@warlock.js/ai 4.14.0 → 4.16.0

package/esm/supervisor/execution.mjs

@@ -11,8 +11,9 @@ import "../utils/index.mjs";
 import { runPipeline } from "../middleware/pipeline.mjs";
 import { END } from "../contracts/end.type.mjs";
 import { isAgentResult, isWorkflowResult } from "./entries.mjs";
+import { assignSafeKey, isUnsafeMergeKey, mergeSafely } from "../security/safe-merge.mjs";
 import { createCancelledError } from "./cancellation.mjs";
-import { decide } from "./decide.mjs";
+import { capFanOut, decide, resolveMaxFanOut } from "./decide.mjs";
 import { persistSupervisorSnapshot } from "./snapshot.mjs";
 import { log } from "@warlock.js/logger";
 
@@ -432,9 +433,17 @@ var SupervisorExecution = class {
 	* branch errors don't abort siblings — they're recorded on the
 	* branch snapshot and let evaluate (or default termination logic)
 	* decide the response.
+	*
+	* `capFanOut` runs here as well as in `decide.ts` — this is the one
+	* chokepoint every dispatch source funnels through (router/route
+	* decisions, `evaluate.reassignTo`, classifier picks, per-intent
+	* `next` unions), so the width bound holds even for the paths that
+	* build a `DispatchDecision` without going through `normalize()`.
+	* Idempotent for already-normalized decisions.
 	*/
 	async dispatchBranches(decision) {
-		return await Promise.all(decision.intents.map((intent) => this.dispatchOne(intent)));
+		const intents = capFanOut(decision.intents, this.entries, resolveMaxFanOut(this.config));
+		return await Promise.all(intents.map((intent) => this.dispatchOne(intent)));
 	}
 	/**
 	* Execute a single branch — resolve the input, invoke the
@@ -819,24 +828,10 @@ var SupervisorExecution = class {
 	* through unchanged so structured inputs work.
 	*/
 	coerceInlineInput(executable, input) {
-		if (!("signature" in executable) && typeof executable.execute === "function" && !this.isSupervisor(executable) && typeof input !== "string") return safeStringify(input);
+		if ("isAnonymous" in executable && typeof input !== "string") return safeStringify(input);
 		return input;
 	}
 	/**
-	* Heuristic detection of `SupervisorContract` — the contract carries
-	* a `signature` getter same as workflows, but supervisors expose
-	* `resume()` while workflows expose `resume(runId, options)` too.
-	* Cleanest distinguisher in the public surface: supervisors carry
-	* the `asTool` method name `as` … unfortunately so do workflows.
-	* Use the `streamableType` brand if we add one in v2; for now lean
-	* on a duck-typed check that's good enough for the ctx.run path
-	* (incorrect routing for workflows would still produce a runnable
-	* call — workflow.execute accepts the same args either way).
-	*/
-	isSupervisor(executable) {
-		return typeof executable.resume === "function" && typeof executable.signature === "string" && typeof executable.stream === "function";
-	}
-	/**
 	* Invoke the underlying dispatchable unit. Agents and workflows
 	* both satisfy `ExecutableContract<string, …>` so the call shape
 	* is uniform; the `type` discriminator picks which options get
@@ -1134,7 +1129,31 @@ var SupervisorExecution = class {
 		if (ackOutcome.error || !ackOutcome.output) return;
 		if (typeof ackOutcome.output !== "object" || ackOutcome.output === null) return;
 		const slice = ackOutcome.output;
-		for (const [key, value] of Object.entries(slice)) this.state[key] = value;
+		this.mergeIntoState(slice, "ack");
+	}
+	/**
+	* Single funnel for "shallow-merge a model-influenced slice into
+	* `this.state`". Wraps the shared {@link mergeSafely} guard so no
+	* merge site can assign `__proto__` / `constructor` / `prototype`
+	* onto the run's state object, and logs when something tried.
+	*
+	* Every slice reaching state is model- or tool-influenced (agent
+	* outputs validated against a DEVELOPER-supplied schema, which may
+	* legitimately be permissive: `z.record()`, `.passthrough()`,
+	* `z.any()`), so the key names are untrusted input even when the
+	* values are shaped.
+	*/
+	mergeIntoState(slice, origin) {
+		const skipped = mergeSafely(this.state, slice);
+		this.warnOnUnsafeKeys(skipped, origin);
+	}
+	/** Shared logging for refused prototype-tampering keys. */
+	warnOnUnsafeKeys(skipped, origin) {
+		if (skipped.length === 0) return;
+		this.logger.warn(this.logModule, "state.merge.unsafe-key", `dropped prototype-tampering key(s) from "${origin}" merge: ${skipped.join(", ")}`, {
+			origin,
+			keys: skipped
+		});
 	}
 	/**
 	* Run the iter-0 classifier prelude (Phase 7 / decisions §37).
@@ -1258,9 +1277,9 @@ var SupervisorExecution = class {
 			refined = interpretation.refined;
 			halted = interpretation.halted;
 			final = interpretation.final ?? raw;
-			if (interpretation.sliceToMerge) for (const [key, value] of Object.entries(interpretation.sliceToMerge)) this.state[key] = value;
+			if (interpretation.sliceToMerge) this.mergeIntoState(interpretation.sliceToMerge, "classifier.refine");
 		}
-		for (const [key, value] of Object.entries(final)) this.state[key] = value;
+		this.mergeIntoState(final, "classifier");
 		this.classifierSnapshot = {
 			intent: halted ? void 0 : final.intent,
 			reasoning: final.reasoning,
@@ -1457,7 +1476,7 @@ var SupervisorExecution = class {
 		const slice = {};
 		for (const [key, value] of Object.entries(record)) {
 			if (key === "intent") continue;
-			slice[key] = value;
+			assignSafeKey(slice, key, value);
 		}
 		const final = {
 			...raw,
@@ -1533,6 +1552,10 @@ var SupervisorExecution = class {
 				continue;
 			}
 			for (const [key, value] of Object.entries(slice)) {
+				if (isUnsafeMergeKey(key)) {
+					this.warnOnUnsafeKeys([key], `intent "${intent}"`);
+					continue;
+				}
 				const previousOwner = mergedKeys.get(key);
 				if (previousOwner !== void 0 && previousOwner !== intent) this.logger.warn(this.logModule, "state.merge.conflict", `state key "${key}" written by both "${previousOwner}" and "${intent}" — last-in-decision-array wins (Q15)`, {
 					key,
@@ -1584,9 +1607,9 @@ var SupervisorExecution = class {
 		const finalize = this.config.finalizeArtifacts;
 		if (finalize) {
 			const merged = finalize(this.state, artifacts);
-			for (const key of Object.keys(this.state)) if (!(key in merged)) delete this.state[key];
-			for (const [key, value] of Object.entries(merged)) this.state[key] = value;
-		} else for (const [key, value] of Object.entries(artifacts)) this.state[key] = value;
+			for (const key of Object.keys(this.state)) if (!Object.hasOwn(merged, key)) delete this.state[key];
+			this.mergeIntoState(merged, "finalizeArtifacts");
+		} else this.mergeIntoState(artifacts, "artifacts");
 		this.currentArtifacts = {};
 	}
 	/**