[kamath]

Summary

Adds biome-plugin-no-type-assertion to the Biome setup from #2 and removes all 77 as type assertions it flagged. Where a value comes from outside the type system, it is now validated with zod (already a dependency of every package). Elsewhere, the cast is replaced by a type guard or TypeScript's own narrowing.

pnpm lint (main's biome check) now runs the formatter, the recommended rules and the plugin. as const is still allowed.

What changed

Untrusted data is parsed with zod instead of cast

• HTTP bodies: /screen in app.ts, /api/chat (the body is parsed with zod, then messages are checked with the AI SDK's validateUIMessages), and web UI error and browser-handle responses.
• CDP responses: /json/version, Page.captureScreenshot, and DOM.getContentQuads (its Quad type is now derived from a zod tuple).
• Hosted provider API JSON, sandbox bridge payloads (JSON.parse of host-call arguments and log entries), and the browser handle saved in sessionStorage.
• MCP tool results in the web app: CallToolResultSchema from the MCP SDK.

Browse command params

• screenshot.type, mouse button, waitUntil, wait load <state>, and clip are validated by small zod-backed helpers (optEnum, oneOf, optClip). Invalid values now raise a BrowseCommandError instead of passing through. The allowed values are exported from page.ts (LOAD_STATES, MOUSE_BUTTONS), and the types derive from them.

QuickJS variant

• @jitl/quickjs-wasmfile-release-sync ships CommonJS typings. Under NodeNext its default import is typed as { default: variant }, but ESM runtimes (Node, workerd) hand over the variant itself. The new sandbox/variant.ts unwraps it with a runtime type guard. It is used by runner.ts, worker.ts and runtime-bundled.ts.

browser_run input schema (tools)

• The double cast that claimed both cdpUrl and sessionId exist is gone. inputSchema is now the honest union of the two modes.
• The AI SDK and Mastra wrappers accept the union unchanged.
• examples/02-mcp-server narrows it with an in check before handing the shape to registerTool.
• The Mastra toModelOutput callbacks receive unknown because Mastra types output only through outputSchema, so they parse their input with zod.
• LiveView.url now also accepts undefined.

Casts that were simply unnecessary

• in-operator narrowing in the web UI's codeOf/textOf.
• The AI SDK dynamic flag in examples/01-hello-world.
• ErrorOptions in CdpEndpointError.
• connectOverCdp in core.ts.
• App.fetch is narrowed to the single argument every caller passes.

Tests

• Result shapes are parsed with zod, so a wrong shape fails loudly.
• Mastra tools get a real execute context (RequestContext + noopObserve) instead of {} as never.

Behavior changes

• Browse commands reject enum values outside the documented LoadState, MouseButton and "png" | "jpeg" types; previously they were forwarded to CDP.
• /api/chat returns 400 for a malformed body or malformed messages; previously a malformed body could throw and return 500.

Validation

• pnpm lint and pnpm check (all 5 packages)
• pnpm test (62 tests) and pnpm build
• test:runtime and test:worker against real Chrome
• test:e2e: 14/14 against real Chrome

  

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ac13c2e. Configure here.}

[cursor]

In-progress tool calls hidden

Medium Severity

toolPartSchema treats input and output as required, but AI SDK dynamic-tool parts omit those keys while a call is streaming or waiting (input-streaming / input-available). asToolCall then fails safeParse and returns null, so in-progress browser_run rows never render and the existing running state is unused until the call finishes.

 

^{Reviewed by Cursor Bugbot for commit ac13c2e. Configure here.}