orchestration provider validation failed", {
                             taskType: classification.type,
                             routedProvider: route.provider,
                             routedModel: route.model,
-                            reason: `Ollama model '${route.model || "llama3.2:latest"}' not found`,
+                            reason: "No Ollama models available",
                             orchestrationTime: `${Date.now() - startTime}ms`,
                         });
                         return {}; // Return empty object to preserve existing fallback behavior
                     }
+                    else {
+                        // No model specified but models are available — use the first one
+                        route.model = validModels[0].name;
+                    }
                 }
                 catch (error) {
                     logger.debug("Stream orchestration provider validation failed", {
@@ -1693,7 +1741,11 @@ Current user's request: ${currentInput}`;
                     span.spanId = traceCtx.parentSpanId;
                     span.parentSpanId = undefined;
                 }
-                span = SpanSerializer.endSpan(span, SpanStatus.OK);
+                // Mark failed generations with ERROR status so metrics count them correctly
+                const spanStatus = data.success === false || data.error
+                    ? SpanStatus.ERROR
+                    : SpanStatus.OK;
+                span = SpanSerializer.endSpan(span, spanStatus, data.error ? String(data.error) : undefined);
                 span.durationMs = responseTime;
                 if (usage) {
                     span = SpanSerializer.enrichWithTokenUsage(span, {
@@ -2261,19 +2313,14 @@ Current user's request: ${currentInput}`;
                             evaluation: textResult.evaluation
                                 ? {
                                     ...textResult.evaluation,
-                                    isOffTopic: textResult.evaluation
-                                        .isOffTopic ?? false,
-                                    alertSeverity: textResult.evaluation
-                                        .alertSeverity ?? "none",
-                                    reasoning: textResult.evaluation
-                                        .reasoning ?? "No evaluation provided",
-                                    evaluationModel: textResult.evaluation
-                                        .evaluationModel ?? "unknown",
-                                    evaluationTime: textResult.evaluation
-                                        .evaluationTime ?? Date.now(),
-                                    // Include evaluationDomain from original options
-                                    evaluationDomain: textResult.evaluation
-                                        .evaluationDomain ??
+                                    isOffTopic: textResult.evaluation.isOffTopic ?? false,
+                                    alertSeverity: textResult.evaluation.alertSeverity ??
+                                        "none",
+                                    reasoning: textResult.evaluation.reasoning ??
+                                        "No evaluation provided",
+                                    evaluationModel: textResult.evaluation.evaluationModel ?? "unknown",
+                                    evaluationTime: textResult.evaluation.evaluationTime ?? Date.now(),
+                                    evaluationDomain: textResult.evaluation.evaluationDomain ??
                                         textOptions.evaluationDomain ??
                                         factoryResult.domainType,
                                 }
@@ -2304,6 +2351,27 @@ Current user's request: ${currentInput}`;
                         code: SpanStatusCode.ERROR,
                         message: error instanceof Error ? error.message : String(error),
                     });
+                    // Emit generation:end on error so metrics listeners still record the failure.
+                    // Note: variables declared inside try blocks are not accessible in error
+                    // handlers, so we extract what we can from the original input.
+                    const errProvider = typeof optionsOrPrompt === "object"
+                        ? optionsOrPrompt.provider || "unknown"
+                        : "unknown";
+                    const errModel = typeof optionsOrPrompt === "object"
+                        ? optionsOrPrompt.model || "unknown"
+                        : "unknown";
+                    try {
+                        this.emitter.emit("generation:end", {
+                            provider: errProvider,
+                            model: errModel,
+                            responseTime: 0,
+                            error: error instanceof Error ? error.message : String(error),
+                            success: false,
+                        });
+                    }
+                    catch (emitError) {
+                        void emitError; // non-blocking — error event emission is best-effort
+                    }
                     throw error;
                 }
                 finally {
@@ -4363,7 +4431,7 @@ Current user's request: ${currentInput}`;
         // Accept audio when frames are present; sampleRateHz is optional (defaults applied later)
         const hasAudio = !!(options?.input?.audio &&
             options.input.audio.frames &&
-            typeof options.input.audio.frames[Symbol.asyncIterator] !== "undefined");
+            typeof options.input.audio.frames[Symbol.asyncIterator] === "function");
         if (!hasText && !hasAudio) {
             throw new Error("Stream options must include either input.text or input.audio");
         }
@@ -5085,8 +5153,7 @@ Current user's request: ${currentInput}`;
         }
         // Check if the memory manager is Redis-backed (has updateAgenticLoopReport method)
         if (!("updateAgenticLoopReport" in this.conversationMemory) ||
-            typeof this.conversationMemory
-                .updateAgenticLoopReport !== "function") {
+            typeof this.conversationMemory.updateAgenticLoopReport !== "function") {
             throw new ConversationMemoryError("updateAgenticLoopReport is only supported with Redis conversation memory.", "CONFIG_ERROR");
         }
         await withTimeout(this
@@ -5787,7 +5854,6 @@ Current user's request: ${currentInput}`;
                         }
                         const responseData = await response.json();
                         const models = responseData?.models;
-                        const defaultOllamaModel = "llama3.2:latest";
                         // Runtime-safe guard: ensure models is an array with valid objects
                         if (!Array.isArray(models)) {
                             logger.warn("Ollama API returned invalid models format in testProvider", {
@@ -5798,15 +5864,14 @@ Current user's request: ${currentInput}`;
                         }
                         // Filter and validate models before comparison
                         const validModels = models.filter((m) => m && typeof m === "object" && typeof m.name === "string");
-                        const modelIsAvailable = validModels.some((m) => m.name === defaultOllamaModel);
-                        if (modelIsAvailable) {
+                        if (validModels.length > 0) {
                             return {
                                 provider: providerName,
                                 status: "working",
                                 configured: true,
                                 authenticated: true,
                                 responseTime: Date.now() - startTime,
-                                model: defaultOllamaModel,
+                                model: validModels[0].name,
                             };
                         }
                         else {
@@ -5815,7 +5880,7 @@ Current user's request: ${currentInput}`;
                                 status: "failed",
                                 configured: true,
                                 authenticated: false,
-                                error: `Ollama service running but model '${defaultOllamaModel}' not found`,
+                                error: "Ollama service running but no models installed",
                                 responseTime: Date.now() - startTime,
                             };
                         }

