[dezren39]

Fixes #2787

detectLanguage() looked up arbitrary filename extensions/stems in the plain-object maps EXT_TO_LANG / FILENAME_TO_LANG with truthiness checks, so inherited Object.prototype members counted as hits: notes.constructor returned the Object constructor function and notes.__proto__ returned a prototype object as the file's "language" (declared return type string | undefined). The LANG_IMPORTS lookup in ensureLanguage had the same flaw for an authored code-block language attribute — constructor was actually called as an import function.

Fix: own-key (Object.hasOwn) guards at all three detectLanguage lookup sites and at the LANG_IMPORTS lookup in ensureLanguage. Unknown/prototype names now fall through to undefined / "language not in registry" as intended.

Verification (laptop worktree, off main 24ddc15):

• Probe importing the real module before the fix reproduced all four bad returns; after the fix all return undefined, controls (app.ts → typescript, Dockerfile → dockerfile, unknown ext) unchanged. Probe: ~/git/fleet/probe-2026-10-30-laneB-highlightproto/
• vitest run src/highlight.test.ts: 99/99 pass (2 new tests cover the prototype extension and filename paths)
• tsc --noEmit: clean

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-30T16:28:55.603191Z	9ee4a5d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Caution

Review failed

The pull request is closed.

Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}