@juspay/neurolink 9.55.10 → 9.55.11

package/dist/mcp/toolDiscoveryService.js

@@ -9,10 +9,72 @@ import { globalCircuitBreakerManager, CircuitBreakerOpenError, } from "./mcpCirc
 import { isObject, isNullish } from "../utils/typeUtils.js";
 import { validateToolName, validateToolDescription, } from "../utils/parameterValidation.js";
 import { withTimeout } from "../utils/errorHandling.js";
+import { extractMcpErrorText } from "../utils/mcpErrorText.js";
 import { SpanKind, SpanStatusCode } from "@opentelemetry/api";
 import { tracers } from "../telemetry/tracers.js";
 import { withSpan } from "../telemetry/withSpan.js";
 const mcpTracer = tracers.mcp;
+/**
+ * JSON-stringify a value for a Langfuse input/output preview attribute,
+ * truncated to a hard cap to stay under span attribute size limits. The
+ * returned string is guaranteed to be ≤ maxLen characters; when truncated,
+ * the last character is replaced with an ellipsis.
+ */
+function safeJsonStringify(value, maxLen) {
+    if (maxLen <= 0) {
+        return "";
+    }
+    try {
+        const str = JSON.stringify(value);
+        if (typeof str !== "string") {
+            return "";
+        }
+        if (str.length <= maxLen) {
+            return str;
+        }
+        return str.slice(0, Math.max(0, maxLen - 1)) + "…";
+    }
+    catch {
+        return "";
+    }
+}
+/**
+ * Match property names that commonly hold secrets. Values under these keys
+ * are replaced with `[REDACTED]` before serialization. Case-insensitive.
+ * Conservative list — anything matching *here* is masked; the rest of the
+ * structure is preserved so Langfuse still gets a meaningful preview.
+ */
+const SENSITIVE_KEY_PATTERN = /^(password|passwd|secret|token|api[_-]?key|apikey|access[_-]?key|authorization|auth|bearer|credential|cookie|session[_-]?id|private[_-]?key|client[_-]?secret|refresh[_-]?token|x-api-key)$/i;
+/**
+ * Walk a value, producing a structurally-equivalent copy with sensitive-key
+ * values masked. Unlike `transformParamsForLogging` (which collapses objects
+ * to a "N params" string), this preserves non-sensitive content so Langfuse
+ * input/output previews stay useful. Bounded depth guards against cycles.
+ */
+function redactForPreview(value, depth = 0) {
+    if (depth > 10) {
+        return "[...]";
+    }
+    if (value === null || value === undefined) {
+        return value;
+    }
+    if (typeof value !== "object") {
+        return value;
+    }
+    if (Array.isArray(value)) {
+        return value.map((v) => redactForPreview(v, depth + 1));
+    }
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+        if (SENSITIVE_KEY_PATTERN.test(k)) {
+            out[k] = "[REDACTED]";
+        }
+        else {
+            out[k] = redactForPreview(v, depth + 1);
+        }
+    }
+    return out;
+}
 /**
  * Default timeout for MCP tool execution operations in milliseconds.
  * Configurable via MCP_TOOL_TIMEOUT env var.
@@ -376,6 +438,18 @@ export class ToolDiscoveryService extends EventEmitter {
                         "mcp.server_id": serverId,
                         "mcp.tool_name": toolName,
                         "mcp.timeout_ms": effectiveTimeout,
+                        // Curator P1-4: Langfuse observations rely on ai.*/gen_ai.*
+                        // attributes for tool name and I/O previews. Provide them so
+                        // the SPAN observation in Langfuse is legible without
+                        // timestamp-joining against the parent ai.toolCall. Redact
+                        // parameters via the existing secret-stripping helper so
+                        // tokens/credentials/paths don't leave the process.
+                        "ai.tool.name": toolName,
+                        "gen_ai.tool.name": toolName,
+                        "gen_ai.request": safeJsonStringify({
+                            name: toolName,
+                            arguments: redactForPreview(parameters),
+                        }, 2048),
                     },
                 }, async (callSpan) => {
                     try {
@@ -384,11 +458,26 @@ export class ToolDiscoveryService extends EventEmitter {
                             name: toolName,
                             arguments: parameters,
                         }), timeout, new Error(`Tool execution timeout: ${toolName}`));
-                        callSpan.setStatus({ code: SpanStatusCode.OK });
+                        // Curator P0-1/P0-2: the MCP client does NOT throw on protocol
+                        // errors — it returns { isError: true, content: [...] }. Detect
+                        // that pattern so the span status reflects reality.
+                        const resultObj = callResult;
+                        if (resultObj && resultObj.isError === true) {
+                            const errorText = extractMcpErrorText(resultObj);
+                            callSpan.setStatus({
+                                code: SpanStatusCode.ERROR,
+                                message: errorText || `Tool ${toolName} returned isError`,
+                            });
+                        }
+                        else {
+                            callSpan.setStatus({ code: SpanStatusCode.OK });
+                        }
                         // ── MCP output normalization ──────────────────────────────────
                         // Intercept here — after receive, before cache, before memory,
                         // before LLM context injection. Returns a compact surrogate when
                         // the payload exceeds mcp.outputLimits.maxBytes.
+                        let resultForPreview = callResult;
+                        let resultForReturn = callResult;
                         if (this.outputNormalizer) {
                             try {
                                 const normalized = await this.outputNormalizer.normalize(callResult, { toolName, serverId });
@@ -396,7 +485,8 @@ export class ToolDiscoveryService extends EventEmitter {
                                 if (normalized.isExternalized) {
                                     callSpan.setAttribute("mcp.output.original_bytes", normalized.originalBytes);
                                 }
-                                return normalized.result;
+                                resultForPreview = normalized.result;
+                                resultForReturn = normalized.result;
                             }
                             catch (normErr) {
                                 mcpLogger.warn(`[ToolDiscoveryService] McpOutputNormalizer failed for ` +
@@ -405,7 +495,13 @@ export class ToolDiscoveryService extends EventEmitter {
                             }
                         }
                         // ── end normalization ─────────────────────────────────────────
-                        return callResult;
+                        // Curator P1-4: build gen_ai.response AFTER normalization so
+                        // large payloads use the compact surrogate instead of the raw
+                        // result (avoids redundant stringify + memory hit on payloads
+                        // that were specifically externalized to Redis). Redact via the
+                        // same secret-stripping path used for request parameters.
+                        callSpan.setAttribute("gen_ai.response", safeJsonStringify(redactForPreview(resultForPreview), 2048));
+                        return resultForReturn;
                     }
                     catch (err) {
                         callSpan.setStatus({