package/dist/observability/exporters/langfuseExporter.js

@@ -118,7 +118,9 @@ export class LangfuseExporter extends BaseExporter {
             name: span.name,
             userId: span.attributes["user.id"],
             sessionId: span.attributes["session.id"],
-            metadata: span.attributes,
+            // Only pick safe, non-PII attributes for metadata — intentionally excludes
+            // input, output, error.stack, and other user content to match Braintrust exporter
+            metadata: filterSafeMetadata(span.attributes),
             release: this.release,
             tags: this.extractTags(span),
         };
@@ -197,3 +199,5 @@ export class LangfuseExporter extends BaseExporter {
         return tags;
     }
 }
+// Safe metadata filtering imported from shared module to avoid duplication
+import { filterSafeMetadata } from "../utils/safeMetadata.js";

package/dist/observability/metricsAggregator.js

@@ -35,8 +35,12 @@ export class MetricsAggregator {
     recordSpan(span) {
         // Enforce maximum spans limit
         if (this.spans.length >= this.config.maxSpansRetained) {
-            this.spans.shift(); // Remove oldest span
-            // Note: We keep aggregated metrics, only raw spans are trimmed
+            const evicted = this.spans.shift(); // Remove oldest span
+            // Only trim latencyValues when the evicted span had a duration recorded
+            if (evicted?.durationMs !== undefined) {
+                this.latencyValues.shift();
+            }
+            // Note: We keep aggregated metrics, only raw spans and latency values are trimmed
         }
         this.spans.push(span);
         // Update timestamps

