sz-chrome-remote-cdp.git/scripts, branch master

test: keep host-provided packages out of dependencies (#36)

2026-10-11T18:10:29+00:00

Adds a manifest guard (scripts/check-manifest.ts + test/util/manifest-test.ts) so npm run check fails if a host-provided package such as typebox lands in dependencies, plus a daemon-startup troubleshooting section in the skill. Co-Authored-By: Claude Fable 5.1

refactor: one door from a tool to the browser

2026-08-02T13:42:46+00:00

Four routes coexisted: cdpCall, a raw client.session().call, a session held in a local and called directly, and client.evaluateJs — and five files mixed two or three of them. The CdpError-to-ToolErr mapping was hand-copied at nine sites, plus a private copy in isolated-tab.ts. domains/cdp-call.ts now owns all of it: cdpErrToToolErr, cdpCall, cdpCallOnTarget, cdpCallBrowser, evalJs. Every other file under src/domains goes through them, which also removes a pile of `if (!r.success) return err({ kind: "cdp_error", ... })` boilerplate in favour of returning the failed Result as-is. Two scanner rules keep it that way, scoped to src/domains/ so the layer that legitimately owns the session — cdp/ and client.ts — is unaffected. Scoping is new to the rule model; without it the rules fired on the transport itself. One deliberate behaviour change: a CDP timeout now surfaces as kind "timeout" rather than "cdp_error". isolated-tab.ts already did this and the other 13 sites flattened it; the shared mapper uses the honest label rather than preserving the mislabel. Co-Authored-By: Claude Opus 5 (1M context)

chore: make the boundary scanner see every cast, not just the unsafe forms

2026-08-02T13:42:46+00:00

The scanner banned as any, as {, as unknown as, non-null assertions and ts-ignore, but said nothing about `as SomeNamedType` — so a new cast over CDP or JSON data could be added and CI would stay green, which is the exact regression the refactor exists to prevent. It also could not see a cast whose target type sits on the following line. Adds named-cast, function-cast and trailing-cast. All six surviving assertions in src/ are now visible to the scanner and individually exempted with a stated reason, so the allowlist is the complete inventory. Co-Authored-By: Claude Opus 5 (1M context)

chore: fail the build on unguarded type assertions

2026-08-02T13:42:46+00:00

A clean tsc does not prove the absence of casts. This scans src/ for as any, ts-ignore, non-null assertions, inline object casts, and double casts, wired into a new npm run check that CI runs as a single step. The escape hatch is an external allowlist module rather than an inline comment marker: comments are not used in this codebase, and an entry carries a count, so adding a new cast to an already-exempted file still fails until someone raises a number that shows up in the diff. Exactly one exemption is needed today, for the dynamic sharp import. scripts/ was gitignored wholesale, so the two new files are un-ignored individually and everything else dropped there stays ignored. Co-Authored-By: Claude Opus 5 (1M context)