Harden constructor custom action ingestion against traps

Co-authored-by: Shri Sukhani <shrisukhani@users.noreply.github.com>

Author: cursoragent

currentState.md

@@ -143,6 +143,7 @@ HyperAgent exposes a TypeScript SDK for browser automation with three primary pa
 - Added constructor regression coverage for trap-prone `llm` config getters, ensuring fallback failure paths stay deterministic and readable.
 - Hardened CDP frame-filter URL normalization to support protocol-relative and scheme-less frame URLs while avoiding path-only false positives in host-based ad-domain detection.
 - Hardened prompt base-message materialization with trap-safe array reads so malformed/trap-prone seed message arrays no longer crash message assembly and readable entries are preserved.
+- Hardened constructor custom-action ingestion with trap-safe array reads so unreadable custom-action entries are skipped while valid entries continue to register.
 - Expanded top-level package exports for key workflow/config types at `@hyperbrowser/agent`.
 - Removed stale script entry (`build-dom-tree-script`) and improved README usage docs.
 - Added canonical single-action debug writer helper (`writePerformDebug`) while preserving deprecated alias compatibility.

src/agent/__tests__/hyperagent-constructor.test.ts

@@ -134,6 +134,62 @@ describe("HyperAgent constructor and task controls", () => {
     }
   });
 
+  it("continues constructor when customActions length getter traps", () => {
+    const trappedCustomActions = new Proxy(
+      [
+        {
+          type: "trappedAction",
+          actionParams: z.object({}),
+          run: async () => ({ success: true, message: "noop" }),
+        },
+      ],
+      {
+        get: (target, prop, receiver) => {
+          if (prop === "length") {
+            throw new Error("customActions length trap");
+          }
+          return Reflect.get(target, prop, receiver);
+        },
+      }
+    );
+
+    expect(
+      () =>
+        new HyperAgent({
+          llm: createMockLLM(),
+          customActions: trappedCustomActions as unknown as AgentActionDefinition[],
+        })
+    ).not.toThrow();
+  });
+
+  it("registers readable custom actions when some customActions entries trap", () => {
+    const safeAction: AgentActionDefinition = {
+      type: "safeAction",
+      actionParams: z.object({}),
+      run: async () => ({ success: true, message: "ok" }),
+    };
+    const trappedCustomActions = new Proxy([{}, safeAction], {
+      get: (target, prop, receiver) => {
+        if (prop === "0") {
+          throw new Error("customActions item trap");
+        }
+        return Reflect.get(target, prop, receiver);
+      },
+    });
+
+    const agent = new HyperAgent({
+      llm: createMockLLM(),
+      customActions: trappedCustomActions as unknown as AgentActionDefinition[],
+    });
+    const internalAgent = agent as unknown as {
+      actions: Array<{ type?: string }>;
+    };
+
+    expect(
+      internalAgent.actions.some((action) => action.type === "safeAction")
+    ).toBe(true);
+  });
+
   it("throws synchronously for reserved custom action names", () => {
     const reservedAction: AgentActionDefinition = {
       type: "complete",

src/agent/index.ts

@@ -365,6 +365,40 @@ export class HyperAgent<T extends BrowserProviders = "Local"> {
     }
   }
 
+  private safeArrayLength(value: unknown): number {
+    if (!Array.isArray(value)) {
+      return 0;
+    }
+    try {
+      const length = value.length;
+      if (!Number.isFinite(length) || length < 0) {
+        return 0;
+      }
+      return Math.floor(length);
+    } catch {
+      return 0;
+    }
+  }
+
+  private safeArrayValues<T>(value: unknown): T[] {
+    const length = this.safeArrayLength(value);
+    if (length === 0 || !Array.isArray(value)) {
+      return [];
+    }
+    const values: T[] = [];
+    for (let index = 0; index < length; index += 1) {
+      try {
+        const item = value[index] as T | undefined;
+        if (typeof item !== "undefined") {
+          values.push(item);
+        }
+      } catch {
+        continue;
+      }
+    }
+    return values;
+  }
+
   private async startBrowserProvider(): Promise<Browser> {
     const startMethod = this.safeReadField(this.browserProvider, "start");
     if (typeof startMethod !== "function") {
@@ -1198,8 +1232,10 @@ export class HyperAgent<T extends BrowserProviders = "Local"> {
           )
     ) as T extends "Hyperbrowser" ? HyperbrowserProvider : LocalBrowserProvider;
 
-    const customActions = this.safeReadField(params, "customActions");
-    if (Array.isArray(customActions)) {
+    const customActions = this.safeArrayValues<AgentActionDefinition>(
+      this.safeReadField(params, "customActions")
+    );
+    if (customActions.length > 0) {
       customActions.forEach((action) => {
         this.registerAction(action);
       });