Reject non-JSON capability objects

Author: JoviDeCroock

.changeset/capability-review-fixes.md

@@ -9,5 +9,6 @@ Harden capability dispatch and agent trust edge cases: normalize custom HTTP
 paths, fail closed for custom endpoints when registry resolution fails, stream
 agent-directory responses within the documented size cap, expose confirmation
 fields in browser types, preserve explicit null capability inputs, reject malformed
-schemas and inherited-property validation bypasses, honor middleware replacement
-responses, and keep test-host agent context aligned with production.
+schemas, inherited-property validation bypasses, and non-JSON object values, honor
+middleware replacement responses, and keep test-host agent context aligned with
+production.

packages/capabilities/src/schema.ts

@@ -341,5 +341,7 @@ function cloneJson<T>(value: T): T {
 }
 
 function isPlainObject(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
 }

packages/capabilities/test/schema.test.ts

@@ -55,6 +55,17 @@ describe("validateAgainstSchema", () => {
     expect(issues).toEqual([{ path: "/query", message: "must be of type string, got number" }]);
   });
 
+  it("rejects JavaScript objects outside the JSON data model", () => {
+    class Instance {}
+
+    for (const value of [new Date(), new Map(), new Instance()]) {
+      expect(validateAgainstSchema({ type: "object" }, value)).toEqual([
+        { path: "", message: "must be of type object, got object" },
+      ]);
+    }
+    expect(validateAgainstSchema({ type: "object" }, Object.create(null))).toEqual([]);
+  });
+
   it("enforces integer vs number", () => {
     expect(validateAgainstSchema(schema, { query: "x", limit: 1.5 })).toEqual([
       { path: "/limit", message: "must be of type integer, got number" },