Evidence record / temporal-agent-harness
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-13-temporal-agent-harness-0-5-0-guards-console-state-patches-against-prototype-chain-paths
0.5.0 guards console state patches against prototype-chain paths. The console now rejects JSON patch paths containing proto, constructor or prototype before applying the patch. The earlier walker followed ordinary object properties, so a crafted state path could write through the prototype chain instead of only into the intended document. The state projection calls this guarded implementation. This hardening shipped in the packaged UI; it is not the separate npm client patcher, which had earlier own-property checks. No CVE or live exploit is claimed.
Channel: preview-or-beta (packaged console at T5 and T6). Half: defect. Date: 2026-09-30 (released; committed 2026-09-29 UTC).
Operator consequence: Use the T5/T6 console rather than an older packaged UI when displaying model-invented state. Keep console and server versions aligned; do not infer the npm client implementation from this console fix.
Receipt
- https://github.com/temporal-community/temporal-agent-harness/commit/421636d5900320233df9f0096809b4462123ff04
- https://github.com/temporal-community/temporal-agent-harness/blob/04a49d1b037de46da2cba31676d2aa2f4c59118f/ui/src/lib/state/jsonPatch.ts#L65-L128
- https://github.com/temporal-community/temporal-agent-harness/blob/04a49d1b037de46da2cba31676d2aa2f4c59118f/ui/src/lib/state/agentState.ts#L171
Finding metadata
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
Finding ID: 2026-10-13-temporal-agent-harness-0-5-0-guards-console-state-patches-against-prototype-chain-paths
Profile citations
- temporal-agent-harness / claim / console-state-patch-guard
Source links
Primary links, including exact changelog lines when available.
- commit2026-10-13-temporal-agent-harness-0-5-0-guards-console-state-patches-against-prototype-chain-pathsgithub.com/temporal-community/temporal-agent-harness/commit/421636d5900320233df9f0096809b4462123ff04tagged commit file2026-10-13-temporal-agent-harness-0-5-0-guards-console-state-patches-against-prototype-chain-pathstemporal-community/temporal-agent-harness / ui/src/lib/state/jsonPatch.ts#L65-L128tagged commit file2026-10-13-temporal-agent-harness-0-5-0-guards-console-state-patches-against-prototype-chain-pathstemporal-community/temporal-agent-harness / ui/src/lib/state/agentState.ts#L171
Versioned source: run artifact