refactor: validate JSON at every parse boundary

Ten sites cast or implicitly typed JSON.parse output; JSON.parse("null")
would have satisfied all of them. parseJson returns a Result and validates
against a typebox schema. js.ts keeps unknown — user script output has no
fixed shape. daemon/bridge.ts assigned JSON.parse straight to CdpRawMessage
with no guard at all; it now uses isCdpRawMessage like the transport does.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

1 files changed, 39 insertions, 0 deletions

diff --git a/test/util/parse-test.ts b/test/util/parse-test.ts
new file mode 100644
index 0000000..1aa6028
--- /dev/null
+++ b/test/util/parse-test.ts
@@ -0,0 +1,39 @@
+import { test, describe } from "node:test";
+import assert from "node:assert/strict";
+import { Type } from "typebox";
+import { Compile } from "typebox/compile";
+import { parseJson } from "../../src/schemas/parse";
+
+const Pin = Compile(Type.Object({ userDataDir: Type.String(), profileDir: Type.String() }));
+
+describe("parseJson", () => {
+  test("parses and validates a well-formed document", () => {
+    const r = parseJson('{"userDataDir":"/d","profileDir":"P1"}', Pin);
+    assert.equal(r.success, true);
+    if (r.success) assert.equal(r.data.profileDir, "P1");
+  });
+
+  test("a syntax error becomes an error result, not a throw", () => {
+    const r = parseJson("{not json", Pin);
+    assert.equal(r.success, false);
+    if (!r.success) assert.match(r.error, /JSON/);
+  });
+
+  test("a schema mismatch becomes an error result", () => {
+    const r = parseJson('{"userDataDir":5}', Pin);
+    assert.equal(r.success, false);
+  });
+
+  test("a bare JSON scalar does not satisfy an object schema", () => {
+    assert.equal(parseJson("42", Pin).success, false);
+    assert.equal(parseJson("null", Pin).success, false);
+    assert.equal(parseJson('"str"', Pin).success, false);
+    assert.equal(parseJson("[]", Pin).success, false);
+  });
+
+  test("an error result carries a non-empty message for a schema mismatch", () => {
+    const r = parseJson("null", Pin);
+    assert.equal(r.success, false);
+    if (!r.success) assert.ok(r.error.length > 0);
+  });
+});