@warlock.js/ai 4.15.0 → 4.16.0

package/esm/supervisor/execution.mjs

@@ -11,8 +11,9 @@ import "../utils/index.mjs";
 import { runPipeline } from "../middleware/pipeline.mjs";
 import { END } from "../contracts/end.type.mjs";
 import { isAgentResult, isWorkflowResult } from "./entries.mjs";
+import { assignSafeKey, isUnsafeMergeKey, mergeSafely } from "../security/safe-merge.mjs";
 import { createCancelledError } from "./cancellation.mjs";
-import { decide } from "./decide.mjs";
+import { capFanOut, decide, resolveMaxFanOut } from "./decide.mjs";
 import { persistSupervisorSnapshot } from "./snapshot.mjs";
 import { log } from "@warlock.js/logger";
 
@@ -432,9 +433,17 @@ var SupervisorExecution = class {
 	* branch errors don't abort siblings — they're recorded on the
 	* branch snapshot and let evaluate (or default termination logic)
 	* decide the response.
+	*
+	* `capFanOut` runs here as well as in `decide.ts` — this is the one
+	* chokepoint every dispatch source funnels through (router/route
+	* decisions, `evaluate.reassignTo`, classifier picks, per-intent
+	* `next` unions), so the width bound holds even for the paths that
+	* build a `DispatchDecision` without going through `normalize()`.
+	* Idempotent for already-normalized decisions.
 	*/
 	async dispatchBranches(decision) {
-		return await Promise.all(decision.intents.map((intent) => this.dispatchOne(intent)));
+		const intents = capFanOut(decision.intents, this.entries, resolveMaxFanOut(this.config));
+		return await Promise.all(intents.map((intent) => this.dispatchOne(intent)));
 	}
 	/**
 	* Execute a single branch — resolve the input, invoke the
@@ -1120,7 +1129,31 @@ var SupervisorExecution = class {
 		if (ackOutcome.error || !ackOutcome.output) return;
 		if (typeof ackOutcome.output !== "object" || ackOutcome.output === null) return;
 		const slice = ackOutcome.output;
-		for (const [key, value] of Object.entries(slice)) this.state[key] = value;
+		this.mergeIntoState(slice, "ack");
+	}
+	/**
+	* Single funnel for "shallow-merge a model-influenced slice into
+	* `this.state`". Wraps the shared {@link mergeSafely} guard so no
+	* merge site can assign `__proto__` / `constructor` / `prototype`
+	* onto the run's state object, and logs when something tried.
+	*
+	* Every slice reaching state is model- or tool-influenced (agent
+	* outputs validated against a DEVELOPER-supplied schema, which may
+	* legitimately be permissive: `z.record()`, `.passthrough()`,
+	* `z.any()`), so the key names are untrusted input even when the
+	* values are shaped.
+	*/
+	mergeIntoState(slice, origin) {
+		const skipped = mergeSafely(this.state, slice);
+		this.warnOnUnsafeKeys(skipped, origin);
+	}
+	/** Shared logging for refused prototype-tampering keys. */
+	warnOnUnsafeKeys(skipped, origin) {
+		if (skipped.length === 0) return;
+		this.logger.warn(this.logModule, "state.merge.unsafe-key", `dropped prototype-tampering key(s) from "${origin}" merge: ${skipped.join(", ")}`, {
+			origin,
+			keys: skipped
+		});
 	}
 	/**
 	* Run the iter-0 classifier prelude (Phase 7 / decisions §37).
@@ -1244,9 +1277,9 @@ var SupervisorExecution = class {
 			refined = interpretation.refined;
 			halted = interpretation.halted;
 			final = interpretation.final ?? raw;
-			if (interpretation.sliceToMerge) for (const [key, value] of Object.entries(interpretation.sliceToMerge)) this.state[key] = value;
+			if (interpretation.sliceToMerge) this.mergeIntoState(interpretation.sliceToMerge, "classifier.refine");
 		}
-		for (const [key, value] of Object.entries(final)) this.state[key] = value;
+		this.mergeIntoState(final, "classifier");
 		this.classifierSnapshot = {
 			intent: halted ? void 0 : final.intent,
 			reasoning: final.reasoning,
@@ -1443,7 +1476,7 @@ var SupervisorExecution = class {
 		const slice = {};
 		for (const [key, value] of Object.entries(record)) {
 			if (key === "intent") continue;
-			slice[key] = value;
+			assignSafeKey(slice, key, value);
 		}
 		const final = {
 			...raw,
@@ -1519,6 +1552,10 @@ var SupervisorExecution = class {
 				continue;
 			}
 			for (const [key, value] of Object.entries(slice)) {
+				if (isUnsafeMergeKey(key)) {
+					this.warnOnUnsafeKeys([key], `intent "${intent}"`);
+					continue;
+				}
 				const previousOwner = mergedKeys.get(key);
 				if (previousOwner !== void 0 && previousOwner !== intent) this.logger.warn(this.logModule, "state.merge.conflict", `state key "${key}" written by both "${previousOwner}" and "${intent}" — last-in-decision-array wins (Q15)`, {
 					key,
@@ -1570,9 +1607,9 @@ var SupervisorExecution = class {
 		const finalize = this.config.finalizeArtifacts;
 		if (finalize) {
 			const merged = finalize(this.state, artifacts);
-			for (const key of Object.keys(this.state)) if (!(key in merged)) delete this.state[key];
-			for (const [key, value] of Object.entries(merged)) this.state[key] = value;
-		} else for (const [key, value] of Object.entries(artifacts)) this.state[key] = value;
+			for (const key of Object.keys(this.state)) if (!Object.hasOwn(merged, key)) delete this.state[key];
+			this.mergeIntoState(merged, "finalizeArtifacts");
+		} else this.mergeIntoState(artifacts, "artifacts");
 		this.currentArtifacts = {};
 	}
 	/**