sdks/node/src/proxies/canonical.ts (1)

35-41: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick win

Exotic objects (Date, Map, Set, RegExp) silently canonicalize as {} instead of throwing.

The generic typeof value === "object" branch (Line 35) catches anything that isn't an array, including Date, Map, Set, RegExp, etc. Object.entries() on these yields no own enumerable properties, so they all silently canonicalize to "{}" rather than hitting the final "must be JSON-serializable" throw at Line 42. Since this is the deterministic signing form for the cross-SDK HMAC contract, any future ProxyHandler that puts such a value into a reference field would get a canonical form that discards the actual value's identity — two different Dates would sign identically.

Consider guarding for plain objects only (e.g. checking the prototype is Object.prototype or null) and throwing otherwise, consistent with the primitive rejection already in place.

🛡️ Proposed fix to reject non-plain objects

   if (typeof value === "object") {
+    const proto = Object.getPrototypeOf(value);
+    if (proto !== Object.prototype && proto !== null) {
+      throw new ProxyError(
+        `proxy reference values must be plain JSON-serializable objects, got ${value?.constructor?.name ?? typeof value}`,
+      );
+    }
     const entries = Object.entries(value as Record<string, unknown>)
       .filter(([, v]) => v !== undefined)
       .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
       .map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`);
     return `{${entries.join(",")}}`;
   }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@sdks/node/src/proxies/canonical.ts` around lines 35 - 41, The canonicalJson
object branch in canonical.ts is too broad and currently treats exotic objects
like Date, Map, Set, and RegExp as plain objects, which makes them serialize to
"{}" instead of failing. Tighten the typeof value === "object" path in
canonicalJson to accept only plain objects (for example by checking the
prototype is Object.prototype or null) and route all other object types to the
existing non-JSON-serializable rejection, so ProxyHandler reference values
cannot lose identity during signing.

sdks/node/src/index.ts (1)

34-35: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Minor style inconsistency: split type/value exports.

Other modules in this file combine type and value exports from the same specifier in one statement (e.g. Line 2: export { type DashboardAuth, type DashboardOptions, serveDashboard } from "./dashboard";). The proxies exports are split into two separate export/export type statements from the same "./proxies" module instead.

♻️ Optional consolidation for consistency

-export type { ProxyHandler, ProxyRef } from "./proxies";
-export { canonicalJson, FileProxyHandler, FileReference, Proxies } from "./proxies";
+export {
+  canonicalJson,
+  FileProxyHandler,
+  FileReference,
+  Proxies,
+  type ProxyHandler,
+  type ProxyRef,
+} from "./proxies";

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@sdks/node/src/index.ts` around lines 34 - 35, The proxies exports in index.ts
are split across separate type and value statements, unlike the other combined
exports in this file. Update the "./proxies" re-exports to match the existing
style by consolidating ProxyHandler and ProxyRef with the value exports in a
single export statement, keeping the same symbols (ProxyHandler, ProxyRef,
canonicalJson, FileProxyHandler, FileReference, Proxies) and preserving their
type/value distinctions.