fix(cli): reject prototype agent profile names

[JSONbored]

Motivation

• Fix a CLI validation bug where inherited prototype properties like __proto__ or constructor could be accepted as agent profiles and lead to malformed JSON or runtime TypeError crashes.
• Ensure agent profile resolution only accepts explicit registry keys to avoid accidental or malicious use of prototype names.

Description

• Replace plain bracket lookup in resolveAgentProfile with an own-property check using Object.hasOwn(AGENT_PROFILES, id) and then return AGENT_PROFILES[id] in packages/gittensory-mcp/bin/gittensory-mcp.js.
• Extend the unit test it("rejects unsupported agent profiles") in test/unit/mcp-cli.test.ts to assert that unsupported names including __proto__ and constructor are rejected in both plain and --json output modes.
• The change preserves existing error behavior and message when an unsupported profile is supplied.

Testing

• Ran npm run build:mcp which completed successfully.
• Ran targeted test npx vitest run test/unit/mcp-cli.test.ts -t "rejects unsupported agent profiles" which passed.
• Ran the full unit test file npx vitest run test/unit/mcp-cli.test.ts and all tests passed (52 passed, 0 failed for the suite run during verification).
• Manual CLI checks confirmed node packages/gittensory-mcp/bin/gittensory-mcp.js init-client --print codex --agent-profile __proto__ --json and --agent-profile constructor now exit with an error and print Unsupported agent profile: ... as expected.

---

Codex Task

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#507 is no longer open.	No action.

---

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	a91f3c5	Commit Preview URL Branch Preview URL	Jun 10 2026, 08:07 AM