fix(core): handle inherited-key message identifiers

[liangzhechen655]

What is the current behavior?

In-memory message storage uses plain objects as user and conversation dictionaries. String identifiers such as constructor, toString and __proto__ resolve to inherited object properties instead of message buckets. Reading an empty conversation can throw messages.sort is not a function, and inherited user buckets can bypass the expected isolation and statistics.

What is the new behavior?

Use dictionaries without prototypes at both levels, including the empty-read fallback and resets after clearing messages or storage. Reserved-looking strings behave like other identifiers. Parameterized tests cover empty reads, per-user isolation, adding/deleting messages, conversation clearing, user clearing and complete storage resets.

Validation

• All six regressions fail on the base revision through the public storage API.
• All 155 memory tests, including 34 type tests, pass with the fix.
• Core TypeScript checking and CJS/ESM/declaration builds pass.
• Core Biome checks pass with five existing complexity warnings.
• Validation uses the repository's locked core/internal/logger dependencies; the entire monorepo build was not run.

PR Checklist

• Conventional commit message
• Regression tests added
• Patch changeset added
• Related issues: independently reproduced bug.
• Documentation: no API changes; ordinary string identifiers now work consistently.

---

Summary by cubic

Fixes @voltagent/core in-memory message storage so user and conversation identifiers like constructor, toString, and __proto__ are treated as ordinary strings. Previously these identifiers resolved to inherited object properties, causing messages.sort is not a function errors on empty reads and letting inherited buckets bypass per-user isolation and statistics.

Bug Fixes

• Replaces plain object dictionaries with prototype-less objects at every level, including the empty-read fallback and resets after clearing messages or storage.
• Adds parameterized regression tests covering empty reads, per-user isolation, message CRUD, and clearing scenarios for these identifiers used as both user and conversation identifiers.

^{Written for commit db5f07a. Summary will update on new commits.}

Summary by CodeRabbit

• Bug Fixes
  • In-memory message storage now reliably supports identifiers such as constructor, toString, and __proto__, including after user-specific or full storage clears.
  • Message retrieval, CRUD operations, statistics, and user isolation work with these identifiers.

[changeset-bot]

🦋 Changeset detected

Latest commit: db5f07a

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@voltagent/core	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4dab0fee-1a02-44fb-9565-9423de3bda5f

---

📥 Commits

Reviewing files that changed from the base of the PR and between 9accd57 and db5f07a.

---

📒 Files selected for processing (1)

• packages/core/src/memory/adapters/storage/in-memory-identifiers.spec.ts

---

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 6 remain after this review.

---

---

📝 Walkthrough

Walkthrough

The in-memory storage adapter now uses null-prototype objects for message records, including after clearing storage. New tests cover user and conversation identifiers such as constructor, toString, and __proto__.

Changes

In-memory message storage

Layer / File(s)	Summary
Null-prototype message records packages/core/src/memory/adapters/storage/in-memory.ts, packages/core/src/memory/adapters/storage/in-memory-identifiers.spec.ts, .changeset/plain-message-identifiers.md	The adapter uses null-prototype objects when it creates or resets message-storage records. Tests cover retrieval, isolation, statistics, and message operations with special identifiers. The changeset declares a patch for @voltagent/core.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

---

Merge Risk: ⚪ Minimal · up to db5f0

No actionable merge-blocking risk is established in the special-identifier storage changes.

Pre-merge checks | 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: fixing inherited-key handling in core message identifiers.
Description check		The description explains the current and new behavior, identifies the bug, documents regression tests and validation, and addresses the checklist items. It does not link a specific issue or include se…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[cubic-dev-ai]

All reported issues were addressed across 3 files

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Re-trigger cubic</sub>