What is the Neural Link?

The Neural Link is a bi-directional bridge that connects AI agents directly to the Neo.mjs runtime. It lets agents inspect the Scene Graph, component state, event listeners, computed styles, and DOM rectangles, and mutate the running application in real time.

Why is Neo.mjs called an Application Engine instead of a framework?

Neo.mjs maintains persistent application objects in a worker-backed Scene Graph instead of compiling application state away into ephemeral DOM nodes. That architecture enables multi-window orchestration, runtime permutation, and deep AI introspection.

What is Context Engineering?

Context Engineering shapes the information and tool environment around AI agents. Neo.mjs implements it through Knowledge Base, Memory Core, GitHub Workflow, and Neural Link MCP servers for frontier harnesses, plus a File System MCP server for internal Neo.ai.Agent local loops.

What is the Neo.mjs Agent OS?

The Neo.mjs Agent OS is the repository Brain: source code and services for Memory Core, Knowledge Base, Active Hybrid GraphRAG, DreamService, Golden Path synthesis, A2A coordination, and Neural Link tooling.

Frontmatter

id	8472
title	Implement Lazy VDOM Cloning in Component Base
state	Closed
labels	bugairefactoringcore
assignees	tobiu
createdAt	Jan 9, 2026, 5:25 PM
updatedAt	Jan 9, 2026, 5:33 PM
githubUrl	https://github.com/neomjs/neo/issues/8472
author	tobiu
commentsCount	1
parentIssue	8469
subIssues	[]
subIssuesCompleted	0
subIssuesTotal	0
contentTrust
projected
quarantined	0
signals	[]
blockedBy	[]
blocking	[]
closedAt	Jan 9, 2026, 5:33 PM

Implement Lazy VDOM Cloning in Component Base

Closed v11.19.1/archive-v11-19-1-chunk-1 bugairefactoringcore

tobiu commented on Jan 9, 2026, 5:25 PM

Context: Neo.core.Base assigns an instance ID early in the constructor, triggering afterSetId. In Neo.component.Base, afterSetId calls ensureStableIds, which accesses this.vdom. Since initConfig (and mergeConfig) has not yet run, this.vdom returns the prototype's _vdom reference. Modifying this object (as ensureStableIds does) causes prototype pollution, affecting all subsequent instances of the class.

Goal: Modify the vdom getter in src/component/Base.mjs to implement lazy cloning.

Check if this._vdom is an own property (using Object.hasOwn).
If not, clone the prototype's _vdom onto the instance immediately.
Update mergeConfig to respect this lazy initialization (avoid double cloning if already done).

Verification: Add a regression test in test/playwright/unit/component/Base_PrototypePollution.spec.mjs that verifies:

Creating Instance A.
Creating Instance B.
Ensuring Instance B's VDOM does not contain Instance A's ID.

tobiu Jan 9, 2026, 5:32 PM

Input from Gemini 3 Pro:

✦ I have implemented the lazy VDOM cloning mechanism in src/component/Base.mjs.

Changes:

Modified the vdom getter to check for Object.hasOwn(this, '_vdom'). If missing, it immediately clones the prototype's _vdom to the instance.

This ensures that any early access to this.vdom (e.g., in afterSetId before initConfig) operates on a safe instance copy, preventing prototype pollution.

Verification:

Added a new regression test: test/playwright/unit/component/Base_PrototypePollution.spec.mjs.

The test explicitly reproduces the "early access" pattern and verifies that subsequent instances do not inherit the mutated VDOM ID.

Ran existing VDOM tests (AutoId.spec.mjs and button/Base.spec.mjs) to ensure no regressions. All passed.

Commit: 64cdb7694 (#8472)

tobiu cross-referenced by #8474 on Jan 9, 2026, 5:42 PM