@warlock.js/ai 4.14.0 → 4.16.0

package/cjs/index.cjs

@@ -1487,6 +1487,22 @@ function isPrivateIpv6(ip) {
 const DEFAULT_MAX_BYTES = 5 * 1024 * 1024;
 /** 10s — default per-request timeout. */
 const DEFAULT_TIMEOUT_MS = 1e4;
+/** Default cap on the number of policy-validated redirect hops. */
+const DEFAULT_MAX_REDIRECTS = 5;
+/** 3xx statuses whose `Location` a follow re-issues. */
+const REDIRECT_STATUSES = new Set([
+	301,
+	302,
+	303,
+	307,
+	308
+]);
+/** Credential headers that must not survive a cross-origin redirect. */
+const CROSS_ORIGIN_STRIP_HEADERS = [
+	"authorization",
+	"cookie",
+	"proxy-authorization"
+];
 /**
 * Fill an {@link OutboundPolicy} with strict defaults: https-only,
 * private-IP deny on, 10s timeout, 5 MiB cap, global `fetch`. Idempotent
@@ -1499,6 +1515,7 @@ function resolveOutboundPolicy(policy = {}) {
 		denyPrivateIPsAfterDNS: policy.denyPrivateIPsAfterDNS ?? true,
 		maxBytes: policy.maxBytes ?? DEFAULT_MAX_BYTES,
 		timeoutMs: policy.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+		maxRedirects: policy.maxRedirects ?? DEFAULT_MAX_REDIRECTS,
 		signal: policy.signal,
 		fetch: policy.fetch ?? globalThis.fetch
 	};
@@ -1585,16 +1602,33 @@ function mergeSignals(timeout, external) {
 	else external.addEventListener("abort", () => abort(external), { once: true });
 	return controller.signal;
 }
+/** Flatten a headers init into a mutable lower-cased-key record. */
+function headersToRecord(headersInit) {
+	const record = {};
+	new Headers(headersInit).forEach((value, key) => {
+		record[key] = value;
+	});
+	return record;
+}
 /**
 * Policy-guarded `fetch`: validates the URL ({@link assertUrlAllowed}),
 * then performs the request with the policy's timeout and (optional)
 * caller signal merged. Returns the raw `Response` — read its body via
 * {@link readTextCapped} to enforce `maxBytes`. Throws
 * {@link OutboundPolicyError} on a policy violation or timeout.
+*
+* Redirects are NEVER delegated to the platform: every hop is issued
+* with `redirect: "manual"` and its `Location` is re-run through
+* {@link assertUrlAllowed} before being followed (capped at
+* `maxRedirects`), so a 3xx from an allowed host cannot smuggle the
+* request to a private / metadata / off-allowlist target. Credential
+* headers are stripped when a hop crosses an origin boundary. Pass
+* `init.redirect: "manual"` to receive the raw 3xx, or `"error"` to
+* reject on any redirect.
 */
 async function guardedFetch(rawUrl, policyInput, init) {
 	const policy = resolveOutboundPolicy(policyInput);
-	const url = await assertUrlAllowed(rawUrl, policy);
+	let url = await assertUrlAllowed(rawUrl, policy);
 	const timeoutController = new AbortController();
 	const timer = setTimeout(() => {
 		timeoutController.abort(new OutboundPolicyError(`outbound request timed out after ${policy.timeoutMs}ms`, { context: {
@@ -1602,11 +1636,51 @@ async function guardedFetch(rawUrl, policyInput, init) {
 			timeoutMs: policy.timeoutMs
 		} }));
 	}, policy.timeoutMs);
+	const signal = mergeSignals(timeoutController.signal, policy.signal);
+	const redirectMode = init?.redirect ?? "follow";
+	const headers = headersToRecord(init?.headers);
+	let method = init?.method ?? "GET";
+	let body = init?.body ?? void 0;
 	try {
-		return await policy.fetch(url, {
-			...init,
-			signal: mergeSignals(timeoutController.signal, policy.signal)
-		});
+		for (let hop = 0;; hop++) {
+			const response = await policy.fetch(url, {
+				...init,
+				method,
+				headers: { ...headers },
+				body,
+				redirect: "manual",
+				signal
+			});
+			const location = response.headers.get("location");
+			if (!REDIRECT_STATUSES.has(response.status) || location === null) return response;
+			if (redirectMode === "manual") return response;
+			if (redirectMode === "error") throw new OutboundPolicyError(`outbound request blocked — redirect received with redirect: "error" (${response.status} → ${location})`, { context: {
+				url: url.toString(),
+				location,
+				status: response.status
+			} });
+			if (hop >= policy.maxRedirects) throw new OutboundPolicyError(`outbound request blocked — more than ${policy.maxRedirects} redirects`, { context: {
+				url: rawUrl,
+				maxRedirects: policy.maxRedirects
+			} });
+			let target;
+			try {
+				target = new URL(location, url);
+			} catch {
+				throw new OutboundPolicyError(`outbound request blocked — invalid redirect Location: ${location}`, { context: {
+					url: url.toString(),
+					location
+				} });
+			}
+			const next = await assertUrlAllowed(target.toString(), policy);
+			if (response.body) await response.body.cancel().catch(() => void 0);
+			if (next.origin !== url.origin) for (const name of CROSS_ORIGIN_STRIP_HEADERS) delete headers[name];
+			if (response.status === 303 || (response.status === 301 || response.status === 302) && method !== "GET" && method !== "HEAD") {
+				method = "GET";
+				body = void 0;
+			}
+			url = next;
+		}
 	} finally {
 		clearTimeout(timer);
 	}
@@ -2872,6 +2946,13 @@ function resolveDefaultSnapshotStore() {
 //#region ../ai/src/middleware/builtins/semantic-cache.ts
 const DEFAULT_NAMESPACE = "ai.cache";
 /**
+* Extra candidates pulled from `similar()` on a SCOPED lookup before the
+* scope filter runs. The driver ranks across every scope in the index,
+* so a bare `topK: 1` can come back as a foreign entry and mask this
+* scope's own legitimate hit. Mirrors the memory tiers' overscan.
+*/
+const SIMILAR_OVERSCAN = 5;
+/**
 * Build a stable fingerprint for a prompt covering the full message
 * list (system + history + user turn). Ensures two prompts sharing
 * the user text but differing in prior context do not collide on
@@ -2883,9 +2964,12 @@ const DEFAULT_NAMESPACE = "ai.cache";
 * trust model.
 */
 function hashPrompt(messages) {
-	const serialized = messages.map((message) => {
+	return fnv1a(messages.map((message) => {
 		return `${message.role}:${Array.isArray(message.content) ? message.content.filter((part) => part.type === "text").map((part) => part.text).join("|") : message.content}`;
-	}).join("||");
+	}).join("||"));
+}
+/** FNV-1a over a string — see {@link hashPrompt} for the caveats. */
+function fnv1a(serialized) {
 	let hash = 2166136261;
 	for (let index = 0; index < serialized.length; index++) {
 		hash ^= serialized.charCodeAt(index);
@@ -2893,6 +2977,28 @@ function hashPrompt(messages) {
 	}
 	return (hash >>> 0).toString(16);
 }
+/**
+* Resolve the isolation key this trip reads and writes under.
+*
+* Derived from the run's own `sessionId` (or the developer's resolver) —
+* never from the prompt, the model's output, or anything the LLM can
+* write to. `"shared"` and an unidentified run both resolve to
+* `undefined`, i.e. the unscoped pool, which a scoped lookup can never
+* read.
+*/
+function resolveScope(scope, context) {
+	if (scope === "shared") return;
+	const key = typeof scope === "function" ? scope(context) : sessionScope(context.options?.sessionId);
+	return key ? key : void 0;
+}
+/**
+* The default `"session"` key: the session id under a reserved prefix so
+* a custom resolver returning a bare tenant id can't collide with a
+* session pool. Mirrors the orchestrator's `sessionMemoryScope`.
+*/
+function sessionScope(sessionId) {
+	return sessionId ? `session:${sessionId}` : void 0;
+}
 function isFresh(entry, ttlMs) {
 	if (ttlMs === void 0) return true;
 	return Date.now() - entry.storedAt <= ttlMs;
@@ -2936,6 +3042,18 @@ function isFresh(entry, ttlMs) {
 * `usage: { input: 0, output: 0, total: 0 }` so budget /
 * observability correctly exclude the saved trip.
