7b:I[154500,[["$2",["$3","$4"],[14451,1389]],["$5",["$6","$7","$8","$9","$a","$b"],[40076,28925,10525,30632,7744,72054]]],"IconMark"] 78:Ta51,Fixes #121. ## What changes `getPath` (shared/core/schema/json/path.ts) validated the container type and then indexed `current[key]` directly. Plain property access walks the prototype chain, so: ```ts getPath({}, "$.constructor"); // Object [Function: Object] on main getPath({}, "$.toString"); // function toString() { ... } on main ``` Numeric traversal had the same gap: an array index set on `Object.prototype` (or `Array.prototype`) resolves through the chain and surfaces as payload data, violating the `Json` return contract that `utils.json.get` / `optionalGet` expose. Both traversal steps now require `Object.hasOwn` before indexing, so a path absent from the payload stays absent. Own members and own elements read exactly as before. ## Verification No deno on this host, so I ran the module itself under Node 26 with type stripping and a two-method `zod` stub (`z.string().regex`, `.refine` are the only calls the module makes at import time), comparing the vendored copy of `main` and the patched copy: | case | main | patched | |---|---|---| | `getPath({}, "$.constructor")` | inherited `Object` function | `undefined` | | `getPath({}, "$.toString")` | inherited `toString` function | `undefined` | | `getPath({ nested: {} }, "$.nested.constructor")` | inherited function | `undefined` | | `getPath({ a: [{}] }, "$.a[0].hasOwnProperty")` | inherited function | `undefined` | | `Object.prototype[0] = "inherited"`; `getPath({ a: [] }, "$.a[0]")` | `"inherited"` | `undefined` | | same pollution; `getPath({ a: ["own"] }, "$.a[0]")` | `"own"` | `"own"` | | `getPath({ cost: { total: 5 } }, "$.cost.total")` | `5` | `5` | | `getPath({}, "$.missing.deep")` | `undefined` | `undefined` | | `getPath({}, "$..recursive")` / `"$.results[*]"` | `undefined` (pattern guard) | `undefined` | The two new `Deno.test` cases in `shared/core/core.test.ts` mirror the first five rows (the prototype pollution is scoped and restored in a `finally`); I could not run `deno test` locally, so CI is the authoritative run for them. ## Summary by CodeRabbit * **Bug Fixes** * Path lookups now return no value for properties inherited from an object’s prototype, including inherited array indexes. Values directly present on objects and arrays continue to be returned as expected. This makes lookup results more predictable when navigating nested data and prevents inherited values from being mistaken for values explicitly provided in that data. 79:T375f,

No actionable comments were generated in the recent review.

Recent review info

Run configuration

- **Source mode**: Auto - **Repository**: [monid\-ai/monid](https://github.com/monid-ai/monid) - **Branch**: [main](https://github.com/monid-ai/monid/tree/main) - **File**: [.coderabbit.yaml](https://github.com/monid-ai/monid/blob/09d54479142e36eff876383beacfbd37b33b5908/.coderabbit.yaml) - **Commit**: [09d5447](https://github.com/monid-ai/monid/commit/09d54479142e36eff876383beacfbd37b33b5908) - **Layers**: Repository YAML - **Review profile**: CHILL - **Plan**: Advanced - **Run ID**: `115135ad-e882-4e92-847d-b3174ea2676e`

Commits

Reviewing files that changed from the base of the PR and between 09d54479142e36eff876383beacfbd37b33b5908 and 3e0ddf60190f35ac8ff98db4c672210dc1aaa4ac.

Files selected for processing: 2

* `shared/core/core.test.ts` * `shared/core/schema/json/path.ts`

**Included review availability:** This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

Walkthrough

`getPath` now returns `undefined` for inherited object members and array indexes. New tests verify that inherited values are ignored and own values remain accessible.

Priority: Low **Severity of issue fixed:** Low

Merge Risk: Minimal · up to 3e0dd

No merge\-blocking issue is evident, so this change is mergeable pending normal checks.

