From 745d9f913bf70d871b27d37345cc0905035b115a Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Sat, 13 Jun 2026 17:42:12 +0000
Subject: [PATCH 1/2] Replace explicit any types with unknown in
 webviewMessageHandler.ts

---
 src/webviewMessageHandler.ts | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/src/webviewMessageHandler.ts b/src/webviewMessageHandler.ts
index f62117a..38c19ed 100644
--- a/src/webviewMessageHandler.ts
+++ b/src/webviewMessageHandler.ts
@@ -21,13 +21,14 @@ interface WebviewLegacyRpcMessage {
 
 function isWebviewRpcInvokeMessage(message: unknown): message is WebviewRpcInvokeMessage {
   if (!message || typeof message !== 'object') return false;
-  const msg = message as Record<string, any>;
-  return msg.channel === 'rpc' && msg.content?.kind === 'invoke';
+  const msg = message as Record<string, unknown>;
+  const content = msg.content as Record<string, unknown> | undefined;
+  return msg.channel === 'rpc' && content?.kind === 'invoke';
 }
 
 function isWebviewLegacyRpcMessage(message: unknown): message is WebviewLegacyRpcMessage {
   if (!message || typeof message !== 'object') return false;
-  const msg = message as Record<string, any>;
+  const msg = message as Record<string, unknown>;
   return msg.type === 'rpc-request';
 }
 
@@ -81,9 +82,9 @@ export class WebviewMessageHandler {
     // SECURITY: Block Object.prototype methods to prevent prototype pollution attacks.
     // Allow class prototype methods (e.g., HostBridge.initialize) but reject inherited
     // Object methods like 'constructor', '__defineGetter__', 'toString'.
-    if (!BLOCKED_METHODS.has(targetMethod) && targetMethod in hostBridge && typeof (hostBridge as Record<string, any>)[targetMethod] === 'function') {
-      const fn = (hostBridge as Record<string, any>)[targetMethod];
-      Promise.resolve(fn.apply(hostBridge as any, deserializedPayload))
+    if (!BLOCKED_METHODS.has(targetMethod) && targetMethod in hostBridge && typeof (hostBridge as Record<string, unknown>)[targetMethod] === 'function') {
+      const fn = (hostBridge as Record<string, unknown>)[targetMethod] as Function;
+      Promise.resolve(fn.apply(hostBridge, deserializedPayload))
         .then(result => {
           // Serialize result to handle Uint8Array and other typed arrays
           // which get converted to {} by postMessage JSON serialization
@@ -131,9 +132,9 @@ export class WebviewMessageHandler {
     const hostBridge = this.hostBridge;
     // SECURITY: Same prototype pollution guard as #handleRpcInvoke
     if (BLOCKED_METHODS.has(message.method) || !(message.method in hostBridge)) return;
-    const fn = (hostBridge as Record<string, any>)[message.method];
+    const fn = (hostBridge as Record<string, unknown>)[message.method] as Function;
     if (typeof fn === 'function') {
-      Promise.resolve(fn.apply(hostBridge as any, deserializeArgs(message.args || [])))
+      Promise.resolve(fn.apply(hostBridge, deserializeArgs(message.args || [])))
         .then(result => {
           // Serialize result to handle Uint8Array
           const serializedResult = serializeValue(result);

From 47c106990fcbc8cdebf0fe9cd263da5ad286e4d1 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Sat, 13 Jun 2026 17:48:41 +0000
Subject: [PATCH 2/2] Fix TS error by double casting HostBridge to
 Record<string, unknown>

---
 src/webviewMessageHandler.ts | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/webviewMessageHandler.ts b/src/webviewMessageHandler.ts
index 38c19ed..4fb53e9 100644
--- a/src/webviewMessageHandler.ts
+++ b/src/webviewMessageHandler.ts
@@ -82,8 +82,8 @@ export class WebviewMessageHandler {
     // SECURITY: Block Object.prototype methods to prevent prototype pollution attacks.
     // Allow class prototype methods (e.g., HostBridge.initialize) but reject inherited
     // Object methods like 'constructor', '__defineGetter__', 'toString'.
-    if (!BLOCKED_METHODS.has(targetMethod) && targetMethod in hostBridge && typeof (hostBridge as Record<string, unknown>)[targetMethod] === 'function') {
-      const fn = (hostBridge as Record<string, unknown>)[targetMethod] as Function;
+    if (!BLOCKED_METHODS.has(targetMethod) && targetMethod in hostBridge && typeof (hostBridge as unknown as Record<string, unknown>)[targetMethod] === 'function') {
+      const fn = (hostBridge as unknown as Record<string, unknown>)[targetMethod] as Function;
       Promise.resolve(fn.apply(hostBridge, deserializedPayload))
         .then(result => {
           // Serialize result to handle Uint8Array and other typed arrays
@@ -132,7 +132,7 @@ export class WebviewMessageHandler {
     const hostBridge = this.hostBridge;
     // SECURITY: Same prototype pollution guard as #handleRpcInvoke
     if (BLOCKED_METHODS.has(message.method) || !(message.method in hostBridge)) return;
-    const fn = (hostBridge as Record<string, unknown>)[message.method] as Function;
+    const fn = (hostBridge as unknown as Record<string, unknown>)[message.method] as Function;
     if (typeof fn === 'function') {
       Promise.resolve(fn.apply(hostBridge, deserializeArgs(message.args || [])))
         .then(result => {