 *
+* **Per-session scoping (4.15.0).** One `semanticCache` instance
+* normally serves every end user, and a hit is returned as the answer
+* with no model call in between — so entries are keyed by the run's
+* `sessionId` (`scope`, default `"session"`) and a lookup only ever
+* sees entries written under the same key. Runs made without a
+* `sessionId` share one unscoped pool; pass `sessionId` on
+* `agent.execute()` (composites thread their own through automatically)
+* to get the isolation, or set `scope: "shared"` to pool deliberately.
+* Note the cost/benefit shift: scoping trades cross-user hit rate for
+* isolation, so public-FAQ deployments where no response can carry a
+* caller's private context should opt into `"shared"` explicitly.
+*
 * @example
 * import { semanticCache } from "@warlock.js/ai";
 * import { MemoryCacheDriver } from "@warlock.js/cache";
@@ -2955,10 +3073,11 @@ function isFresh(entry, ttlMs) {
 function semanticCache(options) {
 	const name = options.name ?? "semantic-cache";
 	const namespace = options.namespace ?? DEFAULT_NAMESPACE;
+	const scopeMode = options.scope ?? "session";
 	const pendingKey = `${name}.pending`;
 	const store = options.store ?? resolveDefaultStore();
 	if (!store) throw new Error(`semanticCache: no store supplied — pass \`store\` in options or call \`ai.config({ defaultStore })\` at app boot before constructing the middleware`);
-	const keyFor = (hash) => `${namespace}.${hash}`;
+	const keyFor = (hash, scope) => scope === void 0 ? `${namespace}.${hash}` : `${namespace}.${fnv1a(scope)}.${hash}`;
 	return {
 		name,
 		log: true,
@@ -2967,21 +3086,20 @@ function semanticCache(options) {
 				if (context.tripIndex !== 0) return;
 				const promptText = extractUserText(context.messages);
 				if (!promptText) return;
+				const scope = resolveScope(scopeMode, context);
 				const promptKey = hashPrompt(context.messages);
-				const scopedKey = keyFor(promptKey);
-				const exact = await store.get(scopedKey);
-				if (exact && isFresh(exact, options.ttlMs)) return toSyntheticResponse(exact.response);
+				const exact = await store.get(keyFor(promptKey, scope));
+				if (exact && exact.scope === scope && isFresh(exact, options.ttlMs)) return toSyntheticResponse(exact.response);
 				const query = await options.embedder.embed(promptText);
-				const [hit] = await store.similar(query.vector, {
-					topK: 1,
+				const hit = (await store.similar(query.vector, {
+					topK: scope === void 0 ? 1 : SIMILAR_OVERSCAN,
 					threshold: options.threshold
-				});
-				if (hit && isFresh(hit.value, options.ttlMs)) {
-					if (hit.key.startsWith(`${namespace}.`)) return toSyntheticResponse(hit.value.response);
-				}
+				})).find((candidate) => candidate.key.startsWith(`${namespace}.`) && candidate.value?.scope === scope && isFresh(candidate.value, options.ttlMs));
+				if (hit) return toSyntheticResponse(hit.value.response);
 				const pending = {
 					promptKey,
-					vector: query.vector
+					vector: query.vector,
+					scope
 				};
 				context.state.set(pendingKey, pending);
 			},
@@ -2992,9 +3110,10 @@ function semanticCache(options) {
 				context.state.delete(pendingKey);
 				const entry = {
 					response,
-					storedAt: Date.now()
+					storedAt: Date.now(),
+					scope: pending.scope
 				};
-				await store.set(keyFor(pending.promptKey), entry, { vector: pending.vector });
+				await store.set(keyFor(pending.promptKey, pending.scope), entry, { vector: pending.vector });
 			}
 		}
 	};
@@ -4318,7 +4437,7 @@ function deriveMemoryId(text) {
 * the raw top-`k` by similarity alone would miss it — overscan, then
 * re-rank.
 */
-const RECALL_OVERSCAN$1 = 5;
+const RECALL_OVERSCAN$2 = 5;
 /**
 * Episodic recall tier (memory core M2).
 *
@@ -4359,9 +4478,10 @@ var EpisodicMemory = class {
 			id,
 			text: item.text,
 			ts: this.now(),
+			scope: item.scope,
 			metadata: item.metadata
 		};
-		await this.store.set(this.keyFor(id), value, { vector });
+		await this.store.set(this.keyFor(id, item.scope), value, { vector });
 	}
 	/**
 	* Embed `query`, pull the nearest episodes clearing the similarity
@@ -4369,16 +4489,21 @@ var EpisodicMemory = class {
 	* returning the top `k`. The similarity floor still gates relevance —
 	* recency only reorders episodes that already cleared it, it never
 	* surfaces an irrelevant-but-recent one.
+	*
+	* Episodes written under a different `scope` (another tenant /
+	* session) are dropped here, before scoring and slicing, so they can
+	* neither leak nor consume a slot. An unscoped recall reads only
+	* unscoped episodes.
 	*/
-	async recall(query, k, threshold) {
+	async recall(query, k, threshold, scope) {
 		const { vector } = await this.embedder.embed(query);
 		const hits = await this.store.similar(vector, {
-			topK: Math.max(k * RECALL_OVERSCAN$1, k),
+			topK: Math.max(k * RECALL_OVERSCAN$2, k),
 			threshold
 		});
 		const prefix = `${this.namespace}.`;
 		const now = this.now();
-		return hits.filter((hit) => hit.key.startsWith(prefix)).map((hit) => ({
+		return hits.filter((hit) => hit.key.startsWith(prefix) && hit.value?.scope === scope).map((hit) => ({
 			id: hit.value.id,
 			text: hit.value.text,
 			tier: "episodic",
@@ -4404,10 +4529,12 @@ var EpisodicMemory = class {
 	/**
 	* Namespaced key for an entry. Mirrors the semantic tier's dot
 	* separator so the prefix used here matches the `hit.key` the driver
-	* returns from `similar()`.
+	* returns from `similar()`, and its hashed scope segment so two
+	* scopes never overwrite one another's identical text. Unscoped keys
+	* keep their pre-4.15.0 shape.
 	*/
-	keyFor(id) {
-		return `${this.namespace}.${id}`;
+	keyFor(id, scope) {
+		return scope === void 0 ? `${this.namespace}.${id}` : `${this.namespace}.${deriveMemoryId(scope)}.${id}`;
 	}
 };
 
@@ -4419,7 +4546,7 @@ var EpisodicMemory = class {
 * promote a well-worn procedure past a slightly-closer one-off, which the
 * raw top-`k` by similarity would miss.
 */
-const RECALL_OVERSCAN = 5;
+const RECALL_OVERSCAN$1 = 5;
 /**
 * Procedural recall tier (memory core M2).
 *
@@ -4458,30 +4585,37 @@ var ProceduralMemory = class {
 	async remember(item) {
 		const id = item.id ?? deriveMemoryId(item.text);
 		const { vector } = await this.embedder.embed(item.text);
-		const existing = await this.store.get(this.keyFor(id));
+		const key = this.keyFor(id, item.scope);
+		const existing = await this.store.get(key);
 		const uses = (existing?.uses ?? 0) + 1;
 		const value = {
 			id,
 			text: item.text,
 			uses,
+			scope: item.scope,
 			metadata: item.metadata ?? existing?.metadata
 		};
-		await this.store.set(this.keyFor(id), value, { vector });
+		await this.store.set(key, value, { vector });
 	}
 	/**
 	* Embed `query`, pull the nearest procedures clearing the similarity
 	* `threshold`, then re-rank each by a reinforcement-blended score and
 	* return the top `k`. The similarity floor still gates relevance;
 	* reinforcement only reorders procedures that already cleared it.
+	*
+	* Procedures written under a different `scope` (another tenant /
+	* session) are dropped here, before scoring and slicing, so they can
+	* neither leak nor consume a slot. An unscoped recall reads only
+	* unscoped procedures.
