fix(highways): validate panel index before indexing the camera map

_resolveFreeCam() (keys/drum) and _freeCamFor() (highway_3d) guarded the panel
map lookup with only `i != null`, so a non-integer / negative / string index
from panelIndexFor() could resolve an unintended or inherited property (e.g.
map['toString']) instead of cleanly falling back to the global camera. Gate the
index on `Number.isInteger(i) && i >= 0` before `map[i]`, matching the hardening
already applied in _bgPanelKey(). Extend the resolver tests with float/string
(prototype-key) cases. Behavior change only for malformed indices.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Kris Anderson <topkoa@gmail.com>

plugins/drum_highway_3d/screen.js

@@ -1387,7 +1387,10 @@
         if (panelsMap && ss && typeof ss.panelIndexFor === 'function') {
             try {
                 const i = ss.panelIndexFor(canvas);
-                if (i != null && panelsMap[i]) return panelsMap[i];
+                // Only a non-negative integer indexes the panel map — a non-int /
+                // negative / string index (or a prototype key) must not resolve an
+                // unintended/inherited property; fall through to the global then.
+                if (Number.isInteger(i) && i >= 0 && panelsMap[i]) return panelsMap[i];
             } catch (e) { /* ignore */ }
         }
         return globalCam || null;

plugins/drum_highway_3d/tests/camera_bridge.test.js

@@ -56,11 +56,14 @@ test('_resolveFreeCam: throw-safe on panelIndexFor → falls back to global', ()
     assert.equal(__test._resolveFreeCam({}, ss, { 0: {} }, g), g);
 });
 
-test('_resolveFreeCam: NaN/invalid panel index → falls back to global', () => {
+test('_resolveFreeCam: NaN/negative/float/string index → falls back to global', () => {
     const { __test } = load();
     const g = { id: 'global' };
     assert.equal(__test._resolveFreeCam({}, { panelIndexFor: () => NaN }, { 0: {} }, g), g);
     assert.equal(__test._resolveFreeCam({}, { panelIndexFor: () => -1 }, { 0: {} }, g), g);
+    assert.equal(__test._resolveFreeCam({}, { panelIndexFor: () => 0.5 }, { 0: {} }, g), g);
+    // A string/prototype key must not resolve an inherited property (e.g. toString).
+    assert.equal(__test._resolveFreeCam({}, { panelIndexFor: () => 'toString' }, {}, g), g);
 });
 
 test('_ssApi: null when neither global set; slopsmith alias; feedBack canonical wins', () => {

plugins/highway_3d/screen.js

@@ -2632,7 +2632,10 @@
             if (ss && typeof ss.panelIndexFor === 'function') {
                 try {
                     const i = ss.panelIndexFor(canvas);
-                    if (i != null && map[i]) return map[i];
+                    // Only a non-negative integer indexes the map (same hardening
+                    // as _bgPanelKey) — a non-int / negative / string index must not
+                    // resolve an unintended/inherited property; fall through then.
+                    if (Number.isInteger(i) && i >= 0 && map[i]) return map[i];
                 } catch (e) { /* ignore */ }
             }
         }

plugins/keys_highway_3d/screen.js

@@ -1626,7 +1626,10 @@
         if (panelsMap && ss && typeof ss.panelIndexFor === 'function') {
             try {
                 const i = ss.panelIndexFor(canvas);
-                if (i != null && panelsMap[i]) return panelsMap[i];
+                // Only a non-negative integer indexes the panel map — a non-int /
+                // negative / string index (or a prototype key) must not resolve an
+                // unintended/inherited property; fall through to the global then.
+                if (Number.isInteger(i) && i >= 0 && panelsMap[i]) return panelsMap[i];
             } catch (e) { /* ignore */ }
         }
         return globalCam || null;

plugins/keys_highway_3d/tests/camera_bridge.test.js

@@ -56,11 +56,14 @@ test('_resolveFreeCam: throw-safe on panelIndexFor → falls back to global', ()
     assert.equal(__test._resolveFreeCam({}, ss, { 0: {} }, g), g);
 });
 
-test('_resolveFreeCam: NaN/invalid panel index → falls back to global', () => {
+test('_resolveFreeCam: NaN/negative/float/string index → falls back to global', () => {
     const { __test } = load();
     const g = { id: 'global' };
     assert.equal(__test._resolveFreeCam({}, { panelIndexFor: () => NaN }, { 0: {} }, g), g);
     assert.equal(__test._resolveFreeCam({}, { panelIndexFor: () => -1 }, { 0: {} }, g), g);
+    assert.equal(__test._resolveFreeCam({}, { panelIndexFor: () => 0.5 }, { 0: {} }, g), g);
+    // A string/prototype key must not resolve an inherited property (e.g. toString).
+    assert.equal(__test._resolveFreeCam({}, { panelIndexFor: () => 'toString' }, {}, g), g);
 });
 
 test('_ssApi: null when neither global set; slopsmith alias; feedBack canonical wins', () => {