[dezren39]

Problem

Variant.resolve (packages/core/src/variant.ts) read the plain-object PROTOCOLS table with PROTOCOLS[model.package], where model.package is externally supplied (model/catalog config). A package named constructor / toString / __proto__ resolves through the prototype chain to an inherited truthy value instead of missing, so the if (!protocol) return [] guard does not fire and the inherited function gets called as a protocol factory.

Fixes #862 (filed from the #833 prototype-chain audit, queue task 3141).

Fix

Own-property read with an explanatory comment, on the queue lane's branch queue/3393-862-variant-protocols (queue task 3393; head d0dd344):

const protocol =
  model.package === undefined
    ? undefined
    : Object.hasOwn(PROTOCOLS, model.package)
      ? PROTOCOLS[model.package]
      : undefined

Provenance, corrected: this PR was opened by issue-sweep-rotating, which picked #862 up believing queue task 3393 was queued; the sweep's cancel call in fact failed because the task was already claimed, and the queue worker was implementing this branch in parallel. The worker adopted this PR (note on #862, 2026-10-29T12:35Z) and parked task 3393 on its CI — so there is exactly one PR for the fix, owned by the queue lane. A duplicate sweep branch was pushed briefly during the overlap and has been deleted.

Tests

New regression test in packages/core/test/variant.test.ts: package names constructor, toString, __proto__, hasOwnProperty, valueOf resolve to no variants (effort and toggle supports).

Verified on the laptop on this branch's head (d0dd344): variant suite 18 pass / 0 fail, 78 expect() calls. The same test was also verified failing pre-fix (17 pass / 1 fail) against unpatched main during the sweep's parallel attempt.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 22 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 483f69e8-3e4c-4c7b-a109-5bb8e524e1a2

Commits

Reviewing files that changed from the base of the PR and between 5664199 and d0dd344.

Files selected for processing: 2

• packages/core/src/variant.ts
• packages/core/test/variant.test.ts

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-29T12:33:29.851549Z	d0dd344	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[dezren39]

Queue reconciliation (Lane A, task 3393): task 3393 is NOT cancelled in the queue — it is live-claimed by repo-worker-opencode (Lane A shift, lease verified 2026-10-29T12:35Z) and the fix on this branch was authored under that claim this shift (laptop worktree ~/git/fleet/3393-862-variant-protocols; variant suite 18/18 with the fix, new test fails pre-fix, core typecheck pass).

This PR (#878, branch queue/3393-862-variant-protocols) is the only PR for #862 and is the queue task's canonical PR — no duplicate exists. Lane A is parking task 3393 on this PR's CI: when checks are green, merge (merge commit), confirm #862 closed, clean labels, and complete task 3393 through the queue. Sweep: thanks for verifying and opening — please leave the merge/close-out to the queue lane to avoid a double shepherd.

[github-actions]

This PR doesn't fully meet our contributing guidelines and PR template.

What needs to be fixed:

• PR description is missing required template sections. Please use the PR template.

Please edit this PR description to address the above within 72 hours, or it will be automatically closed.

If you believe this was flagged incorrectly, please let a maintainer know.