Pre-merge checks: 4

| Check name | Status | Explanation | |:-------------------------- |:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------:|:------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Description Check | ![Passed](https://cdn.trylle.com/media/images/9b9f7fc0af96c9889ff30dd8dc8752bd?key=Aec7YlhhL%2FWojK8gn54mkt9KD7Uvp%2B14YdVeU%2F7AOnbnO8x76NKhQn886i%2FCQT5dcj7%2FiiBjzzzUypazN2QvWoTYfhbCW723SX%2B0ZlbFieBXi1YY7J7gIBXHpKWTAj2Q4%2BCa4dgdBnn8d3HEdUGlUW2Xi%2BXlSDbHrrQTK5zYO2kQgyBp3%2BIaYZB2v57Hd07YU35qEgQV377f%2FXo0E72gVN4H6btm4nsvMaw%3D) | Check skipped \- CodeRabbit’s high\-level summary is enabled. | | Title check | ![Passed](https://cdn.trylle.com/media/images/9b9f7fc0af96c9889ff30dd8dc8752bd?key=Aec7YlhhL%2FWojK8gn54mkt9KD7Uvp%2B14YdVeU%2F7AOnbnO8x76NKhQn886i%2FCQT5dcj7%2FiiBjzzzUypazN2QvWoTYfhbCW723SX%2B0ZlbFieBXi1YY7J7gIBXHpKWTAj2Q4%2BCa4dgdBnn8d3HEdUGlUW2Xi%2BXlSDbHrrQTK5zYO2kQgyBp3%2BIaYZB2v57Hd07YU35qEgQV377f%2FXo0E72gVN4H6btm4nsvMaw%3D) | The title clearly and concisely describes the main change: inherited members are treated as absent during JSONPath lookup. | | Linked Issues check | ![Passed](https://cdn.trylle.com/media/images/9b9f7fc0af96c9889ff30dd8dc8752bd?key=Aec7YlhhL%2FWojK8gn54mkt9KD7Uvp%2B14YdVeU%2F7AOnbnO8x76NKhQn886i%2FCQT5dcj7%2FiiBjzzzUypazN2QvWoTYfhbCW723SX%2B0ZlbFieBXi1YY7J7gIBXHpKWTAj2Q4%2BCa4dgdBnn8d3HEdUGlUW2Xi%2BXlSDbHrrQTK5zYO2kQgyBp3%2BIaYZB2v57Hd07YU35qEgQV377f%2FXo0E72gVN4H6btm4nsvMaw%3D) | Issue `#121` requires that getPath return undefined for inherited object members and array indices, and that traversal use only own members and own elements. The whole\-PR diff (mergeBase 09d5447 to head… | | Out of Scope Changes check | ![Passed](https://cdn.trylle.com/media/images/9b9f7fc0af96c9889ff30dd8dc8752bd?key=Aec7YlhhL%2FWojK8gn54mkt9KD7Uvp%2B14YdVeU%2F7AOnbnO8x76NKhQn886i%2FCQT5dcj7%2FiiBjzzzUypazN2QvWoTYfhbCW723SX%2B0ZlbFieBXi1YY7J7gIBXHpKWTAj2Q4%2BCa4dgdBnn8d3HEdUGlUW2Xi%2BXlSDbHrrQTK5zYO2kQgyBp3%2BIaYZB2v57Hd07YU35qEgQV377f%2FXo0E72gVN4H6btm4nsvMaw%3D) | The whole\-PR diff touches only shared/core/schema/json/path.ts and shared/core/core.test.ts. Every hunk in path.ts changes the ownership check in getPath, which is the defect named in `#121`. The test h… |

Full details: Linked Issues check

**Explanation** Issue `#121` requires that getPath return undefined for inherited object members and array indices, and that traversal use only own members and own elements. The whole\-PR diff (mergeBase 09d5447 to head 3e0ddf6) in shared/core/schema/json/path.ts adds Object.hasOwn checks at both traversal steps. The object\-member branch checks Object.hasOwn(current, key) before reading current[key]. The array\-index branch checks Object.hasOwn(current, index) before reading current[index]. Both branches return undefined when the check fails. Own reads are unchanged. Path validation via PATH\_PATTERN still runs first, and the existing container\-type checks remain. Regression coverage for `#121` is in shared/core/core.test.ts. The first test asserts getPath({}, "$.constructor") and getPath({}, "$.toString") return undefined, plus nested and array\-element inherited members. The second test sets Object.prototype[0] and asserts getPath({ a: [] }, "$.a[0]") returns undefined, with the prototype restored in a finally block. Own\-value assertions are included. The author states the tests were not run locally. The code evidence supports the behavior, but CI has not confirmed the test run.

Full details: Out of Scope Changes check

**Explanation** The whole\-PR diff touches only shared/core/schema/json/path.ts and shared/core/core.test.ts. Every hunk in path.ts changes the ownership check in getPath, which is the defect named in `#121`. The test hunks add regression coverage for the same defect. No unrelated behavior, refactoring, or API change appears in the diff. The changed comments describe the ownership rule and do not add unrelated scope.

- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts _{Comment `@coderabbitai help` to get the list of available commands.} 62:["$","$L75",null,{"entries":[{"key":["platform",{"userId":"anon"},"pulls","page",{"owner":"monid-ai","repo":"monid","pullNumber":207}],"data":{"repositoryId":"4088","detail":{"author":{"avatarUrl":"https://cdn.trylle.com/media/images/a6ff5eb12756bacea455c0ab4f75cdfd?key=Ad1tdHn%2FgFWR%2B1WnbDprk3t01rnDOo4EGMa8w%2Bl4RH7OtfiSYpqxN6GiZKvbjDopdhv95VV5BQDpTW%2F4Zbz%2FhlmvtMbO%2FirMo1AAtGY8OYTGJJZWeKUqrvVaMPcSFmcIHZG8116Ip4FqSbWBnOvQebWgv3I4oBo36cybnpf8gbYd1vfc%2B6kuVhTvaw%3D%3D","externalProvider":"github","login":"rahul05ranjan","type":"User","url":"https://github.com/rahul05ranjan"},"authorId":"11793455","baseRefName":"main","closedAt":null,"comments":2,"createdAt":"2026-10-27T11:25:52Z","headRefName":"rahul05ranjan/fix/jsonpath-inherited-members","id":"4957563","isDraft":false,"labels":[],"number":207,"repository":{"name":"monid","owner":"monid-ai","provider":"forgejo"},"state":"open","title":"fix(core): treat inherited members as absent in JSONPath lookup","updatedAt":"2026-10-27T12:32:46Z","url":"https://trylle.com/monid-ai/monid/pulls/207","body":"$78","additions":37,"deletions":2,"changedFiles":2,"commits":1,"reviewComments":1,"headSha":"3e0ddf60190f35ac8ff98db4c672210dc1aaa4ac","baseSha":"09d54479142e36eff876383beacfbd37b33b5908","headRepoOwner":"monid-ai","headRepoName":"monid","isMerged":false,"mergeCommitSha":null,"mergedBy":null,"mergeable":true,"mergeableState":"clean","conflictingFiles":null,"requestedTeams":[],"requestedReviewers":[],"graphqlId":"issue:207"},"comments":[{"id":27021358,"graphqlId":"27021358","body":"$79","createdAt":"2026-10-27T11:26:07Z","author":{"avatarUrl":"https://cdn.trylle.com/media/images/d39e0f17743c08d7bf625ba6f80c545a?key=Ac3dCIMfeEeTRToXUBeRdRfe7IGnH7FaknGcutnXETLNIDauVDMEeYfL%2BNJ1UW6PltLPYQ8AAbXVYTqKXZ2sbxmdR%2FJeAINpLPz%2Fgbhi3if42haJXKHU1rlVIjj4bCQzj6%2FWYhkNT360oU7wzsBjYZsV7FyaaYuuIlrb3O4TqxAm%2FsfmH46nFvfFacg%3D","externalProvider":"github","login":"coderabbitai[bot]","type":"Bot","url":"https://github.com/apps/coderabbitai"}}],"commits":[{"sha":"3e0ddf60190f35ac8ff98db4c672210dc1aaa4ac","message":"fix(core): treat inherited members as absent in JSONPath lookup\n\ngetPath indexed containers without an own-property check, so paths\nlike $.constructor and $.toString resolved Object.prototype members\nand a prototype-set array index could surface as payload data. Both\ntraversal steps now require Object.hasOwn, keeping every own-member\nand own-element read unchanged.\n\nFixes #121\n\nCo-authored-by: rahul05ranjan <11793455+rahul05ranjan@users.noreply.github.com>\n","createdAt":"2026-10-27T16:55:28+05:30","author":{"avatarUrl":"","login":"","name":"Rahul Ranjan","type":"User","url":""},"verification":{"verified":false,"reason":"gpg.error.not_signed_commit"}}],"events":[],"reviews":[{"id":3636343,"state":"REQUEST_REVIEW","author":{"avatarUrl":"https://cdn.trylle.com/media/images/1ec5c00f9995b5dc5ca35af1a0870887?key=AaIaiXNENNoLHWYsNT9HhOMffcuSHcUM0aNJr7rpnJJaybk8kOBUO0z9tl87uDS%2BldW83peTE%2B%2BpbIdbg6scl4vuXQQlVZvucTGYTNh7Bh99jjJ%2FK6zS2g9Vwtc%2B02qF4HsZBMLgEqny6b%2B7nWvpfnkQrM5bdVZ3uRDt4yIY2KCKwuHYv5ypOCsoz6I%3D","externalProvider":"github","login":"ooctoo777","type":"User","url":"https://github.com/ooctoo777"},"submittedAt":"2026-10-27T11:25:52Z","official":false}],"stackEvents":[],"commentPagination":{"totalCount":2,"perPage":30,"loadedPages":[1]},"eventPagination":{"loadedPages":[1],"hasMore":false},"headRefDeleted":false},"fetchedAt":1793524372757}],"children":"$L7a"}] 64:null 6b:[["$","title","0",{"children":"Commits · fix(core): treat inherited members as absent in JSONPath lookup · monid-ai/monid | Trylle"}],["$","meta","1",{"name":"description","content":"Commits on fix(core): treat inherited members as absent in JSONPath lookup (#207) in monid-ai/monid."