use Map for alias lookup to prevent prototype pollution, return undefined for non-Claude bare models

src/features/claude-code-agent-loader/claude-model-mapper.test.ts

@@ -79,12 +79,22 @@ describe("mapClaudeModelToOpenCode", () => {
   })
 
   describe("#given non-Claude bare model", () => {
-    it("#when called with gpt-5.2 #then normalizes dots without adding prefix", () => {
-      expect(mapClaudeModelToOpenCode("gpt-5.2")).toBe("gpt-5-2")
+    it("#when called with gpt-5.2 #then returns undefined", () => {
+      expect(mapClaudeModelToOpenCode("gpt-5.2")).toBeUndefined()
     })
 
-    it("#when called with gemini-3-flash #then returns unchanged", () => {
-      expect(mapClaudeModelToOpenCode("gemini-3-flash")).toBe("gemini-3-flash")
+    it("#when called with gemini-3-flash #then returns undefined", () => {
+      expect(mapClaudeModelToOpenCode("gemini-3-flash")).toBeUndefined()
+    })
+  })
+
+  describe("#given prototype property name", () => {
+    it("#when called with constructor #then returns undefined", () => {
+      expect(mapClaudeModelToOpenCode("constructor")).toBeUndefined()
+    })
+
+    it("#when called with toString #then returns undefined", () => {
+      expect(mapClaudeModelToOpenCode("toString")).toBeUndefined()
     })
   })
 

src/features/claude-code-agent-loader/claude-model-mapper.ts

@@ -2,11 +2,11 @@ import { normalizeModelID } from "../../shared/model-normalization"
 
 const ANTHROPIC_PREFIX = "anthropic/"
 
-const CLAUDE_CODE_ALIAS_MAP: Record<string, string> = {
-  sonnet: `${ANTHROPIC_PREFIX}claude-sonnet-4-6`,
-  opus: `${ANTHROPIC_PREFIX}claude-opus-4-6`,
-  haiku: `${ANTHROPIC_PREFIX}claude-haiku-4-5`,
-}
+const CLAUDE_CODE_ALIAS_MAP = new Map<string, string>([
+  ["sonnet", `${ANTHROPIC_PREFIX}claude-sonnet-4-6`],
+  ["opus", `${ANTHROPIC_PREFIX}claude-opus-4-6`],
+  ["haiku", `${ANTHROPIC_PREFIX}claude-haiku-4-5`],
+])
 
 export function mapClaudeModelToOpenCode(model: string | undefined): string | undefined {
   if (!model) return undefined
@@ -16,7 +16,7 @@ export function mapClaudeModelToOpenCode(model: string | undefined): string | un
 
   if (trimmed === "inherit") return undefined
 
-  const aliasResult = CLAUDE_CODE_ALIAS_MAP[trimmed.toLowerCase()]
+  const aliasResult = CLAUDE_CODE_ALIAS_MAP.get(trimmed.toLowerCase())
   if (aliasResult) return aliasResult
 
   if (trimmed.includes("/")) return trimmed
@@ -27,5 +27,5 @@ export function mapClaudeModelToOpenCode(model: string | undefined): string | un
     return `${ANTHROPIC_PREFIX}${normalized}`
   }
 
-  return normalized
+  return undefined
 }