Repository navigation
fix(core): WellKnown {env:} substitution reads through the prototype chain — "{env:constructor}" injects the Object function into remote-config URLs/headers #864
Description
Problem
packages/core/src/wellknown.ts:88: {env:NAME} substitution does variables[name] ?? process.env[name] ?? "" where variables is a caller-supplied plain Record<string,string> and name comes from a remote manifest's remote_config url/headers (remote-supplied). {env:constructor} resolves variables["constructor"] to the Object function through the prototype chain — the ?? "" fallback never fires and the function source is coerced into the fetched URL / headers. Same symptom class as #804, different file (the #804 fix covered packages/core/src/config/variable.ts only).
Found by the #833 prototype-chain class audit (triage, queue task 3141, main 71608cb 2026-10-29).
Fix shape
Own-property reads for both variables and process.env (match the fixed shape in config/variable.ts:107-108), or the shared guard from the #833 follow-up. Regression test: manifest url containing {env:constructor} with empty variables substitutes "" (or the real env value only when actually set).
agent-note:v1
state: filed
Agent: repo-worker-opencode (queue task 3141)
Found via: #833 sweep, pattern P-C (Record bracket read with ?? fallback)
Parent: #833
Activity
developing-today commentedon Oct 29, 2026
OPENCODE-204
dezren39 commentedon Oct 29, 2026
🤖 Dispatcher binding · openchamber-dispatcher run 2026-10-29 05:45 CDT
small_fix) ↔ issue fix(core): WellKnown {env:} substitution reads through the prototype chain — "{env:constructor}" injects the Object function into remote-config URLs/headers #864 (fix(core): WellKnown {env:} substitution reads through the prototype chain — "{env:constructor}" injects the Object function into remote-config URLs/headers)ses_e5e78b3cafeffeHnUJhprdY6ie(laptop OpenChamber, agent build) — the launch POST returned this id withpromptDispatched: true, the session activity registry independently shows it busy, and its messages engage this task directly (below).opencode-route/speed— the launch payload's model field was the fleet route id, per Drew's 2026-10-29 route-only rule; the route resolved server-side to opencode-go.personal muse-spark-1.3-contributor, xhigh). Fresh quota read this run ~05:47 CDT: opencode-go 5h 10.72% (reset 7:47 AM) / weekly 53.66% (reset Sun Nov 1 6:00 PM) / monthly 89.31% (reset Fri Nov 6 11:55 PM) — monthly ≥85%, named per the rule (under the used-to-100% rule the pool stays OPEN; only a known 100% closes) — plan quota only, never PAYG. Mechanical, well-specified own-property fix, effort/s, low risk, timebox 45m. Meta was NOT used: its quota read failed again this run ("No quota data in response", pool CLOSED per the per-pool gate).~/git/fleet/3396-864-wellknown-own-propertyon the laptop, branchqueue/3396-864-wellknown-own-property(from freshly fetched origin/main a6d7f78)variables[name] ?? process.env[name] ?? "", unguarded; fixed sibling shape at config/variable.ts using Object.hasOwn). The session's assistant messages show it editingpackages/core/src/wellknown.tsandpackages/core/test/wellknown.test.ts, adding prototype-name regression cases for url and header substitution ({env:constructor}/{env:toString}), running the wellknown tests on the laptop (5 pass per its report), and stash-verifying the new tests catch the original bug. Changes uncommitted at binding time; the session is briefed to commit, push, and open a PR referencing fix(core): WellKnown {env:} substitution reads through the prototype chain — "{env:constructor}" injects the Object function into remote-config URLs/headers #864 (no merge). The queue task itself remainsqueuedin the fleet queue (no targeted claim/binding verb exists yet — fix(script): stats.ts fetches have no deadline and buffer unbounded .json() bodies — PostHog, npm downloads, and the GitHub releases pager #1337/fix(changelog): read upstream changelog through a 1 MiB capped reader #1272); the owning lane reconciles/harvests from here, and the babysitter shepherds the session.dezren39 commentedon Oct 29, 2026
Checkpoint (queue task 3396):
Changed (branch
queue/3396-864-wellknown-own-property, PR #868):packages/core/src/wellknown.ts—resolveEntry's{env:}substitution now reads by own property for BOTHvariablesandprocess.env(Object.hasOwn(...) ? ... : undefined ?? ... ?? ""), following the fixed sibling shape inpackages/core/src/config/variable.ts(fix(core): ConfigVariable {env:} substitution reads through the prototype chain — "{env:constructor}" injects the Object function source and ":-" fallbacks are ignored for prototype names #804).{env:constructor}with empty variables now substitutes''instead of injecting theObjectfunction source into remote-config URLs/headers.packages/core/test/wellknown.test.ts— two regression tests: (1) prototype names (constructorin url,toStringin headers) resolve as unset and substitute real values when genuinely set as own properties; (2) realprocess.envvalues still substitute viawithEnv.Verification (laptop):
bun run script/test.ts test/wellknown.test.tsinpackages/core: 5 pass, 0 fail.bun typecheck(packages/core) clean; commit-hook full-repo lint+typecheck (36 turbo tasks) green.Not merged, per task discipline. Scope respected: no changes to
config/variable.ts, no shared-guard work (#865), no remote_config fetch/protocol changes.dezren39 commentedon Oct 29, 2026
🤖 Agent note · done — merged via PR #868
repo-worker-opencode), OpenChamber scheduled lane{env:}substitution inpackages/core/src/wellknown.tsnow resolves bothvariablesandprocess.envby own property (Object.hasOwn), so a remote manifest's{env:constructor}/{env:toString}substitutes""instead of injecting the inheritedObjectfunction source into the fetched URL or headers. Real env values still substitute.cbe84e94eeb7b1661cc8ad8db7575569385ea84a) — all checks green: basic unit (linux+windows), e2e (linux+windows), typecheck, affected packages, check-compliance, check-standards. Codex review: no findings.authorizationheader, plus a positive control that real values still substitute; CIbasic unitlinux+windows verified on the merged head.config/variable.ts(fix(core): ConfigVariable {env:} substitution reads through the prototype chain — "{env:constructor}" injects the Object function source and ":-" fallbacks are ignored for prototype names #804) and the shared guard helper (audit(core): shared own-property guard + regression net for prototype-chain dictionary reads (#833 follow-up) #865) were deliberately not touched.