@moxxy/sdk 0.14.5 → 0.15.1

package/src/elision-state.ts

@@ -71,34 +71,34 @@ const EMPTY_STATE: ElisionState = {
 };
 
 /**
- * Single-slot memo of the most recent {@link computeElisionState} result,
- * keyed on the IDENTITY of the events array it was folded from.
+ * Memo of {@link computeElisionState} results, keyed on the IDENTITY of the
+ * events array each was folded from.
  *
  * The event log is append-only and every held event is immutable (invariant
  * #6: events at/below the HWM never change), so a given snapshot array is a
  * stable, never-mutated value: the same array reference always denotes the
  * same content and therefore the same state. A new turn produces a NEW snapshot
- * array (the live `log.slice()` returns a fresh array each call), so the memo
- * self-invalidates the moment the log changes — there is no way for it to serve
- * a state that is stale for the array it is keyed on.
+ * array (the live `log.slice()` returns a fresh array each call), so a stale
+ * array key simply falls out of use — there is no way for an entry to serve a
+ * state that is stale for the array it is keyed on.
  *
  * Keying on identity (not a content hash of `id`/`seq`/payload) is the only
- * SOUND single-slot choice for a pure fold over an arbitrary array: two
- * logically-different logs can share ids/seqs (e.g. a test that rebuilds the
- * same prefix with different payload, or a re-config), and a content hash that
- * missed a payload field would serve a stale state — a correctness bug. Array
- * identity can never collide across distinct values.
+ * SOUND choice for a pure fold over an arbitrary array: two logically-different
+ * logs can share ids/seqs (e.g. a test that rebuilds the same prefix with
+ * different payload, or a re-config), and a content hash that missed a payload
+ * field would serve a stale state — a correctness bug. Array identity can never
+ * collide across distinct values.
  *
- * The win: callers that re-ask over the SAME snapshot within an iteration
- * (e.g. the elision/compaction gates and the estimate, when they thread the
- * one `log.slice()` array — see `estimateContextTokens`) fold it only once;
- * `WeakMap` would also help a held snapshot survive GC pressure, but a single
- * slot keeps it allocation-free and matches the "one live snapshot at a time"
- * access pattern. Threading a precomputed state is the explicit zero-cost fast
- * path; this memo covers callers that re-pass the same array but can't thread.
+ * A `WeakMap` (rather than a single global slot) survives interleaving: the
+ * runner serves multiple sessions in ONE process, so two sessions' iterations
+ * can alternate; a single slot would evict each other's memo on every call,
+ * serving ~zero hits and re-folding O(events) each time. The WeakMap holds an
+ * entry per live snapshot array and lets it be GC'd once the array is dropped,
+ * so concurrent sessions each keep their own hot snapshot. Threading a
+ * precomputed state stays the explicit zero-cost fast path; this memo covers
+ * callers that re-pass the same array but can't thread.
  */
-let memoEvents: ReadonlyArray<MoxxyEvent> | null = null;
-let memoState: ElisionState | null = null;
+const memo = new WeakMap<ReadonlyArray<MoxxyEvent>, ElisionState>();
 
 /**
  * Derive elision state purely from the log: the active high-water mark + flags
@@ -110,10 +110,10 @@ let memoState: ElisionState | null = null;
  * (and `===` on a cache hit) to a fresh fold.
  */
 export function computeElisionState(events: ReadonlyArray<MoxxyEvent>): ElisionState {
-  if (memoEvents === events && memoState !== null) return memoState;
+  const cached = memo.get(events);
+  if (cached !== undefined) return cached;
   const state = computeElisionStateUncached(events);
-  memoEvents = events;
-  memoState = state;
+  memo.set(events, state);
   return state;
 }
 

