Addresses cubic-dev-ai P1 review: Object.hasOwn() alone doesn't prevent
a crafted '__proto__' agent name from mutating the result object's
prototype chain. Using Object.create(null) eliminates inherited properties
entirely, making both the hasOwn checks and property assignments safe.
Addresses cubic-dev-ai review: using 'in' on plain objects can skip valid
agent names that match inherited properties (toString, constructor, etc.).
Switched both occurrences in opencode-config-agents-reader.ts to
Object.hasOwn() for safe own-property checks.
- Case-insensitive .md extension stripping for agent name extraction
- Resolve project agent_definitions paths relative to config dir (.opencode/)
- Use getOpenCodeConfigDir() to respect OPENCODE_CONFIG_DIR/XDG_CONFIG_HOME
- First-write-wins semantics for both inline and definition-file agents
so project-level agents always take precedence over global-level
- Modified agent-config-handler.ts to load and integrate both new agent sources
- Added loadAgentDefinitions() and readOpencodeConfigAgents() calls in loading phase
- Integrated both sources into agent precedence chains (both Sisyphus-enabled and disabled paths)
- Added detailed logging for new agent sources
- Added filtering logic to respect disabled_agents configuration
- Extended agent-config-handler.test.ts with 7 new integration tests
- All tests passing (18/18 integration, 65/65 loader suite)
Wave 3 of agent definitions enhancement complete.
Brandon Webb