 	*/
-	async recall(query, k, threshold) {
+	async recall(query, k, threshold, scope) {
 		const { vector } = await this.embedder.embed(query);
 		const hits = await this.store.similar(vector, {
-			topK: Math.max(k * RECALL_OVERSCAN, k),
+			topK: Math.max(k * RECALL_OVERSCAN$1, k),
 			threshold
 		});
 		const prefix = `${this.namespace}.`;
-		return hits.filter((hit) => hit.key.startsWith(prefix)).map((hit) => ({
+		return hits.filter((hit) => hit.key.startsWith(prefix) && hit.value?.scope === scope).map((hit) => ({
 			id: hit.value.id,
 			text: hit.value.text,
 			tier: "procedural",
@@ -4504,15 +4638,28 @@ var ProceduralMemory = class {
 		const reinforcement = uses / (uses + 1);
 		return (1 - this.reinforcementWeight) * similarity + this.reinforcementWeight * reinforcement;
 	}
-	/** Namespaced key for an entry — dot separator, matching `similar()` keys. */
-	keyFor(id) {
-		return `${this.namespace}.${id}`;
+	/**
+	* Namespaced key for an entry — dot separator, matching `similar()`
+	* keys, plus a hashed scope segment so reinforcement counters never
+	* cross a scope boundary (one tenant re-affirming a procedure must not
+	* strengthen — or overwrite — another tenant's identical text).
+	* Unscoped keys keep their pre-4.15.0 shape.
+	*/
+	keyFor(id, scope) {
+		return scope === void 0 ? `${this.namespace}.${id}` : `${this.namespace}.${deriveMemoryId(scope)}.${id}`;
 	}
 };
 
 //#endregion
 //#region ../ai/src/memory/semantic-memory.ts
 /**
+* Extra candidates pulled from `similar()` on a SCOPED recall before the
+* scope filter runs — the driver's ranking spans every scope in the
+* index, so a bare top-`k` can come back entirely foreign. Mirrors the
+* episodic / procedural tiers' overscan constant.
+*/
+const RECALL_OVERSCAN = 5;
+/**
 * Semantic recall tier (memory core M1).
 *
 * Owns: embedding remembered text, writing it to a `@warlock.js/cache`
@@ -4547,30 +4694,33 @@ var SemanticMemory = class {
 		const value = {
 			id,
 			text: item.text,
+			scope: item.scope,
 			metadata: item.metadata
 		};
-		await this.store.set(this.keyFor(id), value, { vector });
+		await this.store.set(this.keyFor(id, item.scope), value, { vector });
 	}
 	/**
 	* Embed `query`, ask the driver for the `k` nearest entries clearing
-	* `threshold`, and return those within this instance's namespace as
-	* scored {@link RecalledMemory}. Hits indexed under a different
-	* namespace (a shared driver) are filtered out.
+	* `threshold`, and return those within this instance's namespace AND
+	* this call's `scope` as scored {@link RecalledMemory}. Hits indexed
+	* under a different namespace (a shared driver) or a different scope
+	* (another tenant / session) are filtered out here, before the caller
+	* ever sees them — an unscoped recall reads only unscoped entries.
 	*/
-	async recall(query, k, threshold) {
+	async recall(query, k, threshold, scope) {
 		const { vector } = await this.embedder.embed(query);
 		const hits = await this.store.similar(vector, {
-			topK: k,
+			topK: scope === void 0 ? k : Math.max(k * RECALL_OVERSCAN, k),
 			threshold
 		});
 		const prefix = `${this.namespace}.`;
-		return hits.filter((hit) => hit.key.startsWith(prefix)).map((hit) => ({
+		return hits.filter((hit) => hit.key.startsWith(prefix) && hit.value?.scope === scope).map((hit) => ({
 			id: hit.value.id,
 			text: hit.value.text,
 			tier: "semantic",
 			score: hit.score,
 			metadata: hit.value.metadata
-		}));
+		})).slice(0, Math.max(0, k));
 	}
 	/** Drop every semantic entry written under this instance's namespace. */
 	async clear() {
@@ -4580,9 +4730,16 @@ var SemanticMemory = class {
 	* Namespaced key for an entry. The cache's `parseKey` normalizes `:`
 	* to `.`, so a dot separator keeps the prefix used here aligned with
 	* the `hit.key` the driver returns from `similar()`.
+	*
+	* A scoped entry gets an extra hashed segment so two scopes writing
+	* identical text (same derived id) don't overwrite each other; the
+	* unscoped key shape is unchanged, so entries written before 4.15.0
+	* still resolve. The hash is a write-separation device only — recall
+	* authorization is the exact `value.scope` equality check, so even a
+	* hash collision cannot widen what a scope can read.
 	*/
-	keyFor(id) {
-		return `${this.namespace}.${id}`;
+	keyFor(id, scope) {
+		return scope === void 0 ? `${this.namespace}.${id}` : `${this.namespace}.${deriveMemoryId(scope)}.${id}`;
 	}
 };
 
@@ -4602,47 +4759,104 @@ var SemanticMemory = class {
 * first, each scored on a `[0, 1]` recency proxy so a caller can merge
 * working hits with semantic hits and sort on one `score` field.
 *
+* **Bounded (4.15.0).** The buffer holds at most `maxItems` entries
+* across every scope; the oldest-written entry is evicted on overflow
+* (FIFO). The tier lives in process memory for the lifetime of the
+* `memory()` instance — which the orchestrator resolves once and reuses
+* for every session — so an unbounded buffer was a memory-exhaustion
+* vector for any long-lived, internet-reachable deployment.
+*
 * Internal to the `memory()` factory — never exported on the package
 * surface.
 */
 var WorkingMemory = class {
-	constructor() {
+	constructor(maxItems) {
 		this.entries = /* @__PURE__ */ new Map();
+		this.maxItems = maxItems;
 	}
 	/**
 	* Append an item to the buffer (or overwrite the entry sharing its
-	* id). Re-inserting an existing id keeps its original position; delete
-	* + set would move it to the end and lie about recency, so the value
-	* is updated in place.
+	* id *within the same scope*). Re-inserting an existing key keeps its
+	* original position; delete + set would move it to the end and lie
+	* about recency, so the value is updated in place.
+	*
+	* Overflowing `maxItems` evicts from the front — see
+	* {@link evictOverflow}.
 	*/
 	remember(item) {
 		const id = item.id ?? deriveMemoryId(item.text);
-		this.entries.set(id, {
+		this.entries.set(scopedKey(item.scope, id), {
+			id,
 			text: item.text,
+			scope: item.scope,
 			metadata: item.metadata
 		});
+		this.evictOverflow();
 	}
 	/**
-	* Return up to `k` most-recently-remembered items, newest first. The
-	* `score` is a linear recency proxy: the newest item scores `1`, the
-	* oldest of the returned slice trends toward `0`. Working memory
+	* Enforce the size bound by dropping oldest-written entries first
+	* (FIFO over the `Map`'s insertion order).
+	*
+	* **Why FIFO, not LRU.** Recall here is a pure recency proxy — it
+	* reverses insertion order and slices the newest `k` — and never
+	* reorders anything, so the front of the buffer is by construction the
+	* region recall reaches last. FIFO therefore evicts exactly the
+	* entries a bounded recall would never have returned. True LRU would
+	* need read-time reordering, which would also rewrite the `score`
+	* every recall reports (a re-read entry would masquerade as freshly
+	* remembered), trading a real correctness property for no gain.
+	*
+	* **Known limitation (documented, not a regression).** The bound is
+	* global, not per-scope: a session writing heavily can push another
+	* session's older entries out of the buffer. That is a recall-quality
+	* degradation on a volatile scratch tier, never a disclosure — the
+	* scope filter in {@link recall} still applies — and a per-scope quota
+	* would not help anyway, since an attacker holding many sessions
+	* evicts through the global bound regardless. Durable recall belongs
+	* in the semantic / episodic tiers.
+	*/
+	evictOverflow() {
+		while (this.entries.size > this.maxItems) {
+			const oldest = this.entries.keys().next();
+			if (oldest.done) return;
+			this.entries.delete(oldest.value);
+		}
+	}
+	/**
+	* Return up to `k` most-recently-remembered items *within `scope`*,
+	* newest first. The scope match is exact equality (an unscoped recall
+	* sees only unscoped entries) and is applied BEFORE the slice, so a
+	* foreign scope's entries can never consume a slot or leak out.