package/dist/mcp/toolRegistry.js

@@ -257,6 +257,9 @@ export class MCPToolRegistry extends MCPRegistry {
             attributes: {
                 [ATTR.GEN_AI_TOOL_NAME]: toolName,
                 [ATTR.MCP_SERVER_ID]: preResolvedServerId || "builtin",
+                // Curator P1-3: registry-level wrapper — duplicates ai.toolCall in
+                // Langfuse. Retained for OTel/metrics; skipped for Langfuse export.
+                "langfuse.internal": true,
             },
         }, async (span) => {
             try {

package/dist/neurolink.js

@@ -64,6 +64,7 @@ import { CircuitBreaker, ERROR_CODES, ErrorFactory, isAbortError, isRetriableErr
 // Factory processing imports
 import { createCleanStreamOptions, enhanceTextGenerationOptions, processFactoryOptions, processStreamingFactoryOptions, validateFactoryConfig, } from "./utils/factoryProcessing.js";
 import { logger, mcpLogger } from "./utils/logger.js";
+import { extractMcpErrorText } from "./utils/mcpErrorText.js";
 import { createCustomToolServerInfo, detectCategory, } from "./utils/mcpDefaults.js";
 import { resolveModel } from "./utils/modelAliasResolver.js";
 // Import orchestration components
@@ -133,29 +134,6 @@ function mcpCategoryToErrorCategory(mcpCategory) {
             return ErrorCategory.EXECUTION;
     }
 }
-/**
- * Extract a human-readable error string from an MCP isError result object.
- * Returns an empty string if nothing useful can be extracted.
- */
-function extractMcpErrorText(raw) {
-    try {
-        const resultObj = typeof raw === "string" ? JSON.parse(raw) : raw;
-        if (!resultObj || typeof resultObj !== "object") {
-            return "";
-        }
-        const content = resultObj.content;
-        if (!Array.isArray(content)) {
-            return "";
-        }
-        const texts = content
-            .filter((c) => c.type === "text" && c.text)
-            .map((c) => c.text);
-        return texts.join(" ").substring(0, 500);
-    }
-    catch {
-        return "";
-    }
-}
 /**
  * Check if an error is a non-retryable provider error that should immediately
  * stop the retry/fallback chain. These errors represent permanent failures
@@ -6267,6 +6245,13 @@ Current user's request: ${currentInput}`;
                 "tool.type": executionContext.toolType,
                 "tool.input_size": executionContext.inputSize,
                 "tool.input_preview": executionContext.truncatedInput,
+                // NOT marked langfuse.internal: this is the public entrypoint for
+                // `NeuroLink.executeTool()`. Direct API callers (not going through
+                // the AI SDK) would otherwise produce zero Langfuse observations —
+                // the lower-level registry/discovery spans are internal wrappers.
+                // AI-SDK-initiated custom tools will produce both ai.toolCall and
+                // this span, which is the accepted tradeoff for keeping direct
+                // invocations observable.
             },
         }, (toolSpan) => this.executeToolWithSpan(toolName, params, options, executionContext, toolSpan));
     }

