From a6e2d09de82b7f3db9ef23f97de3d599601729d9 Mon Sep 17 00:00:00 2001
From: Mark <strategy155@gmail.com>
Date: Sat, 16 May 2026 10:51:00 +0200
Subject: [PATCH] fix(01-review): IN-05 Message<T = unknown> + sweep any[] in
 RrwebEventsResponse/UserEvent.meta/popup log

---
 src/popup/index.ts  |  5 ++++-
 src/shared/types.ts | 24 +++++++++++++++++++++---
 2 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/src/popup/index.ts b/src/popup/index.ts
index e9531d5..214b0db 100644
--- a/src/popup/index.ts
+++ b/src/popup/index.ts
@@ -12,7 +12,10 @@ let popupState: PopupState = {
 };
 
 // Логирование
-function log(...args: any[]) {
+// IN-02-companion: align with the IN-02 fix to Logger/ContentLogger —
+// `unknown[]` is the strict-mode-friendly signature for variadic
+// console wrappers. console.log accepts unknown values natively.
+function log(...args: unknown[]) {
   console.log('[Popup]', ...args);
 }
 
diff --git a/src/shared/types.ts b/src/shared/types.ts
index 94f9ca0..cf00fa0 100644
--- a/src/shared/types.ts
+++ b/src/shared/types.ts
@@ -15,7 +15,14 @@ export type MessageType =
   | 'RECORDING_ERROR'
   | 'OFFSCREEN_READY';
 
-export interface Message<T = any> {
+// IN-05 fix: Message<T = unknown> instead of `T = any`. Call sites that
+// access `(msg as Message).data` MUST narrow before use — `unknown`
+// forces that discipline, which `any` silently bypassed (every
+// downstream access was implicitly `any` and skipped type checking).
+// The Message inbox in src/background/index.ts and src/offscreen/recorder.ts
+// already destructure via `msg.type` switch and never read `.data`
+// directly, so the migration was safe (no widening needed).
+export interface Message<T = unknown> {
   type: MessageType;
   data?: T;
   tabId?: number;
@@ -61,13 +68,18 @@ export interface TransferredVideoSegment {
 }
 
 // Лог событий пользователя
+// IN-05-companion: `meta` uses `unknown` values instead of `any`. The
+// field carries free-form diagnostic data (HTTP status, stack frames,
+// XHR method, etc.); none of the SW consumers READ from meta — it
+// only flows from content script → archive JSON. `unknown` documents
+// "treat me opaquely" honestly; `any` silently allowed any access.
 export interface UserEvent {
   timestamp: number;
   type: 'click' | 'input' | 'navigation' | 'js_error' | 'network_error';
   target: string;
   value?: string;
   url: string;
-  meta?: Record<string, any>;
+  meta?: Record<string, unknown>;
 }
 
 // Метаданные сессии
@@ -93,6 +105,12 @@ export interface VideoBufferResponse {
   segments: VideoSegment[];
 }
 
+// IN-05-companion: `events: unknown[]` instead of `any[]`. The events
+// array carries rrweb's `EventWithTime` shape which is too large to
+// import here without pulling rrweb into the shared module; the
+// consumers (background/index.ts) already type it as `unknown[]` and
+// pass through to JSZip. `any[]` would have silently bypassed all
+// downstream type-checking.
 export interface RrwebEventsResponse {
-  events: any[];
+  events: unknown[];
 }