package/src/errors.test.ts

@@ -117,6 +117,18 @@ describe('classifyNetworkError', () => {
   it('returns null for non-network errors so other handlers can take over', () => {
     expect(classifyNetworkError(new Error('something else'))).toBeNull();
   });
+
+  it('does not throw on a malformed/relative ctx.url — degrades to the raw string', () => {
+    // A bad base URL must not make `new URL()` throw from inside the classifier
+    // and mask the real network error.
+    expect(() =>
+      classifyNetworkError(nodeFetchError('ECONNREFUSED'), { url: 'not a url' }),
+    ).not.toThrow();
+    const out = classifyNetworkError(nodeFetchError('ECONNREFUSED'), { url: '/relative/path' });
+    expect(out!.code).toBe('NETWORK_UNREACHABLE');
+    expect(out!.message).toContain('/relative/path');
+    expect(out!.context).toEqual({ url: '/relative/path' });
+  });
 });
 
 describe('classifyHttpStatus', () => {
@@ -148,6 +160,13 @@ describe('classifyHttpStatus', () => {
     expect(classifyHttpStatus(404)).toBeNull();
     expect(classifyHttpStatus(418)).toBeNull();
   });
+
+  it('does not throw on a malformed ctx.url — degrades to the raw string', () => {
+    expect(() => classifyHttpStatus(401, { url: 'not a url' })).not.toThrow();
+    const out = classifyHttpStatus(401, { url: 'not a url' });
+    expect(out!.code).toBe('AUTH_INVALID');
+    expect(out!.message).toContain('not a url');
+  });
 });
 
 describe('toFriendlyError', () => {

package/src/errors.ts

@@ -126,7 +126,7 @@ export function classifyNetworkError(
 
   const code = extractNodeErrorCode(err);
   const url = ctx.url;
-  const target = url ? new URL(url).host : (ctx.provider ?? 'the upstream service');
+  const target = url ? hostOf(url) : (ctx.provider ?? 'the upstream service');
   const baseContext: Record<string, string> = {};
   if (url) baseContext.url = url;
   if (ctx.provider) baseContext.provider = ctx.provider;
@@ -256,7 +256,7 @@ export function classifyHttpStatus(
   status: number,
   ctx: { readonly url?: string; readonly provider?: string; readonly body?: string } = {},
 ): MoxxyError | null {
-  const target = ctx.provider ?? (ctx.url ? new URL(ctx.url).host : 'the upstream service');
+  const target = ctx.provider ?? (ctx.url ? hostOf(ctx.url) : 'the upstream service');
   const tail = ctx.body ? ` — ${truncate(ctx.body, 200)}` : '';
   const context: Record<string, string | number> = { status };
   if (ctx.url) context.url = ctx.url;
@@ -305,6 +305,21 @@ export function classifyHttpStatus(
   return null;
 }
 
+/**
+ * Extract a URL's host for display. `url` is caller-supplied (provider base
+ * URLs, OAuth token URLs) and may be malformed/relative — `new URL()` would
+ * throw `ERR_INVALID_URL` from inside the error classifier, masking the real
+ * failure the caller is trying to report. Degrade gracefully to the raw string
+ * instead of throwing while classifying an error.
+ */
+function hostOf(url: string): string {
+  try {
+    return new URL(url).host;
+  } catch {
+    return url;
+  }
+}
+
 function truncate(s: string, max: number): string {
   if (s.length <= max) return s;
   return `${s.slice(0, max - 1)}…`;

package/src/index.ts

@@ -31,6 +31,7 @@ export type {
   PluginUnregisteredEvent,
   ModeIterationEvent,
   CompactionEvent,
+  ElisionEvent,
   ProviderRequestEvent,
   ProviderResponseEvent,
   ErrorEvent,
@@ -350,9 +351,11 @@ export type {
   ResolvedPluginManifest,
 } from './plugin.js';
 
+export { startChannelWith } from './channel.js';
 export type {
   Channel,
   ChannelHandle,
+  ChannelStartArgs,
   ChannelStartOptsBase,
   ChannelFactoryDeps,
   ChannelDef,

package/src/json-file-store.test.ts

@@ -115,6 +115,46 @@ describe('createJsonFileStore', () => {
     expect(leftovers).toEqual([]);
   });
 
