fix(plugin-rsc): escape __proto__ in bind objects

Co-authored-by: Codex <noreply@openai.com>

Author: hi-ogawa

packages/plugin-rsc/src/transforms/fixtures/hoist/member-chain-proto.js

@@ -0,0 +1,7 @@
+function outer() {
+  const x = {}
+  async function action() {
+    'use server'
+    return [x.__proto__.y, x.a.__proto__.b]
+  }
+}

packages/plugin-rsc/src/transforms/fixtures/hoist/member-chain-proto.js.snap.js

@@ -0,0 +1,10 @@
+function outer() {
+  const x = {}
+  const action = /* #__PURE__ */ $$register($$hoist_0_action, "<id>", "$$hoist_0_action").bind(null, { ["__proto__"]: { y: x.__proto__.y }, a: { ["__proto__"]: { b: x.a.__proto__.b } } });
+}
+
+;export async function $$hoist_0_action(x) {
+    'use server'
+    return [x.__proto__.y, x.a.__proto__.b]
+  };
+/* #__PURE__ */ Object.defineProperty($$hoist_0_action, "name", { value: "action" });

packages/plugin-rsc/src/transforms/hoist.ts

@@ -289,14 +289,26 @@ function synthesizePartialObject(root: string, bindPaths: BindPath[]): string {
       return root + segments.map((segment) => `.${segment}`).join('')
     }
     const entries = [...node.entries()]
-      .map(([k, child]) => `${k}: ${serialize(child, [...segments, k])}`)
+      .map(
+        ([k, child]) =>
+          `${serializeObjectKey(k)}: ${serialize(child, [...segments, k])}`,
+      )
       .join(', ')
     return `{ ${entries} }`
   }
 
   return serialize(trie, [])
 }
 
+function serializeObjectKey(key: string): string {
+  // ECMAScript object literals treat `__proto__: value` specially: when the
+  // property name is non-computed and equals "__proto__", evaluation performs
+  // [[SetPrototypeOf]] instead of creating a normal own data property. Emit a
+  // computed key here so synthesized partial objects preserve the original
+  // member-path shape rather than mutating the new object's prototype.
+  return key === '__proto__' ? `[${JSON.stringify(key)}]` : key
+}
+
 // e.g.
 // [x.y, x.y.z, x.w] -> [x.y, x.w]
 // [x.y.z, x.y.z.w] -> [x.y.z]