package/dist/observability/spanProcessor.js

@@ -66,6 +66,8 @@ export class RedactionProcessor {
             "credentials",
             "private_key",
             "privateKey",
+            "stack",
+            "error.stack",
         ]);
         this.redactedValue = config?.redactedValue ?? "[REDACTED]";
     }
@@ -228,11 +230,25 @@ export class BatchProcessor {
             this.flush();
         }, this.flushIntervalMs);
     }
+    // Note: flush() is intentionally synchronous. The onBatchReady callback is
+    // typed as `(spans: SpanData[]) => void` — callers must not pass async
+    // exporters. If async export is needed, the callback should handle its own
+    // error reporting (e.g. fire-and-forget with promise error handlers).
     flush() {
         if (this.batch.length > 0 && this.onBatchReady) {
             const spans = [...this.batch];
-            this.batch = [];
-            this.onBatchReady(spans);
+            try {
+                this.onBatchReady(spans);
+                this.batch = [];
+            }
+            catch (flushError) {
+                // Keep spans for next flush attempt, but cap backlog growth
+                void flushError; // acknowledged — error is expected during exporter outages
+                const maxBacklog = this.batchSize * 20;
+                if (this.batch.length > maxBacklog) {
+                    this.batch = this.batch.slice(this.batch.length - maxBacklog);
+                }
+            }
         }
     }
     async shutdown() {

package/dist/observability/utils/safeMetadata.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Safe metadata filtering for observability exporters.
+ *
+ * Only these attribute keys are forwarded to third-party backends as trace
+ * metadata. User prompts (input), LLM responses (output), error stacks, and
+ * any other potentially sensitive data are excluded to prevent PII leaks.
+ */
+import type { SpanAttributes } from "../types/spanTypes.js";
+export declare const SAFE_METADATA_KEYS: Set<string>;
+export declare function filterSafeMetadata(attributes: SpanAttributes): Record<string, unknown>;

package/dist/observability/utils/safeMetadata.js

@@ -0,0 +1,25 @@
+/**
+ * Safe metadata filtering for observability exporters.
+ *
+ * Only these attribute keys are forwarded to third-party backends as trace
+ * metadata. User prompts (input), LLM responses (output), error stacks, and
+ * any other potentially sensitive data are excluded to prevent PII leaks.
+ */
+// Only ai.* keys are forwarded as metadata. Stream metrics (chunk_count,
+// content_length) should be accessed via span attributes directly, not via
+// metadata sent to third-party backends.
+export const SAFE_METADATA_KEYS = new Set([
+    "ai.provider",
+    "ai.model",
+    "ai.temperature",
+    "ai.max_tokens",
+]);
+export function filterSafeMetadata(attributes) {
+    const filtered = {};
+    for (const key of SAFE_METADATA_KEYS) {
+        if (attributes[key] !== undefined) {
+            filtered[key] = attributes[key];
+        }
+    }
+    return filtered;
+}

package/dist/observability/utils/spanSerializer.js

@@ -104,7 +104,9 @@ export class SpanSerializer {
             name: span.name,
             startTime: span.startTime,
             endTime: span.endTime,
-            metadata: { ...span.attributes },
+            // Only pick safe, non-PII attributes for metadata — intentionally excludes
+            // input, output, error.stack, and other user content for PII safety
+            metadata: filterSafeMetadata(span.attributes),
             level: span.status === SpanStatus.ERROR ? "ERROR" : "DEFAULT",
             statusMessage: span.statusMessage,
             input: span.attributes["input"],
@@ -284,3 +286,5 @@ export class SpanSerializer {
         });
     }
 }
+// Safe metadata filtering imported from shared module to avoid duplication
+import { filterSafeMetadata } from "./safeMetadata.js";

package/dist/providers/googleVertex.js

@@ -1259,9 +1259,7 @@ export class GoogleVertexProvider extends BaseProvider {
                     },
                     {
                         role: "model",
-                        parts: [
-                            { text: "Understood. I will follow these instructions." },
-                        ],
+                        parts: [{ text: "OK" }],
                     },
                     ...currentContents,
                 ];
@@ -1435,9 +1433,7 @@ export class GoogleVertexProvider extends BaseProvider {
                     },
                     {
                         role: "model",
-                        parts: [
-                            { text: "Understood. I will follow these instructions." },
-                        ],
+                        parts: [{ text: "OK" }],
                     },
                     ...currentContents,
                 ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@juspay/neurolink",
-  "version": "9.25.0",
+  "version": "9.25.2",
   "description": "Universal AI Development Platform with working MCP integration, multi-provider support, and professional CLI. Built-in tools operational, 58+ external MCP servers discoverable. Connect to filesystem, GitHub, database operations, and more. Build, test, and deploy AI applications with 13 providers: OpenAI, Anthropic, Google AI, AWS Bedrock, Azure, Hugging Face, Ollama, and Mistral AI.",
   "author": {
     "name": "Juspay Technologies",