+  it('keeps the in-memory cache consistent with disk when persist throws', async () => {
+    const s = store();
+    await s.mutate((items) => [...items, { id: 'a', n: 1 }]);
+
+    // A persist failure (BigInt can't JSON-serialize) must NOT advance the
+    // cache to the un-written phantom state — otherwise the next successful
+    // mutate would commit the failed write's mutation.
+    await expect(
+      s.mutate(() => [{ id: 'phantom', n: 1n as unknown as number }]),
+    ).rejects.toThrow();
+
+    // read() must still see the last durably-written state, not the phantom.
+    expect(await s.read()).toEqual([{ id: 'a', n: 1 }]);
+    expect(await s.get('phantom')).toBeNull();
+
+    // The next good mutate serializes from the last-good baseline (no phantom).
+    await s.mutate((items) => [...items, { id: 'b', n: 2 }]);
+    expect(await s.read()).toEqual([{ id: 'a', n: 1 }, { id: 'b', n: 2 }]);
+    const onDisk = JSON.parse(await readFile(file, 'utf8')) as { items: Item[] };
+    expect(onDisk.items).toEqual([{ id: 'a', n: 1 }, { id: 'b', n: 2 }]);
+  });
+
+  it('coalesces concurrent cold reads into a single load (no clobbering)', async () => {
+    await mkdir(join(dir, 'sub'), { recursive: true });
+    await writeFile(file, JSON.stringify({ version: 1, items: [{ id: 'a', n: 1 }] }), 'utf8');
+
+    let loadCalls = 0;
+    const s = createJsonFileStore<Item>({
+      file,
+      load: (raw) => {
+        loadCalls++;
+        return lenientLoad(raw);
+      },
+    });
+    // A burst of cold concurrent reads must share one load, not fan out into N.
+    const results = await Promise.all([s.read(), s.read(), s.read(), s.read()]);
+    for (const r of results) expect(r).toEqual([{ id: 'a', n: 1 }]);
+    expect(loadCalls).toBe(1);
+  });
+
   it('leaves the prior file intact when the atomic rename fails mid-write', async () => {
     const s = store();
     await s.mutate((items) => [...items, { id: 'a', n: 1 }]);

package/src/json-file-store.ts

@@ -65,7 +65,12 @@ export interface JsonFileStoreOptions<T extends { id: string }> {
  * id/createdAt minting and bespoke methods on top of {@link mutate}.
  */
 export interface JsonFileStore<T extends { id: string }> {
-  /** Loaded snapshot (a fresh shallow copy; safe to mutate by the caller). */
+  /**
+   * Loaded snapshot: a fresh shallow copy of the array (safe to add/remove/
+   * reorder). The item objects are shared with the live cache — do NOT mutate
+   * them in place; replace them with new objects instead, or a later unrelated
+   * `mutate()` will persist the drive-by change.
+   */
   read(): Promise<T[]>;
   /** Find a single item by id, or `null`. */
   get(id: string): Promise<T | null>;
@@ -95,10 +100,13 @@ export function createJsonFileStore<T extends { id: string }>(
   } = opts;
 
   let cache: T[] | null = null;
+  // In-flight load so a burst of concurrent cold reads coalesces into one
+  // filesystem read + one parse pass, and the second loader can't clobber the
+  // first's cache assignment with a stale/half-applied snapshot.
+  let loading: Promise<void> | null = null;
   const mutex: Mutex = createMutex();
 
-  async function ensureLoaded(): Promise<void> {
-    if (cache) return;
+  async function loadIntoCache(): Promise<void> {
     let raw: string | null;
     try {
       raw = await readFile(file, 'utf8');
@@ -115,6 +123,15 @@ export function createJsonFileStore<T extends { id: string }>(
     cache = await load(raw);
   }
 
