[Monorepo] 3. Shared Entities package

[mmabrouk]

---

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
agenta-documentation	Ready	Preview, Comment	Jan 23, 2026 8:06pm

In general terms, to fix this problem we must prevent untrusted strings from being used as property names on objects that inherit from Object.prototype. We can do this by either: (a) using a prototype-less object (Object.create(null)) so that even if the key is "__proto__" it does not affect Object.prototype, or (b) validating and rejecting dangerous key names ("__proto__", "prototype", "constructor"), or (c) switching to Map. Given the current code and the need to avoid changing functionality, the least intrusive fix is to keep using plain objects for the API shape but: create the targetObj as a prototype-less object when first created, and/or reject dangerous keys before assignment.

The single best fix here with minimal behavioral change is: when we create targetObj for a given mapping.targetKey, use Object.create(null) instead of {} so it has no prototype, and also explicitly skip assignments when keyName is a prototype-polluting key. We must also ensure that if result[mapping.targetKey] already exists and is not an object, we create a new safe object instead of reusing it unsafely. Concretely, in resolveChainInputs, lines 139–149 are where we construct targetObj and assign targetObj[keyName] = value. We should replace the current initialization:

const targetObj = (result[mapping.targetKey] as Record<string, unknown>) ?? {}
// ...
if (keyName) {
    targetObj[keyName] = value
}
result[mapping.targetKey] = targetObj

with logic that:

1. Retrieves any existing object for result[mapping.targetKey].
2. If none exists or it is not a plain object, initializes a new prototype-less object via Object.create(null).
3. Computes keyName as before.
4. Checks keyName is truthy and is not "__proto__", "prototype", or "constructor".
5. Only then assigns safeTargetObj[keyName] = value.
6. Stores safeTargetObj back into result[mapping.targetKey].

No new imports or external dependencies are needed; Object.create is part of standard JavaScript.