docs(mcp): correct the safeCopy comment — unsafe keys are DROPPED, not rescued

PR #31 review (Copilot), documentation accuracy. The safeCopy JSDoc said it
"stops a key legitimately named __proto__ from silently vanishing into a setter,"
which reads as if such a key is preserved. It is not: the loop `continue`s on
__proto__/constructor/prototype, dropping them outright. The behavior is correct
(dropping is the safe choice, and such a name is meaningless as an env var and
unused as a top-level JSON-Schema keyword); only the comment mis-described it.

Reworded to say plainly that those keys are dropped, never copied, and that this
is a drop rather than a rescue — with the one-line rationale for why losing them
costs nothing.

Also strengthened the existing TRUST test to match the now-accurate contract: it
asserts up front that the input genuinely carries own __proto__/constructor keys
(so the drop path is provably exercised, not vacuous) and that they do not appear
in the output. Mutation-checked: removing the `continue` (i.e. copying the keys
through) fails the test. Full gate: 18 suites, 0 failures.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: ndemianc

extensions/levelcode-ai/mcpConfig.js

@@ -68,14 +68,19 @@ const UNSAFE_KEYS = ['__proto__', 'constructor', 'prototype'];
  * or a server-supplied `inputSchema`. JSON.parse creates a REAL own `__proto__` key, so a plain
  * Object.assign would hand it to the prototype setter instead of copying it. The string-value check in
  * normalizeServer already rejects the classic object-valued payload, which makes today's safety
- * incidental — this makes it structural, and stops a key legitimately named `__proto__` from silently
- * vanishing into a setter. Deliberately a normal object, not Object.create(null): later code (and
- * tests) may reasonably call hasOwnProperty on it.
+ * incidental — this makes it structural.
+ *
+ * The unsafe keys (`__proto__`/`constructor`/`prototype`) are DROPPED outright — never copied to the
+ * output — so none can reach the prototype setter. Note this is a drop, not a rescue: a key literally
+ * named `__proto__` does not survive into the result. That is deliberate. Such a name is meaningless as
+ * an env var and unused as a top-level JSON-Schema keyword, so losing it costs nothing, whereas copying
+ * it would be exactly the pollution we are guarding against. Deliberately a normal object, not
+ * Object.create(null): later code (and tests) may reasonably call hasOwnProperty on it.
  */
 function safeCopy(raw) {
 	const out = {};
 	for (const k of Object.keys(raw || {})) {
-		if (UNSAFE_KEYS.indexOf(k) !== -1) { continue; }
+		if (UNSAFE_KEYS.indexOf(k) !== -1) { continue; }   // dropped, not copied — see the doc above
 		out[k] = raw[k];
 	}
 	return out;

extensions/levelcode-ai/test/mcpConfig.test.js

@@ -105,16 +105,23 @@ test('ASSIGN: two servers that sanitize to the SAME name still get distinct tool
 	for (const t of tools) { assert.ok(LEGAL.test(t.name)); }
 });
 
-test('TRUST: an untrusted env can never reach the prototype setter', () => {
+test('TRUST: an untrusted env DROPS the unsafe keys and never reaches the prototype setter', () => {
 	// JSON.parse creates a REAL own "__proto__" key, so a plain Object.assign would hand it to the
-	// prototype setter instead of copying it. The string-value check already rejects the object-valued
-	// payload, but this makes the guarantee structural rather than incidental.
+	// prototype setter instead of copying it. safeCopy makes the guarantee structural — and it does so by
+	// DROPPING __proto__/constructor/prototype outright (not rescuing them): a key literally named
+	// __proto__ does not survive into the result. Assert both halves so the contract the JSDoc describes
+	// can't rot (PR #31 review flagged the doc implying preservation).
 	const raw = JSON.parse('{"evil":{"command":"x","env":{"__proto__":"pwned","constructor":"no","SAFE":"ok"}}}');
+	// Precondition: the input genuinely HAS these as own keys, so the drop path is actually exercised —
+	// otherwise the assertions below would pass vacuously.
+	assert.ok(Object.prototype.hasOwnProperty.call(raw.evil.env, '__proto__'), 'input must carry an own __proto__');
+	assert.ok(Object.prototype.hasOwnProperty.call(raw.evil.env, 'constructor'), 'input must carry an own constructor');
+
 	const { servers } = M.loadServerConfig({ settings: raw });
 	const env = servers[0].env;
 	assert.strictEqual(env.SAFE, 'ok', 'legitimate vars must survive');
-	assert.ok(!Object.prototype.hasOwnProperty.call(env, '__proto__'), '__proto__ must not be copied through');
-	assert.ok(!Object.prototype.hasOwnProperty.call(env, 'constructor'), 'constructor must not be copied through');
+	assert.ok(!Object.prototype.hasOwnProperty.call(env, '__proto__'), '__proto__ must be dropped, not copied through');
+	assert.ok(!Object.prototype.hasOwnProperty.call(env, 'constructor'), 'constructor must be dropped, not copied through');
 	assert.strictEqual(Object.getPrototypeOf(env), Object.prototype, 'the copy\'s prototype must not be retargeted');
 	// @ts-expect-error — probing for global pollution
 	assert.strictEqual({}.pwned, undefined, 'global Object.prototype must be untouched');