+  function ensureLoaded(): Promise<void> {
+    if (cache) return Promise.resolve();
+    if (loading) return loading;
+    loading = loadIntoCache().finally(() => {
+      loading = null;
+    });
+    return loading;
+  }
+
   async function persist(items: T[]): Promise<void> {
     const payload = stringify({ ...fileFields, [itemsKey]: items });
     await writeFileAtomic(file, payload, writeOptions ?? {});
@@ -133,8 +150,12 @@ export function createJsonFileStore<T extends { id: string }>(
       await mutex.run(async () => {
         await ensureLoaded();
         const updated = await fn(cache!.slice());
-        cache = updated;
+        // Persist first so a write failure (ENOSPC/EACCES/EIO) leaves the
+        // in-memory cache consistent with disk — advancing the cache before the
+        // durable write would commit a phantom state on the next successful
+        // mutate and silently defeat the crash-atomic guarantee.
         await persist(updated);
+        cache = updated;
       });
     },
     invalidate(): void {

package/src/mode/collect-stream.ts

@@ -19,6 +19,24 @@ export interface CollectedToolUse {
   readonly input: unknown;
 }
 
+/** Sum two usage frames so multi-`message_end` responses don't undercount. */
+function addUsage(a: TokenUsage, b: TokenUsage): TokenUsage {
+  const cacheRead =
+    a.cacheReadTokens !== undefined || b.cacheReadTokens !== undefined
+      ? (a.cacheReadTokens ?? 0) + (b.cacheReadTokens ?? 0)
+      : undefined;
+  const cacheCreation =
+    a.cacheCreationTokens !== undefined || b.cacheCreationTokens !== undefined
+      ? (a.cacheCreationTokens ?? 0) + (b.cacheCreationTokens ?? 0)
+      : undefined;
+  return {
+    inputTokens: a.inputTokens + b.inputTokens,
+    outputTokens: a.outputTokens + b.outputTokens,
+    ...(cacheRead !== undefined ? { cacheReadTokens: cacheRead } : {}),
+    ...(cacheCreation !== undefined ? { cacheCreationTokens: cacheCreation } : {}),
+  };
+}
+
 export interface StreamResult {
   readonly text: string;
   readonly toolUses: ReadonlyArray<CollectedToolUse>;
@@ -123,9 +141,12 @@ export async function collectProviderStream(
   };
   const transformed = await ctx.hooks.dispatchBeforeProviderCall(req, {
     sessionId: ctx.sessionId,
-    cwd: '',
+    // Thread the session's real cwd/env (mirrored on ModeContext) so path-based
+    // policy/security `onBeforeProviderCall` hooks see the true per-session
+    // values rather than blank placeholders — matching the dispatchToolCall path.
+    cwd: ctx.cwd,
     log: ctx.log,
-    env: {},
+    env: ctx.env,
     turnId: ctx.turnId,
     iteration: opts.iteration ?? 0,
   });
@@ -181,7 +202,11 @@ export async function collectProviderStream(
         }
         case 'message_end': {
           stopReason = event.stopReason;
-          if (event.usage) usage = event.usage;
+          // Accumulate across frames: a provider that splits a response into
+          // multiple message segments (or emits an interim then a final usage)
+          // must not have its token counts clobbered to only the last frame —
+          // that would undercount input/output/cache tokens for billing.
+          if (event.usage) usage = usage ? addUsage(usage, event.usage) : event.usage;
           break;
         }
         case 'error': {
@@ -214,10 +239,15 @@ export async function collectProviderStream(
       }
     }
   } catch (err) {
-    error = {
-      message: err instanceof Error ? err.message : String(err),
-      retryable: false,
-    };
+    // A stream-level `error` event is the more authoritative classification —
+    // don't let a subsequent iterator throw downgrade its `retryable: true` to
+    // false (which would stop the turn loop from retrying a transient failure).
+    if (!error) {
+      error = {
+        message: err instanceof Error ? err.message : String(err),
+        retryable: false,
+      };
+    }
   }
 
   const finalToolUses: CollectedToolUse[] = [];

