@frontmcp/plugin-codecall 1.7.1 → 1.7.2

package/esm/index.mjs

@@ -1962,6 +1962,7 @@ function assertNotSelfReference(toolName) {
 
 // plugins/plugin-codecall/src/utils/build-tool-namespaces.ts
 var IDENT_RE = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+var PROTOTYPE_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 var RESERVED_NAMESPACES = /* @__PURE__ */ new Set([
   "console",
   "Math",
@@ -1994,7 +1995,7 @@ var RESERVED_NAMESPACES = /* @__PURE__ */ new Set([
   "mcpNotify"
 ]);
 function buildToolNamespaces(tools, callTool) {
-  const namespaces = {};
+  const namespaces = /* @__PURE__ */ Object.create(null);
   const skipped = [];
   for (const tool of tools) {
     const name = tool?.name;
@@ -2010,11 +2011,15 @@ function buildToolNamespaces(tools, callTool) {
       skipped.push({ name, reason: "invalid-identifier" });
       continue;
     }
+    if (PROTOTYPE_KEYS.has(ns)) {
+      skipped.push({ name, reason: "prototype-key" });
+      continue;
+    }
     if (RESERVED_NAMESPACES.has(ns)) {
       skipped.push({ name, reason: "reserved-namespace" });
       continue;
     }
-    const bucket = namespaces[ns] ?? (namespaces[ns] = {});
+    const bucket = namespaces[ns] ?? (namespaces[ns] = /* @__PURE__ */ Object.create(null));
     if (Object.prototype.hasOwnProperty.call(bucket, method)) {
       skipped.push({ name, reason: "duplicate-method" });
       continue;

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-codecall",
-  "version": "1.7.1",
+  "version": "1.7.2",
   "description": "CodeCall plugin for FrontMCP - AgentScript-based meta-tools for orchestrating MCP tools",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -49,13 +49,13 @@
   },
   "dependencies": {
     "@enclave-vm/core": "^2.15.2",
-    "@frontmcp/protocol": "1.7.1",
-    "@frontmcp/sdk": "1.7.1",
+    "@frontmcp/protocol": "1.7.2",
+    "@frontmcp/sdk": "1.7.2",
     "vectoriadb": "^2.3.2"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.7.1",
-    "@frontmcp/plugin-cache": "1.7.1"
+    "@frontmcp/lazy-zod": "1.7.2",
+    "@frontmcp/plugin-cache": "1.7.2"
   },
   "devDependencies": {
     "reflect-metadata": "^0.2.2"

package/index.js

@@ -1999,6 +1999,7 @@ function assertNotSelfReference(toolName) {
 
 // plugins/plugin-codecall/src/utils/build-tool-namespaces.ts
 var IDENT_RE = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+var PROTOTYPE_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 var RESERVED_NAMESPACES = /* @__PURE__ */ new Set([
   "console",
   "Math",
@@ -2031,7 +2032,7 @@ var RESERVED_NAMESPACES = /* @__PURE__ */ new Set([
   "mcpNotify"
 ]);
 function buildToolNamespaces(tools, callTool) {
-  const namespaces = {};
+  const namespaces = /* @__PURE__ */ Object.create(null);
   const skipped = [];
   for (const tool of tools) {
     const name = tool?.name;
@@ -2047,11 +2048,15 @@ function buildToolNamespaces(tools, callTool) {
       skipped.push({ name, reason: "invalid-identifier" });
       continue;
     }
+    if (PROTOTYPE_KEYS.has(ns)) {
+      skipped.push({ name, reason: "prototype-key" });
+      continue;
+    }
     if (RESERVED_NAMESPACES.has(ns)) {
       skipped.push({ name, reason: "reserved-namespace" });
       continue;
     }
-    const bucket = namespaces[ns] ?? (namespaces[ns] = {});
+    const bucket = namespaces[ns] ?? (namespaces[ns] = /* @__PURE__ */ Object.create(null));
     if (Object.prototype.hasOwnProperty.call(bucket, method)) {
       skipped.push({ name, reason: "duplicate-method" });
       continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-codecall",
-  "version": "1.7.1",
+  "version": "1.7.2",
   "description": "CodeCall plugin for FrontMCP - AgentScript-based meta-tools for orchestrating MCP tools",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -49,13 +49,13 @@
   },
   "dependencies": {
     "@enclave-vm/core": "^2.15.2",
-    "@frontmcp/protocol": "1.7.1",
-    "@frontmcp/sdk": "1.7.1",
+    "@frontmcp/protocol": "1.7.2",
+    "@frontmcp/sdk": "1.7.2",
     "vectoriadb": "^2.3.2"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.7.1",
-    "@frontmcp/plugin-cache": "1.7.1"
+    "@frontmcp/lazy-zod": "1.7.2",
+    "@frontmcp/plugin-cache": "1.7.2"
   },
   "devDependencies": {
     "reflect-metadata": "^0.2.2"

