Harden debug option normalization against trap getters

Co-authored-by: Shri Sukhani <shrisukhani@users.noreply.github.com>

Author: cursoragent

currentState.md

@@ -144,6 +144,7 @@ HyperAgent exposes a TypeScript SDK for browser automation with three primary pa
 - Hardened CDP frame-filter URL normalization to support protocol-relative and scheme-less frame URLs while avoiding path-only false positives in host-based ad-domain detection.
 - Refined CDP frame-filter URL normalization to correctly handle scheme-less `host:port` URLs (without misclassifying them as custom schemes), preserving ad-domain detection coverage in those cases.
 - Tightened frame-filter query-signal policy so tracking query parameters are treated as strong signals only for parseable URL contexts, preventing path-only query strings from being over-filtered.
+- Hardened global debug-option storage by normalizing option payloads to plain boolean fields at set-time, preventing trap-prone debug option getters from leaking into runtime reads.
 - Hardened prompt base-message materialization with trap-safe array reads so malformed/trap-prone seed message arrays no longer crash message assembly and readable entries are preserved.
 - Hardened constructor custom-action ingestion with trap-safe array reads so unreadable custom-action entries are skipped while valid entries continue to register.
 - Expanded top-level package exports for key workflow/config types at `@hyperbrowser/agent`.

src/debug/options.test.ts

@@ -0,0 +1,70 @@
+import { getDebugOptions, setDebugOptions } from "@/debug/options";
+
+describe("debug options", () => {
+  beforeEach(() => {
+    setDebugOptions(undefined, false);
+  });
+
+  it("stores boolean debug flags and enabled state", () => {
+    setDebugOptions(
+      {
+        cdpSessions: true,
+        traceWait: false,
+        profileDomCapture: true,
+        structuredSchema: false,
+      },
+      true
+    );
+
+    expect(getDebugOptions()).toEqual({
+      cdpSessions: true,
+      traceWait: false,
+      profileDomCapture: true,
+      structuredSchema: false,
+      enabled: true,
+    });
+  });
+
+  it("ignores non-boolean debug option values", () => {
+    setDebugOptions(
+      {
+        cdpSessions: true,
+        traceWait: "true" as unknown as boolean,
+      },
+      false
+    );
+
+    expect(getDebugOptions()).toEqual({
+      cdpSessions: true,
+      enabled: false,
+    });
+  });
+
+  it("omits trap-prone debug option getters without throwing", () => {
+    const trappedOptions = new Proxy(
+      {
+        cdpSessions: true,
+      },
+      {
+        get: (target, prop, receiver) => {
+          if (prop === "traceWait") {
+            throw new Error("traceWait trap");
+          }
+          return Reflect.get(target, prop, receiver);
+        },
+      }
+    );
+
+    expect(() =>
+      setDebugOptions(
+        trappedOptions as unknown as Parameters<typeof setDebugOptions>[0],
+        true
+      )
+    ).not.toThrow();
+
+    expect(getDebugOptions()).toEqual({
+      cdpSessions: true,
+      enabled: true,
+    });
+  });
+});

src/debug/options.ts

@@ -5,14 +5,46 @@ export interface HyperAgentDebugOptions {
   structuredSchema?: boolean;
 }
 
+const DEBUG_OPTION_KEYS: ReadonlyArray<keyof HyperAgentDebugOptions> = [
+  "cdpSessions",
+  "traceWait",
+  "profileDomCapture",
+  "structuredSchema",
+];
+
 let currentDebugOptions: HyperAgentDebugOptions = {};
 let debugOptionsEnabled = false;
 
+function safeReadOptionField(
+  options: unknown,
+  key: keyof HyperAgentDebugOptions
+): unknown {
+  if (!options || (typeof options !== "object" && typeof options !== "function")) {
+    return undefined;
+  }
+  try {
+    return (options as Record<string, unknown>)[key];
+  } catch {
+    return undefined;
+  }
+}
+
+function normalizeDebugOptions(options?: HyperAgentDebugOptions): HyperAgentDebugOptions {
+  const normalized: HyperAgentDebugOptions = {};
+  for (const key of DEBUG_OPTION_KEYS) {
+    const value = safeReadOptionField(options, key);
+    if (typeof value === "boolean") {
+      normalized[key] = value;
+    }
+  }
+  return normalized;
+}
+
 export function setDebugOptions(
   options?: HyperAgentDebugOptions,
   enabled = false
 ): void {
-  currentDebugOptions = options ?? {};
+  currentDebugOptions = normalizeDebugOptions(options);
   debugOptionsEnabled = enabled;
 }