+	*
+	* The `score` is a linear recency proxy: the newest item scores `1`,
+	* the oldest of the returned slice trends toward `0`. Working memory
 	* ignores any similarity threshold — it has no vector to compare.
 	*/
-	recall(k) {
-		const slice = [...this.entries.entries()].reverse().slice(0, Math.max(0, k));
-		return slice.map(([id, entry], index) => ({
-			id,
+	recall(k, scope) {
+		const slice = [...this.entries.values()].reverse().filter((entry) => entry.scope === scope).slice(0, Math.max(0, k));
+		return slice.map((entry, index) => ({
+			id: entry.id,
 			text: entry.text,
 			tier: "working",
 			score: slice.length <= 1 ? 1 : 1 - index / slice.length,
 			metadata: entry.metadata
 		}));
 	}
-	/** Drop every working-tier entry. */
+	/** Drop every working-tier entry, across every scope. */
 	clear() {
 		this.entries.clear();
 	}
 };
+/**
+* Map key for a buffer entry: the isolation `scope` (empty for the
+* unscoped pool) length-prefixed and joined to the logical id. The
+* length prefix makes the encoding injective — no crafted scope/id pair
+* can collide with a different scope's entry the way a plain `:` join
+* would allow.
+*/
+function scopedKey(scope, id) {
+	return `${scope?.length ?? 0}:${scope ?? ""}:${id}`;
+}
 
 //#endregion
 //#region ../ai/src/memory/memory.ts
@@ -4656,6 +4870,14 @@ const DEFAULT_RECENCY_WEIGHT = .3;
 const DEFAULT_HALF_LIFE_MS = 10080 * 60 * 1e3;
 const DEFAULT_REINFORCEMENT_WEIGHT = .3;
 /**
+* Entries the in-process working buffer holds before it starts evicting
+* its oldest (4.15.0 — security fix for unbounded growth). Sized to hold
+* a deep multi-session scratch history while capping the tier's worst
+* case at a few MB of resident text rather than "everything this process
+* has ever been told."
+*/
+const DEFAULT_WORKING_MAX_ITEMS = 1e3;
+/**
 * Create an agent memory store (memory core M2).
 *
 * Wires up to four tiers behind the {@link MemoryContract}: **working**
@@ -4672,7 +4894,19 @@ const DEFAULT_REINFORCEMENT_WEIGHT = .3;
 * no `ai.config({ defaultStore })` throws now; enabling no tier at all
 * throws now.
 *
-* Decay / forgetting (TTL-based falloff, eviction) remains deferred.
+* TTL-based decay / forgetting remains deferred. The working tier is
+* size-bounded (`working: { maxItems }`, default `1000`, oldest-written
+* evicted first) because it is the one tier that holds everything it is
+* told in process memory for the life of the instance; the durable tiers
+* delegate retention to their `CacheDriver`.
+*
+* **Isolation (4.15.0).** `remember({ scope })` / `recall(query, { scope })`
+* carry an opaque tenant / session key that every tier enforces as an
+* exact-equality filter before scoring — one scope's memories never
+* surface in another's recall, and identical text under two scopes stays
+* two entries. Unscoped writes form a shared pool that only an unscoped
+* recall can read; there is no "all scopes" query. `ai.orchestrator()`
+* derives this from the turn's `sessionId` automatically.
 *
 * @example
 * import { ai } from "@warlock.js/ai";
@@ -4691,10 +4925,10 @@ const DEFAULT_REINFORCEMENT_WEIGHT = .3;
 */
 function memory$2(config = {}) {
 	const name = config.name ?? DEFAULT_NAME$3;
-	const workingEnabled = config.working ?? true;
+	const workingConfig = config.working ?? true;
 	const defaultK = config.k ?? DEFAULT_K;
 	const defaultThreshold = config.threshold ?? DEFAULT_THRESHOLD$1;
-	const working = workingEnabled ? new WorkingMemory() : void 0;
+	const working = workingConfig === false ? void 0 : new WorkingMemory(resolveWorkingMaxItems(workingConfig, name));
 	const semantic = config.semantic ? buildSemanticTier(config.semantic, name) : void 0;
 	const episodic = config.episodic ? buildEpisodicTier(config.episodic, name) : void 0;
 	const procedural = config.procedural ? buildProceduralTier(config.procedural, name) : void 0;
@@ -4736,11 +4970,12 @@ function memory$2(config = {}) {
 			const threshold = options.threshold ?? defaultThreshold;
 			if (options.tier) assertTierEnabled(options.tier, tiers, name);
 			const wants = (tier) => !options.tier || options.tier === tier;
+			const scope = options.scope;
 			const [workingHits, semanticHits, episodicHits, proceduralHits] = await Promise.all([
-				working && wants("working") ? Promise.resolve(working.recall(k)) : Promise.resolve([]),
-				semantic && wants("semantic") ? semantic.recall(query, k, threshold) : Promise.resolve([]),
-				episodic && wants("episodic") ? episodic.recall(query, k, threshold) : Promise.resolve([]),
-				procedural && wants("procedural") ? procedural.recall(query, k, threshold) : Promise.resolve([])
+				working && wants("working") ? Promise.resolve(working.recall(k, scope)) : Promise.resolve([]),
+				semantic && wants("semantic") ? semantic.recall(query, k, threshold, scope) : Promise.resolve([]),
+				episodic && wants("episodic") ? episodic.recall(query, k, threshold, scope) : Promise.resolve([]),
+				procedural && wants("procedural") ? procedural.recall(query, k, threshold, scope) : Promise.resolve([])
 			]);
 			return [
 				...workingHits,
@@ -4760,6 +4995,19 @@ function memory$2(config = {}) {
 	};
 }
 /**
+* Resolve the working tier's size bound from the `working` config
+* (`true` / a `{ maxItems }` object), validating it at construction the
+* same way every other tier's wiring fails loud-and-now rather than on
+* first use. There is deliberately no unbounded setting — the buffer is
+* process-resident for the life of the memory instance, so "no cap" is
+* a memory-exhaustion vector, not a configuration choice.
+*/
+function resolveWorkingMaxItems(workingConfig, name) {
+	const maxItems = workingConfig === true ? DEFAULT_WORKING_MAX_ITEMS : workingConfig.maxItems ?? DEFAULT_WORKING_MAX_ITEMS;
+	if (!Number.isInteger(maxItems) || maxItems < 1) throw new Error(`memory("${name}"): working tier \`maxItems\` must be an integer >= 1 — received ${String(maxItems)}`);
+	return maxItems;
+}
+/**
 * Resolve the semantic tier's store (explicit `store` wins, else the
 * global `ai.config({ defaultStore })`) and build the tier. Throws at
 * construction when neither is available — the same loud-now contract
@@ -11846,7 +12094,8 @@ var MockModel = class {
 	}
 	/**
 	* Record the call, optionally delay, then emit the scripted response as a
-	* sequence of stream chunks: content split word-by-word as `delta`
+	* sequence of stream chunks: the scripted `deltas` when the entry
+	* supplies them, otherwise content split word-by-word, as `delta`
 	* chunks, each scripted tool call as a `tool-call` chunk, and finally a
 	* `done` chunk with finish reason + usage. Throws eagerly if the scripted
 	* entry carries an `error`.
@@ -11859,10 +12108,10 @@ var MockModel = class {
 		const mock = this.nextResponse();
 		if (mock.delay) await new Promise((resolve) => setTimeout(resolve, mock.delay));
 		if (mock.error) throw mock.error;
-		const words = mock.content.split(" ");
-		for (const word of words) yield {
+		const chunks = mock.deltas ?? mock.content.split(" ").map((word) => word + " ");
+		for (const chunk of chunks) yield {
 			type: "delta",
-			content: word + " "
+			content: chunk
 		};
 		if (mock.toolCalls) for (const toolCall of mock.toolCalls) yield {
 			type: "tool-call",
@@ -12324,20 +12573,34 @@ var FallbackRun = class {
 * Mirrors `supervisor.asTool()` — same `compositeAsTool` composition and
 * error normalization — and adds `sessionScope`.