package/utils/build-tool-namespaces.d.ts

@@ -20,7 +20,7 @@ export type ToolNamespaces = Record<string, ToolNamespace>;
  * Reasons a tool may be skipped during namespace generation. Returned so the
  * caller can surface diagnostics without re-deriving the rules.
  */
-export type NamespaceSkipReason = 'no-namespace-prefix' | 'invalid-identifier' | 'reserved-namespace' | 'duplicate-method';
+export type NamespaceSkipReason = 'no-namespace-prefix' | 'invalid-identifier' | 'reserved-namespace' | 'prototype-key' | 'duplicate-method';
 export interface BuildToolNamespacesResult {
     /** The namespaces object to merge into the VM globals. */
     namespaces: ToolNamespaces;
@@ -37,6 +37,8 @@ export interface BuildToolNamespacesResult {
  * - Tools whose name has no `.` are skipped (still callable via `callTool`).
  * - Tools whose prefix or suffix is not a valid JS identifier are skipped.
  * - Tools whose prefix collides with a reserved global are skipped.
+ * - Tools whose PREFIX is a prototype key (`__proto__`, `constructor`,
+ *   `prototype`) are skipped — they would write onto a JavaScript intrinsic.
  * - First registration wins on duplicate `{ns}.{method}` (subsequent are reported as skipped).
  *
  * The returned methods are thin wrappers that delegate to `callTool` with the

package/utils/build-tool-namespaces.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-tool-namespaces.d.ts","sourceRoot":"","sources":["../../src/utils/build-tool-namespaces.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AA8CjE;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO,EACd,OAAO,CAAC,EAAE,eAAe,KACtB,OAAO,CAAC,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;AAEhD;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,mFAAmF;AACnF,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AAE7G,0FAA0F;AAC1F,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAE3D;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAC3B,qBAAqB,GACrB,oBAAoB,GACpB,oBAAoB,GACpB,kBAAkB,CAAC;AAEvB,MAAM,WAAW,yBAAyB;IACxC,0DAA0D;IAC1D,UAAU,EAAE,cAAc,CAAC;IAC3B,+EAA+E;IAC/E,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,mBAAmB,CAAA;KAAE,CAAC,CAAC;CAC/D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,aAAa,CAAC,iBAAiB,CAAC,EACvC,QAAQ,EAAE,kBAAkB,GAC3B,yBAAyB,CAqC3B"}
+{"version":3,"file":"build-tool-namespaces.d.ts","sourceRoot":"","sources":["../../src/utils/build-tool-namespaces.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AA2DjE;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO,EACd,OAAO,CAAC,EAAE,eAAe,KACtB,OAAO,CAAC,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;AAEhD;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,mFAAmF;AACnF,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AAE7G,0FAA0F;AAC1F,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAE3D;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAC3B,qBAAqB,GACrB,oBAAoB,GACpB,oBAAoB,GACpB,eAAe,GACf,kBAAkB,CAAC;AAEvB,MAAM,WAAW,yBAAyB;IACxC,0DAA0D;IAC1D,UAAU,EAAE,cAAc,CAAC;IAC3B,+EAA+E;IAC/E,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,mBAAmB,CAAA;KAAE,CAAC,CAAC;CAC/D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,aAAa,CAAC,iBAAiB,CAAC,EACvC,QAAQ,EAAE,kBAAkB,GAC3B,yBAAyB,CAsD3B"}