refactor: validate JSON at every parse boundary

Ten sites cast or implicitly typed JSON.parse output; JSON.parse("null")
would have satisfied all of them. parseJson returns a Result and validates
against a typebox schema. js.ts keeps unknown — user script output has no
fixed shape. daemon/bridge.ts assigned JSON.parse straight to CdpRawMessage
with no guard at all; it now uses isCdpRawMessage like the transport does.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

1 files changed, 1 insertions, 1 deletions

diff --git a/src/domains/js.ts b/src/domains/js.ts
index b4a5b4c..61dbe53 100644
--- a/src/domains/js.ts
+++ b/src/domains/js.ts
@@ -61,7 +61,7 @@ export const executeJsTool = defineBrowserTool({
     // to the raw string if parse fails (e.g. value is "undefined" sentinel).
     let pretty: string | undefined;
     try {
-      const parsed = JSON.parse(valueStr);
+      const parsed: unknown = JSON.parse(valueStr);
       pretty = JSON.stringify(parsed, null, 2);
     } catch {
       pretty = undefined;