refactor(domains): drop CDP casts, share the box-model unwrap

ref-resolve.ts and snapshot.ts had the same box-model unwrap, both using
data.model! to work around an untyped response. Extracted to domains/box.ts;
the typed schema makes the assertions unnecessary. Both derived the centre
identically (quad corner + half the model width/height), so centreOf keeps
that derivation; the shared zero-size rejection moved into boxOf, and
snapshot keeps its own off-viewport (x/y < 0) filter.

evalInIsolatedTab now goes through evaluateJson with the tab's own sessionId
and a caller-supplied guard; both callers evaluate expressions ending in
JSON.stringify, so they pass isJsonText rather than a check that checks
nothing. Runtime.evaluate/callFunctionOn result casts in form.ts, forms.ts
and keyboard.ts are replaced by named guards over the in-page result shapes.

Runtime.callFunctionOn's params schema gained arguments/returnByValue/
awaitPromise/userGesture: four domain call sites legitimately pass them and
typebox's additionalProperties:true does not widen the static type, so the
params type was rejecting valid CDP fields. Params schemas are type-only
(only results are compiled), so this is a compile-time widening with no
runtime effect.

tsc is green again for both tsconfigs.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

1 files changed, 3 insertions, 2 deletions

diff --git a/src/domains/readpage/read-page.ts b/src/domains/readpage/read-page.ts
index bc1a2b1..c21b264 100644
--- a/src/domains/readpage/read-page.ts
+++ b/src/domains/readpage/read-page.ts
@@ -5,6 +5,7 @@ import { defineBrowserTool, type ToolErr, type ToolOk } from "../../util/tool";
 import {
   closeIsolatedTab,
   evalInIsolatedTab,
+  isJsonText,
   type IsolatedTab,
   navigateIsolatedTab,
   openIsolatedTab,
@@ -73,7 +74,7 @@ const readOpenedUrl = async (
     if (!navigated.success) return err(navigated.error);
     const loaded = await waitForIsolatedLoad(client, tab, LOAD_TIMEOUT_MS, signal);
     if (!loaded.success) return err(loaded.error);
-    const captured = await evalInIsolatedTab(client, tab, buildPageCaptureExpr());
+    const captured = await evalInIsolatedTab(client, tab, buildPageCaptureExpr(), isJsonText);
     if (!captured.success) return err(captured.error);
     return captureToResult(captured.data);
   } finally {
@@ -90,7 +91,7 @@ const readOwnedTab = async (
   }
   const attached = await client.session().callBrowser("Target.attachToTarget", { targetId, flatten: true });
   if (!attached.success) return err({ kind: "cdp_error", message: attached.error.message });
-  const sessionId = (attached.data as { sessionId: string }).sessionId;
+  const sessionId = attached.data.sessionId;
   const captured = await client.evaluateJs(buildPageCaptureExpr(), sessionId);
   if (!captured.success) return err({ kind: "cdp_error", message: captured.error.message });
   return captureToResult(captured.data);