 *
-* The boundary is OPAQUE (§13, §18.6): the parent's `signal` / `context`
-* / events do NOT auto-forward. Anything the wrapped orchestrator needs
-* per call must ride on the tool's `inputSchema` payload.
+* The boundary is OPAQUE (§13, §18.6): the parent's `context` / events do
+* NOT auto-forward. Per-call data the wrapped orchestrator needs rides on
+* the tool's `inputSchema` payload — with ONE deliberate exception, the
+* session binding below, because the payload is written by an LLM.
 *
 * Session continuity:
 * - `"fresh"` (default) — each invocation gets a brand-new `sessionId`
 *   (a generated id) and empty history; the session lives only for this
 *   tool call. The whole validated payload is forwarded as the
 *   orchestrator's `execute(input)` argument.
-* - `"shared"` — the parent supplies `sessionId` (and optionally
-*   `history`) inside the validated payload; the orchestrator
-*   participates in that session. The remaining payload fields are
-*   forwarded as `execute(input)`. A missing/blank `sessionId` throws
-*   {@link SupervisorFailedError}.
+* - `"shared"` — the orchestrator joins an EXISTING session named by the
+*   developer through `options.session`: either a literal id fixed at
+*   construction, or a resolver that reads the invocation's
+*   {@link ToolContext} (`ctx.artifacts`, the out-of-band bag the model
+*   cannot write to). The whole validated payload is forwarded as
+*   `execute(input)`. A `"shared"` tool built without `session` throws at
+*   construction.
+*
+* **Why the session id is not a schema field (4.15.0 security fix).**
+* Before this release, `"shared"` scope read `sessionId` straight out of
+* the model-generated tool arguments. A `sessionId` is bearer-equivalent
+* — naming one grants read/write on that session's persisted state — so
+* any prompt injection reaching the outer agent ("continue session
+* `<victim-id>`") made the nested orchestrator load a stranger's
+* conversation, mutate it, and echo its content back into the attacker's
+* transcript. The binding now lives on channels the model has no access
+* to. The old behavior survives only behind the loudly-named
+* `unsafeAllowModelSessionId` opt-in.
 *
 * On `result.error`, the typed orchestrator error is thrown so the tool
 * wrapper produces a `ToolExecutionError` with `cause` preserved — the
@@ -12345,22 +12608,36 @@ var FallbackRun = class {
 *
 * @example
 * const support = ai.orchestrator({ name: "refund-support", intents });
+*
+* // Fresh session per call — no continuity, nothing to hijack.
 * const supportTool = support.asTool({
 *   name: "handle_refund",
 *   description: "Handle a refund conversation end-to-end.",
 *   inputSchema: v.object({ message: v.string() }),
 * });
-* const concierge = ai.agent({ model, tools: [supportTool] });
+*
+* // Continuous session — bound from the authenticated request, never
+* // from the model's arguments.
+* const continuousTool = support.asTool({
+*   name: "handle_refund",
+*   inputSchema: v.object({ message: v.string() }),
+*   sessionScope: "shared",
+*   session: (ctx) => ({
+*     sessionId: String(ctx?.artifacts?.refundSessionId ?? ""),
+*   }),
+* });
 */
 function asTool(orchestrator, options) {
 	if (!orchestrator.name || typeof orchestrator.name !== "string") throw new SupervisorFailedError("orchestrator.asTool(): orchestrator must have a `name` to be wrapped as a tool");
 	const sessionScope = options.sessionScope ?? "fresh";
+	const allowModelSessionId = options.unsafeAllowModelSessionId === true;
+	if (sessionScope === "shared" && !options.session && !allowModelSessionId) throw new SupervisorFailedError("orchestrator.asTool(): sessionScope \"shared\" requires a `session` binding — a session id fixed at construction, or a `(ctx) => sessionId` resolver reading the tool context. A model-supplied `sessionId` in the tool payload is bearer-equivalent access to that session; pass `unsafeAllowModelSessionId: true` only if the outer agent's context is trusted and you verify session ownership yourself");
 	return compositeAsTool({
 		name: options.name ?? orchestrator.name,
 		description: options.description ?? `Invoke orchestrator "${orchestrator.name}" as a tool.`,
 		input: options.inputSchema,
-		execute: async (input) => {
-			const { sessionId, history, executeInput } = resolveSession(sessionScope, input);
+		execute: async (input, ctx) => {
+			const { sessionId, history, executeInput } = await resolveSession(sessionScope, input, ctx, options.session, allowModelSessionId);
 			const result = await orchestrator.execute(executeInput, {
 				sessionId,
 				history
@@ -12376,21 +12653,41 @@ function asTool(orchestrator, options) {
 }
 /**
 * Resolve the per-call `sessionId`, `history`, and the `execute(input)`
-* argument from the validated tool payload, according to `sessionScope`.
+* argument, according to `sessionScope`.
+*
+* For `"shared"` scope the session comes from the developer's `session`
+* binding (construction-time literal or `ToolContext` resolver) — the
+* validated payload is never consulted for it unless the caller opted
+* into `unsafeAllowModelSessionId`. Either way `sessionId` / `history`
+* are stripped from the payload before it is forwarded as
+* `execute(input)`, so a model-authored field of that name can't reach
+* the orchestrator's input under a misleading name.
 */
-function resolveSession(sessionScope, input) {
+async function resolveSession(sessionScope, input, ctx, session, allowModelSessionId) {
 	if (sessionScope === "fresh") return {
 		sessionId: generateRunId("session"),
 		history: [],
 		executeInput: coerceInput$1(input)
 	};
-	const payload = typeof input === "object" && input !== null ? input : {};
-	if (typeof payload.sessionId !== "string" || payload.sessionId.length === 0) throw new SupervisorFailedError("orchestrator.asTool(): sessionScope \"shared\" requires a `sessionId` string in the tool input payload");
-	const { sessionId, history, ...rest } = payload;
+	const { sessionId: payloadSessionId, history: payloadHistory, ...rest } = typeof input === "object" && input !== null ? input : {};
+	const executeInput = coerceInput$1(rest);
+	if (session !== void 0) {
+		const bound = typeof session === "function" ? await session(ctx) : session;
+		const sessionId = typeof bound === "string" ? bound : bound?.sessionId;
+		const history = typeof bound === "string" ? void 0 : bound?.history;
+		if (typeof sessionId !== "string" || sessionId.length === 0) throw new SupervisorFailedError("orchestrator.asTool(): the `session` binding for sessionScope \"shared\" resolved to no session id — return a non-empty string (or `{ sessionId }`) from it, or throw to reject the call. The model's payload is never used as a fallback");
+		return {
+			sessionId,
+			history: Array.isArray(history) ? history : [],
+			executeInput
+		};
+	}
+	if (!allowModelSessionId) throw new SupervisorFailedError("orchestrator.asTool(): sessionScope \"shared\" requires a `session` binding");
+	if (typeof payloadSessionId !== "string" || payloadSessionId.length === 0) throw new SupervisorFailedError("orchestrator.asTool(): sessionScope \"shared\" requires a `sessionId` string in the tool input payload");
 	return {
-		sessionId,
-		history: Array.isArray(history) ? history : [],
-		executeInput: coerceInput$1(rest)
+		sessionId: payloadSessionId,
+		history: Array.isArray(payloadHistory) ? payloadHistory : [],
+		executeInput
 	};
 }
 /**
@@ -12524,6 +12821,14 @@ function invoke$2(handler, payload) {
 /** Default key the recalled memories are injected under in the context bag. */
 const DEFAULT_INJECT_KEY = "memories";
 /**
+* Default isolation boundary: a turn recalls only what its own session
+* remembered. Cross-session pooling is opt-in (`scope: "shared"`) — the
+* default must not leak one user's remembered turns into another's
+* context, since one memory store backs every session of an
+* orchestrator instance.
