From a91f3c5e69d13b91cc5997083222ca332b61a3d7 Mon Sep 17 00:00:00 2001
From: ghost <49853598+JSONbored@users.noreply.github.com>
Date: Tue, 9 Jun 2026 11:13:59 -0600
Subject: [PATCH] fix(cli): reject prototype agent profile names

---
 packages/gittensory-mcp/bin/gittensory-mcp.js | 5 ++---
 test/unit/mcp-cli.test.ts                     | 5 ++++-
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/packages/gittensory-mcp/bin/gittensory-mcp.js b/packages/gittensory-mcp/bin/gittensory-mcp.js
index 2733791183..2087bb2dcd 100755
--- a/packages/gittensory-mcp/bin/gittensory-mcp.js
+++ b/packages/gittensory-mcp/bin/gittensory-mcp.js
@@ -2004,9 +2004,8 @@ function initClient(options) {
 function resolveAgentProfile(profileId) {
   if (!profileId) return null;
   const id = String(profileId).trim().toLowerCase();
-  const profile = AGENT_PROFILES[id];
-  if (!profile) throw new Error(`Unsupported agent profile: ${profileId}. Use ${AGENT_PROFILE_IDS.join(", ")}.`);
-  return profile;
+  if (!Object.hasOwn(AGENT_PROFILES, id)) throw new Error(`Unsupported agent profile: ${profileId}. Use ${AGENT_PROFILE_IDS.join(", ")}.`);
+  return AGENT_PROFILES[id];
 }
 
 function formatAgentProfile(profile) {
diff --git a/test/unit/mcp-cli.test.ts b/test/unit/mcp-cli.test.ts
index 72e5401808..91359b9bd5 100644
--- a/test/unit/mcp-cli.test.ts
+++ b/test/unit/mcp-cli.test.ts
@@ -1106,7 +1106,10 @@ describe("gittensory-mcp CLI", () => {
   });
 
   it("rejects unsupported agent profiles", () => {
-    expect(() => run(["init-client", "--print", "codex", "--agent-profile", "autopilot"])).toThrow(/Unsupported agent profile/);
+    for (const profile of ["autopilot", "__proto__", "constructor"]) {
+      expect(() => run(["init-client", "--print", "codex", "--agent-profile", profile])).toThrow(/Unsupported agent profile/);
+      expect(() => run(["init-client", "--print", "codex", "--agent-profile", profile, "--json"])).toThrow(/Unsupported agent profile/);
+    }
   });
 
   it("reports the package version via version, --version, and -v", () => {