refactor(cdp): validate event params against a typed table

Malformed or unknown events are now dropped rather than hand-narrowed;
consumers get typed params. Unknown methods are ignored, since the
transport delivers every event Chrome emits.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

1 files changed, 8 insertions, 29 deletions

diff --git a/src/cdp/console-buffer.ts b/src/cdp/console-buffer.ts
index 5ba7c87..f42312f 100644
--- a/src/cdp/console-buffer.ts
+++ b/src/cdp/console-buffer.ts
@@ -13,9 +13,11 @@
  * the previous drain. This is the cursor pattern that makes "what did this action
  * cause?" answerable in one tool call.
  *
- * Pure module (no CDP dependency) — joining/filtering logic stays trivially testable.
+ * Joining/filtering logic stays trivially testable (no transport dependency).
  */
 
+import { decodeEvent } from "./events";
+
 export type ConsoleLevel = "log" | "info" | "warn" | "error" | "debug";
 
 export type ConsoleRecord = {
@@ -165,21 +167,9 @@ export const createConsoleBuffer = (capacity = 500): ConsoleBuffer => {
 
   return {
     ingestConsoleApi(p) {
-      // CDP boundary cast: Runtime.consoleAPICalled
-      const params = p as
-        | {
-            type?: string;
-            args?: ReadonlyArray<{
-              type?: string;
-              subtype?: string;
-              value?: unknown;
-              description?: string;
-              unserializableValue?: string;
-            }>;
-            stackTrace?: { callFrames?: ReadonlyArray<{ url?: string; lineNumber?: number; functionName?: string }> };
-          }
-        | undefined;
-      if (!params) return;
+      const decoded = decodeEvent("Runtime.consoleAPICalled", p);
+      if (!decoded.success) return;
+      const params = decoded.data;
       const level = mapConsoleApiLevel(params.type);
       const argTexts = (params.args ?? []).map((a) => truncateArg(stringifyRemoteObject(a)));
       const text = argTexts.join(" ");
@@ -199,19 +189,8 @@ export const createConsoleBuffer = (capacity = 500): ConsoleBuffer => {
     },
 
     ingestLogEntry(p) {
-      // CDP boundary cast: Log.entryAdded
-      const params = p as
-        | {
-            entry?: {
-              level?: string;
-              text?: string;
-              url?: string;
-              lineNumber?: number;
-              stackTrace?: { callFrames?: ReadonlyArray<{ url?: string; lineNumber?: number; functionName?: string }> };
-            };
-          }
-        | undefined;
-      const entry = params?.entry;
+      const decoded = decodeEvent("Log.entryAdded", p);
+      const entry = decoded.success ? decoded.data.entry : undefined;
       if (!entry) return;
       const level = mapLogEntryLevel(entry.level);
       const text = truncateArg(entry.text ?? "");