package/src/mode/project-messages.test.ts

@@ -1,12 +1,26 @@
 import { describe, expect, it } from 'vitest';
-import { projectUserPrompt, resolvedCallIdSet } from './project-messages.js';
+import { projectMessagesFromLog, projectUserPrompt, resolvedCallIdSet } from './project-messages.js';
 import { computeElisionState } from '../elision-state.js';
 import { asEventId, asSessionId, asTurnId } from '../ids.js';
-import type { MoxxyEvent, UserPromptEvent } from '../events.js';
+import type { EventLogReader } from '../log.js';
+import type { MoxxyEvent, MoxxyEventOfType, MoxxyEventType, UserPromptEvent } from '../events.js';
+import type { TurnId } from '../ids.js';
 
 const sid = asSessionId('s1');
 const t1 = asTurnId('t1');
 
+function reader(events: ReadonlyArray<MoxxyEvent>): EventLogReader {
+  return {
+    length: events.length,
+    at: (seq) => events[seq],
+    slice: (from = 0, to = events.length) => events.slice(from, to),
+    ofType: <T extends MoxxyEventType>(type: T): ReadonlyArray<MoxxyEventOfType<T>> =>
+      events.filter((e): e is MoxxyEventOfType<T> => e.type === type),
+    byTurn: (turnId: TurnId) => events.filter((e) => e.turnId === turnId),
+    toJSON: () => events,
+  };
+}
+
 // No-elision state — computeElisionState returns the empty/inactive state when
 // the log has no elision events, which is the only state these pure sub-steps
 // branch on for a fresh (non-stubbed) prompt.
@@ -119,3 +133,51 @@ describe('resolvedCallIdSet', () => {
     expect(set.has('later')).toBe(true);
   });
 });
+
+describe('projectMessagesFromLog tool_result stringify hardening', () => {
+  function logWith(output: unknown): MoxxyEvent[] {
+    return [
+      event(0, { type: 'user_prompt', turnId: t1, source: 'user', text: 'go' }),
+      event(1, {
+        type: 'tool_call_requested',
+        turnId: t1,
+        source: 'model',
+        callId: 'c1',
+        name: 'weird',
+        input: {},
+      }),
+      event(2, { type: 'tool_result', turnId: t1, source: 'tool', callId: 'c1', ok: true, output }),
+    ];
+  }
+
+  function toolResultText(events: MoxxyEvent[]): string {
+    const msgs = projectMessagesFromLog({ log: reader(events) });
+    const tr = msgs.find((m) => m.role === 'tool_result');
+    const block = tr?.content[0];
+    return block && block.type === 'tool_result' ? (block.content as string) : '';
+  }
+
+  it('does not throw on a circular tool_result output (would permanently wedge the turn)', () => {
+    const circular: Record<string, unknown> = { a: 1 };
+    circular.self = circular;
+    const events = logWith(circular);
+    expect(() => projectMessagesFromLog({ log: reader(events) })).not.toThrow();
+    // Re-projecting the same append-only log must also never throw.
+    expect(() => projectMessagesFromLog({ log: reader(events) })).not.toThrow();
+    expect(typeof toolResultText(events)).toBe('string');
+  });
+
+  it('does not throw on a BigInt-bearing tool_result output', () => {
+    const events = logWith({ n: 10n });
+    expect(() => projectMessagesFromLog({ log: reader(events) })).not.toThrow();
+    expect(typeof toolResultText(events)).toBe('string');
+  });
+
+  it('still serializes a plain object output as JSON', () => {
+    expect(toolResultText(logWith({ ok: true }))).toBe('{"ok":true}');
+  });
+
+  it('passes a string output through verbatim', () => {
+    expect(toolResultText(logWith('plain text'))).toBe('plain text');
+  });
+});

package/src/mode/project-messages.ts

@@ -13,6 +13,28 @@ import {
 } from '../elision-state.js';
 import { isToolDisplayResult } from '../tool-display.js';
 
