fix: tie proto key blocking to ownPropertyOnly policy

Block __proto__, constructor, and prototype only when ownPropertyOnly
is true or when access would traverse the prototype chain. Allow own
properties with those names when ownPropertyOnly is false.

Co-authored-by: Cursor <[email protected]>

src/context/scope.ts

@@ -13,6 +13,16 @@ export function isBlockedScopeKey (key: PropertyKey): boolean {
   return typeof key === 'string' && BLOCKED_SCOPE_KEYS.has(key)
 }
 
+export function shouldBlockScopeKeyRead (obj: Scope, key: PropertyKey, ownPropertyOnly: boolean): boolean {
+  if (!isBlockedScopeKey(key)) return false
+  if (ownPropertyOnly) return true
+  return !hasOwnProperty.call(obj, key)
+}
+
+export function shouldBlockScopeKeyWrite (key: PropertyKey, ownPropertyOnly: boolean): boolean {
+  return ownPropertyOnly && isBlockedScopeKey(key)
+}
+
 export function createScope (from?: ScopeObject): ScopeObject {
   return from ? sanitizeScope(from) : Object.create(null)
 }
@@ -20,7 +30,7 @@ export function createScope (from?: ScopeObject): ScopeObject {
 export function sanitizeScope (obj: ScopeObject): ScopeObject {
   const scope = Object.create(null)
   for (const key of Object.keys(obj)) {
-    if (!isBlockedScopeKey(key) && hasOwnProperty.call(obj, key)) {
+    if (hasOwnProperty.call(obj, key)) {
       scope[key] = obj[key]
     }
   }