Pipeline output queries report inherited Object properties as completed-stage outputs

[ugin-man]

On main a72b99f60680ffbe56a4c72e113ca52c9469921e, a newly constructed pipeline with no stages and no outputs reports that constructor, toString, and __proto__ have produced output.

pipelineOutputs starts as {}. hasStageOutput() uses in, which includes inherited properties, while getStageOutput() performs an unrestricted property lookup. Consequently the two methods disagree with the empty own-output set returned by getAllOutputs().

Reproduction

Save as tests/output-lookup-repro.test.ts and run with bun test tests/output-lookup-repro.test.ts:

import { test } from "bun:test"
import { strict as assert } from "node:assert"
import { BasePipelineSolver } from "../lib/BasePipelineSolver"

class EmptyPipeline extends BasePipelineSolver<Record<string, never>> {
  pipelineDef = []
}

for (const name of ["constructor", "toString", "__proto__"]) {
  test(`no output exists for ${name}`, () => {
    const pipeline = new EmptyPipeline({})
    assert.deepEqual(Object.keys(pipeline.getAllOutputs()), [])
    assert.equal(pipeline.hasStageOutput(name), false)
    assert.equal(pipeline.getStageOutput(name), undefined)
  })
}

Actual results before any step runs:

Name	hasStageOutput	typeof getStageOutput	Expected
constructor	true	function	false / undefined
toString	true	function	false / undefined
proto	true	object	false / undefined

An ordinary missing name correctly returns false/undefined. A control pipeline with a real stage returning numeric zero correctly returns true/0 after solve(); zero-valued outputs should remain valid.

A correction should distinguish own output entries from inherited Object properties. This report only concerns output-existence and output-value queries; it does not claim a security exploit or prescribe a redesign of stage names or solver-instance storage.

Executed verification

The complete actual BasePipelineSolver.ts and BaseSolver.ts files were checked against Git blob SHAs 83219bde45df9b6e456dfb175a37d5c5147a9b3c and e071bf8c1fe3e2fb4eae73bbaa4e282871d15f02. TypeScript 5.8.3 transpilation and Node 22.16.0 execution reproduced six incorrect query results across the three names, with two passing controls (ordinary missing output and an actually completed zero-valued output).

The unavailable graphics-debug import was supplied with a throwing visualization-only stub; it was called zero times. Constructors, stepping, output production and output queries used the original solver implementations. No full Bun suite, dependency-resolved typecheck or rendering run is claimed here. Prepared with ChatGPT assistance and the account owner's authorization.

[Flame119052]

Fix: #41