fix(types): replace Record<string, any> with Record<string, unknown> for message in utils.js

[jonathanKingston]

Asana Task/Github Issue:

Description

Testing Steps

Checklist

Please tick all that apply:

• I have tested this change locally
• I have tested this change locally in all supported browsers
• This change will be visible to users
• I have added automated tests that cover this change
• I have ensured the change is gated by config
• This change was covered by a ship review
• This change was covered by a tech design
• Any dependent config has been merged

---

https://claude.ai/code/session_01QaZ2NFE7y5u8YdZhjoc79m

---

Note

Low Risk
Low risk: this is a JSDoc type tightening for a debug-message helper and should not affect runtime behavior, but it may surface new type-check warnings where callers assumed any.

Overview
Tightens the JSDoc type of the postDebugMessage message parameter from Record<string, any> to Record<string, unknown> in injected/src/utils.js, reducing implicit any usage for debug payloads.

^{Reviewed by Cursor Bugbot for commit 66bc28e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

[Beta] Generated file diff

Time updated: Fri, 22 May 2026 10:16:18 GMT

Dismissing stale approval — new commits pushed, awaiting Cursor re-review.

Dismissing stale approval — new commits pushed, awaiting Cursor re-review.

Dismissing stale approval — new commits pushed, awaiting Cursor re-review.

Dismissing stale approval — new commits pushed, awaiting Cursor re-review.

Dismissing stale approval — new commits pushed, awaiting Cursor re-review.

Dismissing stale approval — new commits pushed, awaiting Cursor re-review.

Dismissing stale approval — new commits pushed, awaiting Cursor re-review.

Dismissing stale approval — new commits pushed, awaiting Cursor re-review.

Dismissing stale approval — new commits pushed, awaiting Cursor re-review.

Dismissing stale approval — new commits pushed, awaiting Cursor re-review.

Dismissing stale approval — new commits pushed, awaiting Cursor re-review.

Dismissing stale approval — new commits pushed, awaiting Cursor re-review.

Dismissing stale approval — new commits pushed, awaiting Cursor re-review.

Dismissing stale approval — new commits pushed, awaiting Cursor re-review.

[cursor]

Stale comment

Web Compatibility Assessment

• injected/src/utils.js, 580-582, info: JSDoc-only type tightening (Record<string, any> → Record<string, unknown>) does not alter runtime behavior, API shims, descriptors, prototype chains, or DOM interaction paths. No web-compat regression identified for the changed lines.

Security Assessment

• injected/src/utils.js, 580-582, info: Change is static typing only and introduces no new global reads/writes, messaging paths, bridge logic, origin checks, or executable code paths. No security vulnerability introduced by this diff.

Risk Level

Low Risk — this PR changes only a JSDoc annotation and does not modify runtime logic in injected code.

Recommendations

1. Optional hardening: replace Record<string, unknown> with a dedicated DebugMessage typedef (e.g., { stack?: string, [key: string]: unknown }) so message.stack remains explicitly typed and future edits avoid drifting back to any.
2. Optional guardrail: add/keep lint/type-check enforcement that rejects Record<string, any> in injected/src/** JSDoc to prevent recurrence.

---

  

[cursor]

Web Compatibility Assessment

• injected/src/utils.js, 580-592, info: The changed annotation is JSDoc-only and does not alter runtime behavior, API shims, descriptors, prototype chains, DOM access, or platform-specific code paths. No web-compat regression identified in the runtime diff.

Security Assessment

• injected/src/utils.js, 580-592, info: The diff introduces no new global reads/writes, message bridge changes, origin validation changes, executable code, network requests, or data-flow changes. No injected-runtime security vulnerability identified.

Risk Level

Low Risk — runtime behavior is unchanged; the only change is a type annotation on a debug-message helper.

Recommendations

1. Fix the direct type-check regression before merge: Record<string, unknown> makes message.stack type as unknown and narrows to {} after the truthiness check, so npm run tsc fails at the getStackTraceOrigins(message.stack) call. Prefer a dedicated typedef such as Record<string, unknown> & { stack?: string; scriptOrigins?: string[] }.
2. Verification run: npm run build-surrogates -w injected && npm run build-locales -w injected && npm run tsc fails only on this changed path after generated prerequisites are present.

  

_{Sent by Cursor Automation: Web compat and sec}

[cursor]

This becomes a type-check failure with the new Record<string, unknown> annotation. message.stack is unknown; inside if (message.stack), TypeScript narrows it to {}, which is not assignable to getStackTraceOrigins(stack: string | undefined). A narrow typedef for debug messages, e.g. Record<string, unknown> & { stack?: string; scriptOrigins?: string[] }, keeps the any removal without breaking npm run tsc.

Dismissing stale approval — new commits pushed, awaiting Cursor re-review.