@opencode/codemode 0.0.0-dev-19583 → 0.0.0-dev-19585

package/dist/data.d.ts

@@ -23,4 +23,4 @@ export declare const fromData: (protos: Prototypes, value: unknown, label: strin
  * dropped ("json") or become null ("result", for program results where the consumer must never see
  * undefined); a bare `undefined` follows the same rule.
  */
-export declare const toData: (value: unknown, label: string, undefinedAs?: "json" | "result") => unknown;
+export declare const toData: (value: unknown, label: string, undefinedAs?: "json" | "result", stripProto?: boolean) => unknown;

package/dist/data.js

@@ -28,9 +28,9 @@ export const fromData = (protos, value, label) => copy(value, label, "data", 0,
  * dropped ("json") or become null ("result", for program results where the consumer must never see
  * undefined); a bare `undefined` follows the same rule.
  */
-export const toData = (value, label, undefinedAs = "json") => copy(value, label, undefinedAs, 0, new Set());
-const copy = (value, label, mode, depth, seen, protos) => {
-    const next = (item) => copy(item, label, mode, depth + 1, seen, protos);
+export const toData = (value, label, undefinedAs = "json", stripProto = true) => copy(value, label, undefinedAs, 0, new Set(), undefined, stripProto);
+const copy = (value, label, mode, depth, seen, protos, stripProto = true) => {
+    const next = (item) => copy(item, label, mode, depth + 1, seen, protos, stripProto);
     if (depth > MAX_VALUE_DEPTH) {
         throw new ToolRuntimeError("InvalidDataValue", `${label} exceeds the maximum value depth of ${MAX_VALUE_DEPTH}.`);
     }
@@ -106,6 +106,8 @@ const copy = (value, label, mode, depth, seen, protos) => {
             defineHost(copied, "message", next(get(value, "message")));
         }
         for (const [key, item] of entries(value)) {
+            if (stripProto && key === "__proto__")
+                continue;
             const copiedItem = next(item);
             if (copiedItem === undefined && mode === "json")
                 continue;
@@ -141,6 +143,8 @@ const copy = (value, label, mode, depth, seen, protos) => {
     }
     const copied = {};
     for (const [key, item] of Object.entries(value)) {
+        if (stripProto && key === "__proto__")
+            continue;
         const copiedItem = next(item);
         if (copiedItem === undefined && mode === "json")
             continue;

package/dist/stdlib/json.js

@@ -53,7 +53,8 @@ const stringify = (runner, args) => {
                 .filter((item) => typeof item === "string" || typeof item === "number")
                 .map(String)
             : null;
-        return Effect.succeed(JSON.stringify(toData(args[0], "JSON.stringify value"), properties, indent));
+        // A string cannot pollute, so __proto__ stays: JSON.stringify includes own __proto__ keys, like JS.
+        return Effect.succeed(JSON.stringify(toData(args[0], "JSON.stringify value", "json", false), properties, indent));
     }
     // Validate up front; the replacer walk below reads the original value.
     toProgram(runner.prototypes, args[0], "JSON.stringify value");

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "@opencode/codemode",
-  "version": "0.0.0-dev-19583",
+  "version": "0.0.0-dev-19585",
   "description": "Effect-native confined code execution over schema-described tools",
   "type": "module",
   "license": "MIT",