+/**
+ * Stringify an arbitrary tool output for the model-facing tool_result text.
+ * `tool_result.output` is `unknown` and comes straight from whatever a tool
+ * returned, so it can be circular or contain a BigInt — either of which makes
+ * `JSON.stringify` THROW. Because projection runs on every request over the
+ * append-only log, an unguarded throw here permanently wedges the session
+ * (every subsequent re-projection re-throws). Mirrors the try/catch guard the
+ * sibling sizing paths (`safeJsonLen`, `toolResultBytes`) already use.
+ */
+function safeStringifyOutput(output: unknown): string {
+  if (typeof output === 'string') return output;
+  try {
+    return JSON.stringify(output ?? '');
+  } catch {
+    try {
+      return String(output ?? '');
+    } catch {
+      return '[unserializable tool output]';
+    }
+  }
+}
+
 /** Appended to the system prompt while elision is active (see projection). */
 export const ELISION_SYSTEM_NOTE =
   'Context note: to stay within budget, older turns may appear as stubs like ' +
@@ -449,7 +471,7 @@ export function projectMessages(
           // `forModel` summary — the structured `display` is for channels.
           text = e.output.forModel;
         } else {
-          text = typeof e.output === 'string' ? e.output : JSON.stringify(e.output ?? '');
+          text = safeStringifyOutput(e.output);
         }
         messages.push({
           role: 'tool_result',

package/src/mode/stable-hash.ts

@@ -2,19 +2,79 @@
  * Stable, key-order-canonical hash of a tool call's input, so `{a:1,b:2}` and
  * `{b:2,a:1}` produce the same key. Use for any "have I seen this call before"
  * comparison — a raw `JSON.stringify` is NOT order-stable.
+ *
+ * MUST be total: the input is a tool call's `input`, typed `unknown` and coming
+ * straight from whatever the provider deserialized (it can carry a BigInt, a
+ * circular reference, or a deeply nested structure). This hashes in the HOT
+ * tool-dispatch path (`detector.record` in tool-dispatch.ts), where an
+ * unhandled throw or a stack-overflow from unbounded recursion would crash the
+ * whole turn. So every leaf is serialized defensively, cycles are detected and
+ * collapsed to a stable marker, and recursion is depth-bounded.
  */
 export function stableHash(input: unknown): string {
-  return canonicalize(input);
+  try {
+    return canonicalize(input, new WeakSet(), 0);
+  } catch {
+    // Last-ditch guard: an exotic value (e.g. a Proxy whose ownKeys/get trap
+    // throws, or a getter that throws) could still surface a throw out of the
+    // recursive walk. Never let it escape into the hot tool-dispatch path —
+    // collapse to a stable opaque marker. Two such inputs hash equal, which at
+    // worst makes the stuck detector slightly more eager, never crashes.
+    return '"[unhashable]"';
+  }
+}
+
+// Bound recursion so a hostile/pathologically-nested input can't blow the stack
+// (the JS engine throws RangeError well before this, and a tool input that deep
+// is already degenerate for stuck-detection purposes — treat it as opaque).
+const MAX_DEPTH = 100;
+
+/** Serialize a primitive leaf without ever throwing (BigInt/symbol/etc.). */
+function leaf(value: unknown): string {
+  switch (typeof value) {
+    case 'string':
+      return JSON.stringify(value);
+    case 'number':
+      // JSON.stringify(NaN|±Infinity) is 'null'; keep that, but use a stable
+      // distinct token so two different non-finite values don't collide.
+      return Number.isFinite(value) ? String(value) : `#${String(value)}`;
+    case 'boolean':
+      return value ? 'true' : 'false';
+    case 'bigint':
+      // JSON.stringify THROWS on a BigInt — serialize it ourselves, tagged so a
+      // bigint and the equal-valued number never collide.
+      return `${value.toString()}n`;
+    case 'symbol':
+      return `@${String(value)}`;
+    case 'function':
+      return '"[fn]"';
+    default:
+      return 'null';
+  }
 }
 
