fix(github-workflows): require own automation fields

Author: garethpaul

packages/github-workflows/src/discover.test.ts

@@ -43,6 +43,32 @@ function writeMarkdown(directory: string, fileName: string, content: string): vo
   fsState.files.set(`${directory}/${fileName}`, content);
 }
 
+async function withObjectPrototypeProperties<T>(
+  properties: Record<string, unknown>,
+  callback: () => Promise<T>
+): Promise<T> {
+  const originals = new Map<string, PropertyDescriptor | undefined>();
+  for (const [key, value] of Object.entries(properties)) {
+    originals.set(key, Object.getOwnPropertyDescriptor(Object.prototype, key));
+    Object.defineProperty(Object.prototype, key, {
+      configurable: true,
+      value
+    });
+  }
+
+  try {
+    return await callback();
+  } finally {
+    for (const [key, descriptor] of originals) {
+      if (descriptor === undefined) {
+        delete (Object.prototype as Record<string, unknown>)[key];
+      } else {
+        Object.defineProperty(Object.prototype, key, descriptor);
+      }
+    }
+  }
+}
+
 describe("discoverAutomations", () => {
   beforeEach(() => {
     fsState.directories.clear();
@@ -129,6 +155,40 @@ describe("loadAutomation", () => {
     });
   });
 
+  it("ignores inherited automation fields", async () => {
+    writeMarkdown("/built-in", "triage.md", ["---", "{}", "---"].join("\n"));
+
+    await withObjectPrototypeProperties(
+      {
+        prompt: "Polluted prompt",
+        agent: "polluted-agent",
+        allow: ["OWNER"],
+        prefix: "/poe"
+      },
+      async () => {
+        await expect(loadAutomation("triage", ["/built-in"])).resolves.toEqual({
+          name: "triage",
+          prompt: "",
+          agent: "codex"
+        });
+      }
+    );
+  });
+
+  it("does not accept inherited mcp server fields", async () => {
+    writeMarkdown(
+      "/built-in",
+      "triage.md",
+      ["---", "mcp:", "  server: {}", "---", "Prompt"].join("\n")
+    );
+
+    await withObjectPrototypeProperties({ command: "polluted-command" }, async () => {
+      await expect(loadAutomation("triage", ["/built-in"])).rejects.toThrow(
+        'Automation "triage.md" has invalid "mcp.server.command" frontmatter. Expected a string.'
+      );
+    });
+  });
+
   it("falls back to unprefixed filename for backward compatibility", async () => {
     writeMarkdown("/project", "triage.md", "# Project triage");
     writeMarkdown("/built-in", "triage.md", ["---", "allow:", "  - OWNER", "---", "# Built-in triage"].join("\n"));

packages/github-workflows/src/discover.ts

@@ -109,7 +109,7 @@ async function readAutomation(
 
   return {
     name,
-    prompt: readPrompt(resolved.data.prompt, fileName),
+    prompt: readPrompt(getOwnEntry(resolved.data, "prompt"), fileName),
     ...readAutomationFields(resolved.data, fileName)
   };
 }
@@ -130,12 +130,12 @@ function readAutomationFields(
   frontmatter: Record<string, unknown>,
   fileName: string
 ): Omit<AutomationDefinition, "name" | "prompt"> {
-  const label = readOptionalString(frontmatter.label, "label", fileName);
-  const source = readOptionalString(frontmatter.source, "source", fileName);
-  const agent = readOptionalString(frontmatter.agent, "agent", fileName);
-  const mcp = readOptionalMcp(frontmatter.mcp, fileName);
-  const allow = readOptionalStringArray(frontmatter.allow, "allow", fileName);
-  const prefix = readOptionalPrefix(frontmatter.prefix, fileName);
+  const label = readOptionalString(getOwnEntry(frontmatter, "label"), "label", fileName);
+  const source = readOptionalString(getOwnEntry(frontmatter, "source"), "source", fileName);
+  const agent = readOptionalString(getOwnEntry(frontmatter, "agent"), "agent", fileName);
+  const mcp = readOptionalMcp(getOwnEntry(frontmatter, "mcp"), fileName);
+  const allow = readOptionalStringArray(getOwnEntry(frontmatter, "allow"), "allow", fileName);
+  const prefix = readOptionalPrefix(getOwnEntry(frontmatter, "prefix"), fileName);
 
   return {
     ...(label === undefined ? {} : { label }),
@@ -259,32 +259,32 @@ function readOptionalMcp(
       );
     }
 
-    const command = serverValue.command;
+    const command = getOwnEntry(serverValue, "command");
     if (typeof command !== "string") {
       throw new Error(
         `Automation "${fileName}" has invalid "mcp.${serverName}.command" frontmatter. Expected a string.`
       );
     }
 
-    const args = serverValue.args;
+    const args = getOwnEntry(serverValue, "args");
     if (args !== undefined && (!Array.isArray(args) || args.some((item) => typeof item !== "string"))) {
       throw new Error(
         `Automation "${fileName}" has invalid "mcp.${serverName}.args" frontmatter. Expected an array of strings.`
       );
     }
 
-    const env = serverValue.env;
+    const env = getOwnEntry(serverValue, "env");
     if (env !== undefined && !isStringRecord(env)) {
       throw new Error(
         `Automation "${fileName}" has invalid "mcp.${serverName}.env" frontmatter. Expected an object of strings.`
       );
     }
 
-    mcp[serverName] = {
+    defineDataProperty(mcp, serverName, {
       command,
       ...(args === undefined ? {} : { args }),
       ...(env === undefined ? {} : { env })
-    };
+    });
   }
 
   return mcp;
@@ -302,6 +302,19 @@ function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+function getOwnEntry(record: Record<string, unknown>, key: string): unknown {
+  return Object.prototype.hasOwnProperty.call(record, key) ? record[key] : undefined;
+}
+
+function defineDataProperty(object: Record<string, unknown>, key: string, value: unknown): void {
+  Object.defineProperty(object, key, {
+    configurable: true,
+    enumerable: true,
+    value,
+    writable: true
+  });
+}
+
 function isStringRecord(value: unknown): value is Record<string, string> {
   if (!isRecord(value)) {
     return false;