+*/
+const DEFAULT_SCOPE = "session";
+/**
 * A `MemoryContract` is the bare-store form; anything carrying a `store`
 * is the {@link OrchestratorMemoryConfig} wrapper. Distinguished by the
 * presence of `recall` — a method on the contract, absent on the config
@@ -12543,6 +12848,7 @@ function resolveOrchestratorMemory(memory) {
 	if (isBareMemory(memory)) return {
 		store: memory,
 		remember: true,
+		scope: DEFAULT_SCOPE,
 		injectKey: DEFAULT_INJECT_KEY
 	};
 	return {
@@ -12552,10 +12858,39 @@ function resolveOrchestratorMemory(memory) {
 		tier: memory.recall?.tier,
 		remember: memory.remember ?? true,
 		rememberTier: memory.rememberTier,
+		scope: memory.scope ?? DEFAULT_SCOPE,
 		injectKey: memory.injectKey ?? DEFAULT_INJECT_KEY
 	};
 }
 /**
+* Resolve the isolation key a turn reads and writes memories under
+* (4.15.0 — security fix for cross-session recall).
+*
+* The memory store is resolved once per orchestrator instance and reused
+* by every session, so this — not the store — is what keeps one session's
+* remembered turns out of another's recall. It is derived from the
+* execute-time `sessionId` by the engine and handed to every tier as an
+* exact-match filter; the model, the tool payload, and the per-call
+* `context` bag have no say in it.
+*
+* `"shared"` resolves to `undefined`, i.e. the store's unscoped pool —
+* the explicit opt-in back to pre-4.15.0 cross-session behavior, which
+* also keeps memories written before this release readable.
+*/
+function memoryScopeFor(memory, sessionId) {
+	if (memory.scope === "shared") return;
+	if (typeof memory.scope === "function") return memory.scope(sessionId);
+	return sessionMemoryScope(sessionId);
+}
+/**
+* The default `"session"` scope key: the session id under a reserved
+* prefix, so a custom `scope` callback returning a bare tenant id can
+* never accidentally collide with a session-scoped pool.
+*/
+function sessionMemoryScope(sessionId) {
+	return `session:${sessionId}`;
+}
+/**
 * Coerce a turn's {@link SupervisorInput} (string or structured object)
 * into the natural-language query the memory store recalls / embeds
 * against. Strings pass through; objects are JSON-serialized — the same
@@ -12572,13 +12907,18 @@ function memoryQueryFromInput(input) {
 * `memory.injectKey`. Returns an empty array — never throws on "no hits"
 * — and short-circuits when `k === 0` (recall disabled / write-only
 * memory) so a write-only config never round-trips the embedder.
+*
+* The recall is confined to the calling session's scope (see
+* {@link memoryScopeFor}) — `sessionId` is required, not optional, so a
+* new call site cannot silently recall across every session.
 */
-async function recallForTurn(memory, input) {
+async function recallForTurn(memory, input, sessionId) {
 	if (memory.k === 0) return [];
 	return memory.store.recall(memoryQueryFromInput(input), {
 		k: memory.k,
 		threshold: memory.threshold,
-		tier: memory.tier
+		tier: memory.tier,
+		scope: memoryScopeFor(memory, sessionId)
 	});
 }
 /**
@@ -12609,14 +12949,19 @@ function injectMemories(context, memory, recalled) {
 * The remembered text is the turn input followed by the model's textual
 * outcome when one is available, so a later `recall` keyed on a similar
 * input surfaces both the prior question and its answer.
+*
+* The write is tagged with the calling session's scope (see
+* {@link memoryScopeFor}) so only that session recalls it later —
+* turn text routinely contains one user's private content.
 */
-async function rememberTurnOutcome(memory, input, outcomeText) {
+async function rememberTurnOutcome(memory, input, outcomeText, sessionId) {
 	if (!memory.remember) return;
 	const text = buildOutcomeText(input, outcomeText);
 	if (!text) return;
 	const item = {
 		text,
-		tier: memory.rememberTier
+		tier: memory.rememberTier,
+		scope: memoryScopeFor(memory, sessionId)
 	};
 	await memory.store.remember(item);
 }
@@ -13320,6 +13665,72 @@ function isWorkflowResult(raw) {
 	return raw.type === "workflow";
 }
 
+//#endregion
+//#region ../ai/src/security/safe-merge.ts
+/**
+* Prototype-key guard for merges of model-influenced data into plain
+* objects (supervisor `state`, artifact bags, refine slices, …).
+*
+* Any `target[key] = value` where `key` came from an LLM, a tool
+* result, or a permissively-schema'd agent output is a prototype-
+* tampering primitive: `state["__proto__"] = {...}` repoints that
+* object's prototype, and `state["constructor"]` shadows its
+* constructor. On a plain object literal the blast radius is contained
+* (the write lands on the one object, not on `Object.prototype`), but
+* it becomes real prototype pollution the moment anything downstream
+* uses `in`, `hasOwnProperty`, or a recursive deep-merge on the
+* tainted object — which is exactly the kind of change that gets added
+* later without re-auditing the merge sites.
+*
+* So: one shared guard, applied at every merge boundary, dropping the
+* dangerous keys instead of assigning them. Dropping (not throwing) is
+* deliberate — these keys are never legitimate state fields, and a
+* merge boundary in the middle of a settled iteration is the wrong
+* place to fail a run. Callers get the dropped keys back so they can
+* log the anomaly.
+*/
+/**
+* Keys that must never be written through a dynamic-key assignment.
+* `__proto__` repoints the prototype; `constructor` / `prototype`
+* are the standard escalation path from there.
+*/
+const UNSAFE_MERGE_KEYS = [
+	"__proto__",
+	"constructor",
+	"prototype"
+];
+const UNSAFE_MERGE_KEY_SET = new Set(UNSAFE_MERGE_KEYS);
+/**
+* True when `key` must not be assigned onto an object built from
+* untrusted (model/tool-influenced) data.
+*/
+function isUnsafeMergeKey(key) {
+	return UNSAFE_MERGE_KEY_SET.has(key);
+}
+/**
+* Assign one key onto `target`, skipping prototype-tampering keys.
+* Returns `true` when the value was written, `false` when the key was
+* refused.
+*/
+function assignSafeKey(target, key, value) {
+	if (isUnsafeMergeKey(key)) return false;
+	target[key] = value;
+	return true;
+}
+/**
+* Shallow-merge every own enumerable key of `source` into `target`,
+* skipping prototype-tampering keys. Mutates `target` in place (call
+* sites rely on external references to the merged object staying
+* coherent) and returns the list of refused keys — empty in the
+* overwhelmingly common case, non-empty only when something upstream
+* tried to smuggle `__proto__`/`constructor`/`prototype` through.
+*/
+function mergeSafely(target, source) {
+	const skipped = [];
+	for (const [key, value] of Object.entries(source)) if (!assignSafeKey(target, key, value)) skipped.push(key);
+	return skipped;
+}
+
 //#endregion
 //#region ../ai/src/supervisor/cancellation.ts
 /**
@@ -13431,7 +13842,7 @@ async function decideViaCallback(params) {
 		throw wrapRouteError(params.config.name, thrown);
 	}
 	const durationMs = performance.now() - started;
-	return normalize(raw, params.entries, "route", durationMs);
+	return normalize(raw, params.entries, "route", durationMs, resolveMaxFanOut(params.config));
 }
 async function decideViaRouter(params) {
 	const { agent, placeholders, inputOverride, historySlicer } = resolveRouterEntry(params.config.router);
@@ -13480,7 +13891,7 @@ async function decideViaRouter(params) {
 		availableKeys: [...params.entries.keys()]
 	});
 	return {
-		...normalize(rawNext, params.entries, "router", durationMs),
+		...normalize(rawNext, params.entries, "router", durationMs, resolveMaxFanOut(params.config)),
 		reasoning: typeof reasoning === "string" ? reasoning : void 0,
 		usage: routerResult.usage,
 		routerReport: routerResult.report
@@ -13520,7 +13931,7 @@ function resolveSupervisorPromptText(config) {
 * `next` field) into a canonical `DispatchDecision`, validating every
 * named intent against the supervisor's `intents` map.
 */
-function normalize(raw, entries, source, durationMs) {
+function normalize(raw, entries, source, durationMs, maxFanOut) {
 	if (isEnd(raw)) return {
 		kind: "end",
 		source,
@@ -13551,7 +13962,7 @@ function normalize(raw, entries, source, durationMs) {
 		}
 		return {
 			kind: "dispatch",
-			intents: raw,
+			intents: capFanOut(raw, entries, maxFanOut),
 			source,
 			raw,
 			durationMs
@@ -13562,6 +13973,53 @@ function normalize(raw, entries, source, durationMs) {
 		availableKeys: [...entries.keys()]
 	});
 }
+/**
+* Default fan-out WIDTH ceiling — how many intents one dispatch
+* decision may run in parallel. `maxIterations` bounds depth; this
+* bounds width, so total work per run is bounded by the product
+* instead of by iterations alone.