package/dist/services/server/ai/observability/instrumentation.d.ts

@@ -11,6 +11,32 @@ import { LoggerProvider } from "@opentelemetry/sdk-logs";
 import { type SpanProcessor } from "@opentelemetry/sdk-trace-base";
 import { NodeTracerProvider } from "@opentelemetry/sdk-trace-node";
 import type { LangfuseConfig, LangfuseContext } from "../../../../types/index.js";
+/**
+ * True when a span is an internal NeuroLink wrapper that should NOT be sent to
+ * Langfuse. Internal wrappers carry the `langfuse.internal: true` attribute.
+ *
+ * Exposed so host apps that bring their own `LangfuseSpanProcessor` (e.g.
+ * `skipLangfuseSpanProcessor: true`, or manual registration on an existing
+ * TracerProvider) can apply the same filter and avoid duplicate observations.
+ */
+export declare function isLangfuseInternalSpan(span: {
+    attributes?: Record<string, unknown>;
+}): boolean;
+/**
+ * Drop-in `shouldExportSpan` predicate for a `LangfuseSpanProcessor` that
+ * filters out NeuroLink internal wrapper spans.
+ *
+ * Usage in host apps:
+ * ```ts
+ * import { langfuseShouldExportSpan } from "@juspay/neurolink";
+ * new LangfuseSpanProcessor({ ..., shouldExportSpan: langfuseShouldExportSpan });
+ * ```
+ */
+export declare function langfuseShouldExportSpan({ otelSpan, }: {
+    otelSpan: {
+        attributes?: Record<string, unknown>;
+    };
+}): boolean;
 /**
  * Initialize OpenTelemetry with Langfuse span processor
  *

