refactor: validate JSON at every parse boundary

Ten sites cast or implicitly typed JSON.parse output; JSON.parse("null")
would have satisfied all of them. parseJson returns a Result and validates
against a typebox schema. js.ts keeps unknown — user script output has no
fixed shape. daemon/bridge.ts assigned JSON.parse straight to CdpRawMessage
with no guard at all; it now uses isCdpRawMessage like the transport does.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

1 files changed, 5 insertions, 2 deletions

diff --git a/src/daemon/bridge.ts b/src/daemon/bridge.ts
index 33ef63b..de6dec7 100644
--- a/src/daemon/bridge.ts
+++ b/src/daemon/bridge.ts
@@ -12,6 +12,7 @@
 
 import WebSocket from "ws";
 import { discoverWsUrl } from "../cdp/discovery";
+import { isCdpRawMessage } from "../cdp/types";
 import type { CdpRawMessage } from "../cdp/types";
 import type { WireRequest, WireResponse, WireEvent } from "./protocol";
 import { CDP_CONNECT_TIMEOUT_MS, CDP_COMMAND_TIMEOUT_MS } from "./protocol";
@@ -150,8 +151,10 @@ export const createCdpBridge = (): CdpBridge => {
   // ── Handle raw CDP messages from Chrome ─────────────────────────────────
 
   const onChromeMessage = (raw: string): void => {
-    let msg: CdpRawMessage;
-    try { msg = JSON.parse(raw); } catch { return; }
+    let parsed: unknown;
+    try { parsed = JSON.parse(raw); } catch { return; }
+    if (!isCdpRawMessage(parsed)) return;
+    const msg: CdpRawMessage = parsed;
 
     // ---- Response (has id) ----
     if (msg.id !== undefined) {