+*/
+const DEFAULT_MAX_FAN_OUT = 10;
+/**
+* Resolve the configured width ceiling. Factory validation
+* (`supervisor.ts`) rejects non-integer / `< 1` values at authoring
+* time, so this only has to apply the default.
+*/
+function resolveMaxFanOut(config) {
+	return config.maxFanOut ?? 10;
+}
+/**
+* Dedupe + width-cap a fan-out intent list before it reaches
+* `Promise.all(...dispatchOne)`.
+*
+* Duplicates are collapsed silently: running the same intent twice in
+* one decision is pure wasted spend (branch results are indexed by
+* intent downstream, so the extras can't change the outcome), and a
+* router that repeats itself is sloppy rather than hostile.
+*
+* Exceeding the cap *after* dedupe THROWS rather than truncating.
+* Truncation would silently hand an attacker-chosen subset of the
+* decision to the executor and hide the anomaly from the operator;
+* every other routing violation in this file (unknown key, empty
+* array, non-string element) already fails loudly as
+* `SupervisorRoutingError`, so a width violation surfaces in the same
+* place, with the same code, carrying the offending array.
+*
+* Threat model: the router's prompt embeds supervisor `state` and
+* prior branch outputs, both of which can carry attacker-controlled
+* text from tool results. Without a width bound, one injected
+* "always return this 200-element `next` array" turns a single
+* iteration into 200 real agent/workflow executions — no unknown
+* intent name required, so the existing allowlist check never fires.
+*/
+function capFanOut(intents, entries, maxFanOut) {
+	const unique = [...new Set(intents)];
+	if (unique.length > maxFanOut) throw new SupervisorRoutingError(`routing decision fanned out to ${unique.length} intents — exceeds maxFanOut=${maxFanOut}. Raise \`maxFanOut\` if this width is intended.`, {
+		returned: intents,
+		availableKeys: [...entries.keys()]
+	});
+	return unique;
+}
 function validateKey(intent, entries) {
 	if (!entries.has(intent)) throw new SupervisorRoutingError(`router returned unknown agent key "${intent}"`, {
 		returned: intent,
@@ -14127,9 +14585,17 @@ var SupervisorExecution = class {
 	* branch errors don't abort siblings — they're recorded on the
 	* branch snapshot and let evaluate (or default termination logic)
 	* decide the response.
+	*
+	* `capFanOut` runs here as well as in `decide.ts` — this is the one
+	* chokepoint every dispatch source funnels through (router/route
+	* decisions, `evaluate.reassignTo`, classifier picks, per-intent
+	* `next` unions), so the width bound holds even for the paths that
+	* build a `DispatchDecision` without going through `normalize()`.
+	* Idempotent for already-normalized decisions.
 	*/
 	async dispatchBranches(decision) {
-		return await Promise.all(decision.intents.map((intent) => this.dispatchOne(intent)));
+		const intents = capFanOut(decision.intents, this.entries, resolveMaxFanOut(this.config));
+		return await Promise.all(intents.map((intent) => this.dispatchOne(intent)));
 	}
 	/**
 	* Execute a single branch — resolve the input, invoke the
@@ -14514,24 +14980,10 @@ var SupervisorExecution = class {
 	* through unchanged so structured inputs work.
 	*/
 	coerceInlineInput(executable, input) {
-		if (!("signature" in executable) && typeof executable.execute === "function" && !this.isSupervisor(executable) && typeof input !== "string") return safeStringify(input);
+		if ("isAnonymous" in executable && typeof input !== "string") return safeStringify(input);
 		return input;
 	}
 	/**
-	* Heuristic detection of `SupervisorContract` — the contract carries
-	* a `signature` getter same as workflows, but supervisors expose
-	* `resume()` while workflows expose `resume(runId, options)` too.
-	* Cleanest distinguisher in the public surface: supervisors carry
-	* the `asTool` method name `as` … unfortunately so do workflows.
-	* Use the `streamableType` brand if we add one in v2; for now lean
-	* on a duck-typed check that's good enough for the ctx.run path
-	* (incorrect routing for workflows would still produce a runnable
-	* call — workflow.execute accepts the same args either way).
-	*/
-	isSupervisor(executable) {
-		return typeof executable.resume === "function" && typeof executable.signature === "string" && typeof executable.stream === "function";
-	}
-	/**
 	* Invoke the underlying dispatchable unit. Agents and workflows
 	* both satisfy `ExecutableContract<string, …>` so the call shape
 	* is uniform; the `type` discriminator picks which options get
@@ -14829,7 +15281,31 @@ var SupervisorExecution = class {
 		if (ackOutcome.error || !ackOutcome.output) return;
 		if (typeof ackOutcome.output !== "object" || ackOutcome.output === null) return;
 		const slice = ackOutcome.output;
-		for (const [key, value] of Object.entries(slice)) this.state[key] = value;
+		this.mergeIntoState(slice, "ack");
+	}
+	/**
+	* Single funnel for "shallow-merge a model-influenced slice into
+	* `this.state`". Wraps the shared {@link mergeSafely} guard so no
+	* merge site can assign `__proto__` / `constructor` / `prototype`
+	* onto the run's state object, and logs when something tried.
+	*
+	* Every slice reaching state is model- or tool-influenced (agent
+	* outputs validated against a DEVELOPER-supplied schema, which may
+	* legitimately be permissive: `z.record()`, `.passthrough()`,
+	* `z.any()`), so the key names are untrusted input even when the
+	* values are shaped.
+	*/
+	mergeIntoState(slice, origin) {
+		const skipped = mergeSafely(this.state, slice);
+		this.warnOnUnsafeKeys(skipped, origin);
+	}
+	/** Shared logging for refused prototype-tampering keys. */
+	warnOnUnsafeKeys(skipped, origin) {
+		if (skipped.length === 0) return;
+		this.logger.warn(this.logModule, "state.merge.unsafe-key", `dropped prototype-tampering key(s) from "${origin}" merge: ${skipped.join(", ")}`, {
+			origin,
+			keys: skipped
+		});
 	}
 	/**
 	* Run the iter-0 classifier prelude (Phase 7 / decisions §37).