}],["$","meta","2",{"name":"application-name","content":"Trylle"}],["$","link","3",{"rel":"manifest","href":"/manifest.json","crossOrigin":"$undefined"}],["$","meta","4",{"name":"keywords","content":"Commits · fix(core): treat inherited members as absent in JSONPath lookup · monid-ai/monid, monid-ai/monid, monid-ai/monid repository, monid, TypeScript repository, source code, trylle, agent-native git platform, git platform for agents and humans, git platform for ai agents, coding agent pull requests, ai code review, repository automation, stacked pull requests, two-way github sync, github-compatible actions, try cli"}],["$","meta","5",{"name":"robots","content":"index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1"}],["$","meta","6",{"name":"mobile-web-app-capable","content":"yes"}],["$","meta","7",{"name":"googlebot","content":"index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1"}],["$","meta","8",{"name":"twitter:domain","content":"trylle.com"}],["$","meta","9",{"name":"twitter:url","content":"https://trylle.com/monid-ai/monid/pulls/207/commits"}],["$","link","10",{"rel":"canonical","href":"https://trylle.com/monid-ai/monid/pulls/207/commits"}],["$","meta","11",{"name":"format-detection","content":"telephone=no"}],["$","meta","12",{"name":"mobile-web-app-capable","content":"yes"}],["$","meta","13",{"name":"apple-mobile-web-app-title","content":"Trylle"}],["$","meta","14",{"name":"apple-mobile-web-app-status-bar-style","content":"black-translucent"}],["$","meta","15",{"property":"og:title","content":"Commits · fix(core): treat inherited members as absent in JSONPath lookup · monid-ai/monid | Trylle"}],["$","meta","16",{"property":"og:description","content":"Commits on fix(core): treat inherited members as absent in JSONPath lookup (#207) in monid-ai/monid."}],["$","meta","17",{"property":"og:url","content":"https://trylle.com/monid-ai/monid/pulls/207/commits"}],["$","meta","18",{"property":"og:site_name","content":"Trylle"}],["$","meta","19",{"property":"og:locale","content":"en_US"}],["$","meta","20",{"property":"og:image","content":"https://trylle.com/api/og.png?kind=repo&owner=monid-ai&repo=monid"}],["$","meta","21",{"property":"og:image:secure_url","content":"https://trylle.com/api/og.png?kind=repo&owner=monid-ai&repo=monid"}],["$","meta","22",{"property":"og:image:type","content":"image/png"}],["$","meta","23",{"property":"og:image:width","content":"1200"}],["$","meta","24",{"property":"og:image:height","content":"630"}],["$","meta","25",{"property":"og:image:alt","content":"monid-ai/monid repository preview on Trylle"}],["$","meta","26",{"property":"og:type","content":"website"}],["$","meta","27",{"name":"twitter:card","content":"summary_large_image"}],["$","meta","28",{"name":"twitter:site","content":"@trylle"}],["$","meta","29",{"name":"twitter:title","content":"Commits · fix(core): treat inherited members as absent in JSONPath lookup · monid-ai/monid | Trylle"}],["$","meta","30",{"name":"twitter:description","content":"Commits on fix(core): treat inherited members as absent in JSONPath lookup (#207) in monid-ai/monid."}],["$","meta","31",{"name":"twitter:image","content":"https://trylle.com/api/og.png?kind=repo&owner=monid-ai&repo=monid"}],["$","meta","32",{"name":"twitter:image:alt","content":"monid-ai/monid repository preview on Trylle"}],["$","link","33",{"rel":"icon","href":"/favicon.png","type":"image/png"}],["$","link","34",{"rel":"icon","href":"/favicon-white.png","type":"image/png","media":"(prefers-color-scheme: dark)"}],["$","link","35",{"rel":"apple-touch-icon","href":"/logo192.png"}],["$","$L7b","36",{}]]

Commits on Tue, Oct 27, 2026