From cf4b23155376ed1afd1f56368e34e16be9c97e4d Mon Sep 17 00:00:00 2001
From: Brandon Webb <brandon.webb@vista.com>
Date: Tue, 14 Apr 2026 20:45:22 -0400
Subject: [PATCH] fix(agents): replace 'in' with Object.hasOwn() for
 prototype-safe property checks

Addresses cubic-dev-ai review: using 'in' on plain objects can skip valid
agent names that match inherited properties (toString, constructor, etc.).
Switched both occurrences in opencode-config-agents-reader.ts to
Object.hasOwn() for safe own-property checks.
---
 .../claude-code-agent-loader/opencode-config-agents-reader.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/features/claude-code-agent-loader/opencode-config-agents-reader.ts b/src/features/claude-code-agent-loader/opencode-config-agents-reader.ts
index 2859a361c..7a73d6b26 100644
--- a/src/features/claude-code-agent-loader/opencode-config-agents-reader.ts
+++ b/src/features/claude-code-agent-loader/opencode-config-agents-reader.ts
@@ -96,7 +96,7 @@ export function readOpencodeConfigAgents(directory: string): Record<string, Clau
 
       if (agentsToLoad && typeof agentsToLoad === "object") {
         for (const [agentName, agentData] of Object.entries(agentsToLoad)) {
-          if (agentName in result) continue
+          if (Object.hasOwn(result, agentName)) continue
           const converted = convertInlineAgent(agentData)
           if (converted) {
             result[agentName] = converted
@@ -113,7 +113,7 @@ export function readOpencodeConfigAgents(directory: string): Record<string, Clau
         const definitionAgents = loadAgentDefinitions(resolvedPaths, "opencode-config")
 
         for (const [name, config] of Object.entries(definitionAgents)) {
-          if (!(name in result)) {
+          if (!Object.hasOwn(result, name)) {
             result[name] = config
           }
         }