package/dist/services/server/ai/observability/instrumentation.js

@@ -18,6 +18,7 @@ import { BatchSpanProcessor, } from "@opentelemetry/sdk-trace-base";
 import { NodeTracerProvider } from "@opentelemetry/sdk-trace-node";
 import { ATTR_SERVICE_NAME, ATTR_SERVICE_VERSION, } from "@opentelemetry/semantic-conventions";
 import { AsyncLocalStorage } from "async_hooks";
+import { extractMcpErrorText } from "../../../../utils/mcpErrorText.js";
 import { logger } from "../../../../utils/logger.js";
 const LOG_PREFIX = "[OpenTelemetry]";
 function createOtelResource(config, serviceName) {
@@ -131,6 +132,64 @@ function _hasExternalTracerProvider() {
         return false;
     }
 }
+/**
+ * Parse `ai.toolCall.result` on a Vercel AI SDK tool span and surface any
+ * embedded MCP `{ isError: true }` as a Langfuse ERROR + status message.
+ */
+function applyToolCallIsErrorStatus(attrs) {
+    const resultAttr = attrs["ai.toolCall.result"];
+    if (typeof resultAttr !== "string" || resultAttr.length === 0) {
+        return;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(resultAttr);
+    }
+    catch {
+        return;
+    }
+    if (!parsed ||
+        typeof parsed !== "object" ||
+        parsed.isError !== true) {
+        return;
+    }
+    attrs["langfuse.level"] = "ERROR";
+    // Always set a status_message, even when the MCP payload has non-text or
+    // empty content. Without a fallback the Curator P0-1 gap reappears for
+    // those failures (level=ERROR but statusMessage=null).
+    const errorText = extractMcpErrorText(parsed);
+    const toolName = typeof attrs["ai.toolCall.name"] === "string"
+        ? attrs["ai.toolCall.name"]
+        : "tool";
+    attrs["langfuse.status_message"] =
+        errorText || `MCP ${toolName} returned isError=true`;
+}
+/**
+ * Map non-ERROR span conditions (content-filter, length, client abort, SDK
+ * timeout, empty output) onto Langfuse WARNING/ERROR levels. Mutates `attrs`.
+ */
+function applyNonErrorLangfuseLevel(attrs) {
+    const finishReason = attrs["ai.finishReason"] ?? attrs["gen_ai.response.finish_reasons"];
+    const reasonStr = Array.isArray(finishReason)
+        ? finishReason.join(",")
+        : String(finishReason ?? "");
+    if (reasonStr.includes("content-filter") || reasonStr === "length") {
+        attrs["langfuse.level"] = "WARNING";
+        attrs["langfuse.status_message"] =
+            `Generation stopped: finishReason=${reasonStr}`;
+        return;
+    }
+    if (attrs["neurolink.no_output"] === true) {
+        attrs["langfuse.level"] = "WARNING";
+        attrs["langfuse.status_message"] =
+            "Stream produced no output (NoOutputGeneratedError)";
+        return;
+    }
+    if (reasonStr === "aborted") {
+        attrs["langfuse.level"] = "WARNING";
+        attrs["langfuse.status_message"] = "Generation aborted by client";
+    }
+}
 /**
  * Span processor that enriches spans with user and session context from AsyncLocalStorage
  * Also extracts GenAI semantic convention attributes for Langfuse integration
@@ -459,26 +518,23 @@ class ContextEnricher {
             const readableStatus = span.status;
             try {
                 const mutableAttrs = span.attributes;
+                // Curator P0-1/P0-2: detect MCP isError pattern on AI SDK tool call spans.
+                // The AI SDK's `ai.toolCall` span stays status=UNSET when the tool
+                // *returns* { isError:true } (no exception thrown), so Langfuse sees
+                // level=DEFAULT and no status message. Parse the stringified result
+                // and surface the embedded error text.
+                if (readableSpan.name === "ai.toolCall" &&
+                    readableStatus?.code !== SpanStatusCode.ERROR) {
+                    applyToolCallIsErrorStatus(mutableAttrs);
+                }
                 if (readableStatus?.code === SpanStatusCode.ERROR) {
                     mutableAttrs["langfuse.level"] = "ERROR";
                     if (readableStatus.message) {
                         mutableAttrs["langfuse.status_message"] = readableStatus.message;
                     }
                 }
-                else {
-                    // P8 extended: Detect WARNING-level conditions on non-ERROR spans.
-                    // The AI SDK sets ai.finishReason on its spans; content-filter and
-                    // length finish reasons indicate partial failures that deserve WARNING.
-                    const finishReason = mutableAttrs["ai.finishReason"] ??
-                        mutableAttrs["gen_ai.response.finish_reasons"];
-                    const reasonStr = Array.isArray(finishReason)
-                        ? finishReason.join(",")
-                        : String(finishReason ?? "");
-                    if (reasonStr.includes("content-filter") || reasonStr === "length") {
-                        mutableAttrs["langfuse.level"] = "WARNING";
-                        mutableAttrs["langfuse.status_message"] =
-                            `Generation stopped: finishReason=${reasonStr}`;
-                    }
+                else if (mutableAttrs["langfuse.level"] === undefined) {
+                    applyNonErrorLangfuseLevel(mutableAttrs);
                 }
             }
             catch {
@@ -520,9 +576,36 @@ async function createLangfuseProcessor(config) {
         baseUrl: config.baseUrl || "https://cloud.langfuse.com",
         environment: config.environment || "dev",
         release: config.release || "v1.0.0",
-        shouldExportSpan: () => true,
+        // Curator P1-3: skip internal wrapper spans that duplicate ai.toolCall /
+        // ai.generateText observations in Langfuse. Wrappers still emit OTel spans
+        // for internal metrics; they just aren't forwarded to Langfuse.
+        shouldExportSpan: langfuseShouldExportSpan,
     });
 }
+/**
+ * True when a span is an internal NeuroLink wrapper that should NOT be sent to
+ * Langfuse. Internal wrappers carry the `langfuse.internal: true` attribute.
+ *
+ * Exposed so host apps that bring their own `LangfuseSpanProcessor` (e.g.
+ * `skipLangfuseSpanProcessor: true`, or manual registration on an existing
+ * TracerProvider) can apply the same filter and avoid duplicate observations.
+ */
+export function isLangfuseInternalSpan(span) {
+    return span.attributes?.["langfuse.internal"] === true;
+}
+/**
+ * Drop-in `shouldExportSpan` predicate for a `LangfuseSpanProcessor` that
+ * filters out NeuroLink internal wrapper spans.
+ *
+ * Usage in host apps:
+ * ```ts
+ * import { langfuseShouldExportSpan } from "@juspay/neurolink";
+ * new LangfuseSpanProcessor({ ..., shouldExportSpan: langfuseShouldExportSpan });
+ * ```
+ */
+export function langfuseShouldExportSpan({ otelSpan, }) {
+    return !isLangfuseInternalSpan(otelSpan);
+}
 async function initializeExternalOpenTelemetryMode(config, resource, otlpEndpoint, serviceName, langfuseRequested, hasLangfuseCreds) {
     if (langfuseRequested && !hasLangfuseCreds) {
         if (!otlpEndpoint) {