-function canonicalize(value: unknown): string {
+function canonicalize(value: unknown, seen: WeakSet<object>, depth: number): string {
   if (value === null || value === undefined) return 'null';
-  if (typeof value !== 'object') return JSON.stringify(value);
-  if (Array.isArray(value)) {
-    return '[' + value.map(canonicalize).join(',') + ']';
+  if (typeof value !== 'object') return leaf(value);
+  // Cycle guard: a circular reference would recurse forever → stack overflow.
+  if (seen.has(value)) return '"[circular]"';
+  if (depth >= MAX_DEPTH) return '"[deep]"';
+  seen.add(value);
+  try {
+    if (Array.isArray(value)) {
+      return '[' + value.map((v) => canonicalize(v, seen, depth + 1)).join(',') + ']';
+    }
+    const entries = Object.entries(value as Record<string, unknown>).sort(([a], [b]) =>
+      a < b ? -1 : a > b ? 1 : 0,
+    );
+    return (
+      '{' +
+      entries.map(([k, v]) => JSON.stringify(k) + ':' + canonicalize(v, seen, depth + 1)).join(',') +
+      '}'
+    );
+  } finally {
+    // Allow the same object to appear in sibling positions (DAG, not a cycle)
+    // without being flagged circular — only ancestors are forbidden.
+    seen.delete(value);
   }
-  const entries = Object.entries(value as Record<string, unknown>).sort(
-    ([a], [b]) => (a < b ? -1 : a > b ? 1 : 0),
-  );
-  return '{' + entries.map(([k, v]) => JSON.stringify(k) + ':' + canonicalize(v)).join(',') + '}';
 }

package/src/mode.test.ts

@@ -17,4 +17,22 @@ describe('migrateModeName', () => {
     expect(migrateModeName('some-future-mode')).toBe('some-future-mode');
     expect(migrateModeName('')).toBe('');
   });
+
+  it('never leaks an inherited Object.prototype member for a polluting name', () => {
+    // `name` is externally-sourced; a bare object index would resolve these to
+    // truthy Functions and break the `string` contract. Each must pass through
+    // as its own identity string instead.
+    for (const polluting of [
+      'toString',
+      'valueOf',
+      'constructor',
+      'hasOwnProperty',
+      'isPrototypeOf',
+      '__proto__',
+    ]) {
+      const result = migrateModeName(polluting);
+      expect(typeof result).toBe('string');
+      expect(result).toBe(polluting);
+    }
+  });
 });

package/src/mode.ts

@@ -219,5 +219,11 @@ const LEGACY_MODE_NAMES: Readonly<Record<string, string>> = {
 
 /** Map a possibly-legacy mode name to its current name (identity if unknown). */
 export function migrateModeName(name: string): string {
-  return LEGACY_MODE_NAMES[name] ?? name;
+  // Own-property check: `name` is externally-sourced (config / preferences /
+  // setMode RPC). A bare `LEGACY_MODE_NAMES[name]` index would resolve inherited
+  // Object.prototype members (`toString`, `constructor`, `__proto__`, …) — all
+  // truthy Functions, so `?? name` would NOT fall through and the function would
+  // return a Function, breaking its `string` contract and shadowing a mode
+  // legitimately named `toString`.
+  return Object.hasOwn(LEGACY_MODE_NAMES, name) ? LEGACY_MODE_NAMES[name]! : name;
 }

package/src/provider-utils.test.ts

@@ -81,4 +81,14 @@ describe('zodToJsonSchema', () => {
     expect(out).toHaveProperty('type', 'object');
     expect(out).toHaveProperty('properties');
   });
+
+  it('bounds recursion on a deeply nested schema instead of overflowing the stack', () => {
+    // Build a pathologically deep array nesting; the converter must degrade to
+    // the permissive {} past its depth cap rather than blow the call stack.
+    let schema: z.ZodTypeAny = z.string();
+    for (let i = 0; i < 500; i++) schema = z.array(schema);
+    expect(() => zodToJsonSchema(schema)).not.toThrow();
+    const out = zodToJsonSchema(schema);
+    expect(out).toBeDefined();
+  });
 });