@@ -14953,9 +15429,9 @@ var SupervisorExecution = class {
 			refined = interpretation.refined;
 			halted = interpretation.halted;
 			final = interpretation.final ?? raw;
-			if (interpretation.sliceToMerge) for (const [key, value] of Object.entries(interpretation.sliceToMerge)) this.state[key] = value;
+			if (interpretation.sliceToMerge) this.mergeIntoState(interpretation.sliceToMerge, "classifier.refine");
 		}
-		for (const [key, value] of Object.entries(final)) this.state[key] = value;
+		this.mergeIntoState(final, "classifier");
 		this.classifierSnapshot = {
 			intent: halted ? void 0 : final.intent,
 			reasoning: final.reasoning,
@@ -15152,7 +15628,7 @@ var SupervisorExecution = class {
 		const slice = {};
 		for (const [key, value] of Object.entries(record)) {
 			if (key === "intent") continue;
-			slice[key] = value;
+			assignSafeKey(slice, key, value);
 		}
 		const final = {
 			...raw,
@@ -15228,6 +15704,10 @@ var SupervisorExecution = class {
 				continue;
 			}
 			for (const [key, value] of Object.entries(slice)) {
+				if (isUnsafeMergeKey(key)) {
+					this.warnOnUnsafeKeys([key], `intent "${intent}"`);
+					continue;
+				}
 				const previousOwner = mergedKeys.get(key);
 				if (previousOwner !== void 0 && previousOwner !== intent) this.logger.warn(this.logModule, "state.merge.conflict", `state key "${key}" written by both "${previousOwner}" and "${intent}" — last-in-decision-array wins (Q15)`, {
 					key,
@@ -15279,9 +15759,9 @@ var SupervisorExecution = class {
 		const finalize = this.config.finalizeArtifacts;
 		if (finalize) {
 			const merged = finalize(this.state, artifacts);
-			for (const key of Object.keys(this.state)) if (!(key in merged)) delete this.state[key];
-			for (const [key, value] of Object.entries(merged)) this.state[key] = value;
-		} else for (const [key, value] of Object.entries(artifacts)) this.state[key] = value;
+			for (const key of Object.keys(this.state)) if (!Object.hasOwn(merged, key)) delete this.state[key];
+			this.mergeIntoState(merged, "finalizeArtifacts");
+		} else this.mergeIntoState(artifacts, "artifacts");
 		this.currentArtifacts = {};
 	}
 	/**
@@ -15911,6 +16391,10 @@ function validateFactoryConfig$1(config) {
 		authoring: true,
 		maxIterations: config.maxIterations
 	} });
+	if (config.maxFanOut !== void 0 && (!Number.isInteger(config.maxFanOut) || config.maxFanOut < 1)) throw new SupervisorFailedError(`ai.supervisor("${config.name}"): \`maxFanOut\` must be an integer >= 1`, { context: {
+		authoring: true,
+		maxFanOut: config.maxFanOut
+	} });
 }
 function generateRunId$2() {
 	return `sup_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 10)}`;
@@ -16519,7 +17003,7 @@ async function runTurn(ctx, input, options) {
 		const seedState = applyStatePatch(loaded.state, options.state);
 		let turnContext = options.context;
 		if (ctx.memory) {
-			const recalled = await recallForTurn(ctx.memory, input);
+			const recalled = await recallForTurn(ctx.memory, input, sessionId);
 			turnContext = injectMemories(turnContext, ctx.memory, recalled);
 		}
 		const { result, state, turnSnapshot } = await dispatchTurn({
@@ -16559,7 +17043,7 @@ async function runTurn(ctx, input, options) {
 			lastRoute: summarizeRoute(turnSnapshot.decision.raw),
 			summarizedThrough: loaded.record?.summarized_through ?? null
 		});
-		if (ctx.memory) await rememberTurnOutcome(ctx.memory, input, outcomeTextFromTurn(result.data, turnSnapshot));
+		if (ctx.memory) await rememberTurnOutcome(ctx.memory, input, outcomeTextFromTurn(result.data, turnSnapshot), sessionId);
 		let compaction;
 		if (shouldCompact(ctx, loaded.turnIndex)) {
 			const outcome = await runCompaction(ctx, sessionId, options.history);
@@ -17254,25 +17738,35 @@ function assertAcyclic(nodes, byId, plannerName) {
 //#endregion
 //#region ../ai/src/planner/plan-schema.ts
 /**
-* Build the Standard Schema the planning agent emits — an ordered
-* `{ steps: [...], summary? }` plan whose every step references one of
-* `capabilityNames` via the `capability` field.
-*
-* Mirrors the router's hand-built schema approach
-* (`supervisor/router-factory.ts`): the JSON Schema extension carries
-* the capability names as an `enum` so capable providers enforce the
-* choice natively, while `validate()` still accepts the shape softly so
-* providers without native structured output can pass a parsed object
-* through. Validation is intentionally lenient on `capability` — an
-* unknown name is surfaced later by the planner as a typed
-* `PlannerPlanInvalidError`, with the full forensic context, rather
-* than as an opaque schema issue here.
+* Slack allowed over `maxSteps` before a returned plan is rejected
+* outright. A model that overshoots the prompt's "at most N steps" by a
+* little is normal and the runtime truncates the tail to `skipped`;
+* one that returns several times the budget is malfunctioning (or the
+* provider/proxy is not the one we think it is), and parsing it is
+* unbounded work on attacker-adjacent input.
+*/
+const STEP_CEILING_FACTOR = 4;
+/**
+* Ceiling used when `planSchema` is built without a `maxSteps` — direct
+* callers outside `PlannerRun`, which has no runtime truncation of its
+* own to fall back on.
+*/
+const DEFAULT_STEP_CEILING = 100;
+/**
+* Hard upper bound on the number of steps `validate()` will parse.
 *
-* `maxSteps`, when provided, is emitted as the `steps` array's
-* `maxItems` so capable providers refuse to over-produce up front
-* (the planner still truncates the tail to `skipped` defensively).
+* Strict-mode JSON Schema can't carry `maxItems`, so nothing on the wire
+* stops a provider from returning an arbitrarily long `steps[]`; before
+* 4.15.0 the whole array was parsed, normalized and stored, and only the
+* execution loop truncated it. This is the parse-time backstop that
+* makes the bound hold regardless of what the provider honors.
 */
+function parsedStepCeiling(maxSteps) {
+	if (maxSteps === void 0) return DEFAULT_STEP_CEILING;
+	return Math.max(1, Math.ceil(maxSteps)) * STEP_CEILING_FACTOR;
+}
 function planSchema(capabilityNames, maxSteps) {
+	const stepCeiling = parsedStepCeiling(maxSteps);
 	const jsonSchema = {
 		type: "object",
 		properties: {
@@ -17297,6 +17791,7 @@ function planSchema(capabilityNames, maxSteps) {
 			if (!value || typeof value !== "object") return { issues: [{ message: "plan must be an object" }] };
 			const record = value;
 			if (!Array.isArray(record.steps) || record.steps.length === 0) return { issues: [{ message: "plan `steps` must be a non-empty array" }] };
+			if (record.steps.length > stepCeiling) return { issues: [{ message: `plan \`steps\` must not exceed ${stepCeiling} entries (received ${record.steps.length})` }] };
 			const steps = [];
 			for (const raw of record.steps) {
 				const normalized = normalizeStep(raw);
@@ -24268,6 +24763,7 @@ exports.SupervisorFailedError = SupervisorFailedError;
 exports.SupervisorRoutingError = SupervisorRoutingError;
 exports.SystemPrompt = SystemPrompt;
 exports.ToolExecutionError = ToolExecutionError;
+exports.UNSAFE_MERGE_KEYS = UNSAFE_MERGE_KEYS;
 exports.VcrCassetteMissError = VcrCassetteMissError;
 exports.WorkflowCancelledError = WorkflowCancelledError;
 exports.WorkflowDriftError = WorkflowDriftError;
@@ -24277,6 +24773,7 @@ exports.agent = agent;
 exports.ai = ai;
 exports.approximateTokenCount = approximateTokenCount;
 exports.assertUrlAllowed = assertUrlAllowed;
+exports.assignSafeKey = assignSafeKey;
 exports.audioFromBuffer = audioFromBuffer;
 exports.audioFromFile = audioFromFile;
 exports.audioMediaTypeForFilename = audioMediaTypeForFilename;
@@ -24346,6 +24843,7 @@ exports.interruptRedis = redis$1;
 exports.isExecutableTool = isExecutableTool;
 exports.isObserveAll = isObserveAll;
 exports.isPrivateOrReservedIp = isPrivateOrReservedIp;
+exports.isUnsafeMergeKey = isUnsafeMergeKey;
 exports.judge = judge;
 exports.judgePromptBody = judgePromptBody;
 exports.keywordReranker = keywordReranker;
@@ -24362,6 +24860,7 @@ exports.matchOutputShape = require_matcher_logic.matchOutputShape;
 exports.matchPassStep = require_matcher_logic.matchPassStep;
 exports.matchRouteTo = require_matcher_logic.matchRouteTo;
 exports.memory = memory$2;
+exports.mergeSafely = mergeSafely;
 exports.mergeUsage = mergeUsage;
 exports.mockAgent = mockAgent;
 exports.mockRouter = mockRouter;
@@ -24374,7 +24873,9 @@ exports.onConfigApplied = onConfigApplied;
 exports.orchestrator = orchestrator;
 exports.orchestratorAsTool = asTool;
 exports.orchestratorMemoryQueryFromInput = memoryQueryFromInput;
+exports.orchestratorMemoryScopeFor = memoryScopeFor;
 exports.orchestratorOutcomeTextFromTurn = outcomeTextFromTurn;
+exports.orchestratorSessionMemoryScope = sessionMemoryScope;
 exports.parseFrontmatter = parseFrontmatter;
 exports.parsePartialJson = parsePartialJson;
 exports.parseTags = parseTags;