fix(keybinds): survive group names shadowing Object.prototype

A description like "toString: X" made byName["toString"] resolve to
the inherited Object.prototype.toString instead of undefined, so the
group was never created and .rows.push threw. Object.create(null)
gives byName no prototype to shadow.

Also note in a comment that CAPS/MOD2/MOD3/MOD5 modmask bits are not
decoded and silently drop from the combo string.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2 files changed, 9 insertions, 1 deletions

diff --git a/keybinds/Binds.js b/keybinds/Binds.js
index 5c0ce2d..697f3c9 100644
--- a/keybinds/Binds.js
+++ b/keybinds/Binds.js
@@ -14,6 +14,8 @@
 // see test_binds.js.
 
 // Modmask bits, in the order they are written in keybindings.lua.
+// ponytail: CAPS/MOD2/MOD3/MOD5 bits are not decoded and vanish from the
+// combo; add them here if a bind ever uses one.
 const MODS = [[64, "SUPER"], [4, "CTRL"], [8, "ALT"], [1, "SHIFT"]];
 
 function mods(mask) {
@@ -28,7 +30,7 @@ function keys(bind) {
 // so a gap in the config is visible rather than silently missing.
 function group(binds) {
     const groups = [];
-    const byName = {};
+    const byName = Object.create(null);
     const undescribed = [];
     for (const b of binds) {
         const d = b.description || "";
diff --git a/keybinds/test_binds.js b/keybinds/test_binds.js
index 9be1dea..81f9108 100644
--- a/keybinds/test_binds.js
+++ b/keybinds/test_binds.js
@@ -42,4 +42,10 @@ assert.deepStrictEqual(B.group([
     { name: "Undescribed", rows: [{ keys: "SUPER + s", label: "no description" }] },
 ]);
 
+// A group name matching an Object.prototype property must not resolve to
+// the inherited value instead of creating a new group.
+assert.deepStrictEqual(B.group([
+    { modmask: 64, key: "z", description: "toString: Weird" },
+]), [{ name: "toString", rows: [{ keys: "SUPER + z", label: "Weird" }] }]);
+
 console.log("ok");