package/dist/utils/mcpErrorText.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Extract a human-readable error string from an MCP isError result object.
+ *
+ * Shared utility — no side effects, no dependencies on other SDK modules —
+ * so it can be imported from the neurolink.ts event loop, the telemetry
+ * instrumentation (which loads earlier), and the MCP discovery layer without
+ * creating circular imports. Any change to truncation or content-type parsing
+ * must happen here and propagate to all three surfaces.
+ */
+export declare function extractMcpErrorText(raw: unknown): string;

package/dist/utils/mcpErrorText.js

@@ -0,0 +1,35 @@
+/**
+ * Extract a human-readable error string from an MCP isError result object.
+ *
+ * Shared utility — no side effects, no dependencies on other SDK modules —
+ * so it can be imported from the neurolink.ts event loop, the telemetry
+ * instrumentation (which loads earlier), and the MCP discovery layer without
+ * creating circular imports. Any change to truncation or content-type parsing
+ * must happen here and propagate to all three surfaces.
+ */
+export function extractMcpErrorText(raw) {
+    let resultObj;
+    try {
+        resultObj = typeof raw === "string" ? JSON.parse(raw) : raw;
+    }
+    catch {
+        return "";
+    }
+    if (!resultObj || typeof resultObj !== "object") {
+        return "";
+    }
+    const content = resultObj.content;
+    if (!Array.isArray(content)) {
+        return "";
+    }
+    // Fail closed on malformed entries (e.g. `content: [null]`) rather than
+    // throwing — the caller expects an empty string for unparseable input.
+    const texts = content
+        .filter((c) => c !== null &&
+        typeof c === "object" &&
+        c.type === "text" &&
+        typeof c.text === "string" &&
+        c.text.length > 0)
+        .map((c) => c.text);
+    return texts.join(" ").substring(0, 500);
+}

package/dist/utils/timeout.js

@@ -313,6 +313,12 @@ export function createTimeoutController(timeout, provider, operation) {
     }
     const controller = new AbortController();
     const timer = setTimeout(() => {
+        // NOTE: we cannot stamp the AI SDK's ai.streamText/ai.generateText span
+        // from here — the setTimeout callback runs in the async context captured
+        // at schedule time, which is BEFORE the AI SDK span exists. Instead we
+        // rely on the AI SDK propagating the TimeoutError through its recordSpan
+        // wrapper, which sets span.status = ERROR + message. ContextEnricher's
+        // SpanStatusCode.ERROR branch then surfaces level=ERROR + status_message.
         controller.abort(new TimeoutError(`${provider} ${operation} operation timed out after ${timeout}`, timeoutMs, provider, operation));
     }, timeoutMs);
     const cleanup = () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@juspay/neurolink",
-  "version": "9.55.10",
+  "version": "9.55.11",
   "packageManager": "pnpm@10.15.1",
   "description": "Universal AI Development Platform with working MCP integration, multi-provider support, and professional CLI. Built-in tools operational, 58+ external MCP servers discoverable. Connect to filesystem, GitHub, database operations, and more. Build, test, and deploy AI applications with 13 providers: OpenAI, Anthropic, Google AI, AWS Bedrock, Azure, Hugging Face, Ollama, and Mistral AI.",
   "author": {