fix(commands): guard command authorization preview lookups

[JSONbored]

Motivation

• Prevent a crash in the settings preview when untrusted commandName values that are inherited object properties (for example constructor, toString, __proto__) are indexed on normalized.commands and then passed to dedupeRoles, which caused a TypeError and availability impact.

Description

• Use Object.hasOwn(normalized.commands, commandName) before reading normalized.commands[commandName] so prototype properties do not get treated as command role arrays and instead fall back to normalized.default, and add unit coverage in test/unit/command-authorization.test.ts exercising inherited property names through commandAuthorizationAllowedRoles and evaluateCommandAuthorization.

Testing

• Ran npx vitest run test/unit/command-authorization.test.ts --pool=threads --reporter=default and npm run typecheck, both succeeded, and git diff --check reported no issues.

---

Codex Task

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#503 is no longer open.	No action.

---

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	0738737	Commit Preview URL Branch Preview URL	Jun 10 2026, 07:32 AM