mstro-app 0.3.0 → 0.3.4

package/server/mcp/bouncer-integration.ts

@@ -42,6 +42,43 @@ import {
   SAFE_OPERATIONS
 } from './security-patterns.js';
 
+/** Timeout for Haiku bouncer subprocess calls (ms). Configurable via env var. */
+const HAIKU_TIMEOUT_MS = parseInt(process.env.BOUNCER_HAIKU_TIMEOUT_MS || '10000', 10);
+
+// ========== Decision Cache ==========
+
+/** Cache TTL in ms (default 5 minutes) */
+const CACHE_TTL_MS = parseInt(process.env.BOUNCER_CACHE_TTL_MS || '300000', 10);
+const CACHE_MAX_SIZE = 200;
+
+interface CachedDecision {
+  decision: BouncerDecision;
+  expiresAt: number;
+}
+
+const decisionCache = new Map<string, CachedDecision>();
+
+function getCachedDecision(operation: string): BouncerDecision | null {
+  const entry = decisionCache.get(operation);
+  if (!entry) return null;
+  if (Date.now() > entry.expiresAt) {
+    decisionCache.delete(operation);
+    return null;
+  }
+  return entry.decision;
+}
+
+function cacheDecision(operation: string, decision: BouncerDecision): void {
+  // Don't cache low-confidence or error-fallback decisions
+  if (decision.confidence < 50) return;
+  // Evict oldest entries if cache is full
+  if (decisionCache.size >= CACHE_MAX_SIZE) {
+    const firstKey = decisionCache.keys().next().value;
+    if (firstKey !== undefined) decisionCache.delete(firstKey);
+  }
+  decisionCache.set(operation, { decision, expiresAt: Date.now() + CACHE_TTL_MS });
+}
+
 export interface BouncerReviewRequest {
   operation: string;
   context?: {
@@ -53,7 +90,7 @@ export interface BouncerReviewRequest {
     userRequest?: string;
     conversationHistory?: string[];
     sessionId?: string;
-    [key: string]: any;
+    [key: string]: unknown;
   };
 }
 
@@ -98,7 +135,7 @@ function tryExtractJsonBlock(text: string): string {
   return text;
 }
 
-function validateDecision(parsed: any): BouncerDecision {
+function validateDecision(parsed: Record<string, unknown>): BouncerDecision {
   if (!parsed || typeof parsed.decision !== 'string') {
     console.error('[Bouncer] Invalid parsed response:', parsed);
     throw new Error('Haiku returned invalid response: missing or invalid decision field');
@@ -111,11 +148,11 @@ function validateDecision(parsed: any): BouncerDecision {
   }
 
   return {
-    decision: parsed.decision,
-    confidence: parsed.confidence || 0,
-    reasoning: parsed.reasoning || 'No reasoning provided',
-    threatLevel: parsed.threat_level || 'medium',
-    alternative: parsed.alternative
+    decision: parsed.decision as BouncerDecision['decision'],
+    confidence: (parsed.confidence as number) || 0,
+    reasoning: (parsed.reasoning as string) || 'No reasoning provided',
+    threatLevel: (parsed.threat_level as BouncerDecision['threatLevel']) || 'medium',
+    alternative: parsed.alternative as string | undefined
   };
 }
 
@@ -195,7 +232,7 @@ or
     const timer = setTimeout(() => {
       timedOut = true;
       child.kill('SIGTERM');
-    }, 10000);
+    }, HAIKU_TIMEOUT_MS);
 
     child.stdout.on('data', (data) => {
       output += data.toString();
@@ -209,7 +246,7 @@ or
       clearTimeout(timer);
 
       if (timedOut) {
-        reject(new Error('Haiku analysis timeout after 10s'));
+        reject(new Error(`Haiku analysis timed out after ${HAIKU_TIMEOUT_MS}ms`));
         return;
       }
 
@@ -221,9 +258,9 @@ or
       try {
         const decision = parseHaikuResponse(output.trim());
         resolve(decision);
-      } catch (error: any) {
+      } catch (error: unknown) {
         console.error('[Bouncer] Parse error details:', error);
-        reject(new Error(`Failed to parse Haiku response: ${error.message}`));
+        reject(new Error(`Failed to parse Haiku response: ${error instanceof Error ? error.message : String(error)}`));
       }
     });
 
@@ -234,16 +271,55 @@ or
   });
 }
 
+/**
+ * Finalize a bouncer decision: log, track analytics, cache, and return.
+ */
+function finalizeDecision(
+  operation: string,
+  decision: BouncerDecision,
+  layer: string,
+  startTime: number,
+  context: BouncerReviewRequest['context'],
+  logFn: typeof import('./security-audit.js')['logBouncerDecision'],
+  opts?: { error?: string; skipCache?: boolean; skipAnalytics?: boolean },
+): BouncerDecision {
+  const latencyMs = Math.round(performance.now() - startTime);
+
+  logFn(operation, decision.decision, decision.confidence, decision.reasoning, {
+    context, threatLevel: decision.threatLevel, layer, latencyMs, ...(opts?.error && { error: opts.error }),
+  });
+
+  if (!opts?.skipAnalytics) {
+    const event = decision.decision === 'deny' ? AnalyticsEvents.BOUNCER_TOOL_DENIED : AnalyticsEvents.BOUNCER_TOOL_ALLOWED;
+    trackEvent(event, {
+      layer,
+      operation_length: operation.length,
+      threat_level: decision.threatLevel,
+      confidence: decision.confidence,
+      latency_ms: latencyMs,
+    });
+  }
+
+  if (!opts?.skipCache) cacheDecision(operation, decision);
+  return decision;
+}
+
 /**
  * Main bouncer review function - 2-layer hybrid system
  */
 export async function reviewOperation(request: BouncerReviewRequest): Promise<BouncerDecision> {
-  // Import audit logger
   const { logBouncerDecision } = await import('./security-audit.js');
-
   const startTime = performance.now();
-
   const { operation } = request;
+  const fin = (d: BouncerDecision, layer: string, opts?: Parameters<typeof finalizeDecision>[6]) =>
+    finalizeDecision(operation, d, layer, startTime, request.context, logBouncerDecision, opts);
+
+  // Check cache first
+  const cached = getCachedDecision(operation);
+  if (cached) {
+    console.error(`[Bouncer] ⚡ Cache hit: ${cached.decision} (${cached.confidence}%)`);
+    return cached;
+  }
 
   console.error('[Bouncer] Analyzing operation...');
   console.error(`[Bouncer] Operation: ${operation}`);
@@ -251,218 +327,70 @@ export async function reviewOperation(request: BouncerReviewRequest): Promise<Bo
     console.error(`[Bouncer] User request: ${request.context.userRequest}`);
   }
 
-  // ========================================
-  // PRE-CHECK: Malformed/empty tool calls
-  // ========================================
-  // Empty-param Edit/Write calls are no-ops that will fail validation anyway.
-  // Allow immediately instead of wasting ~8s on Haiku analysis.
+  // PRE-CHECK: Empty-param Edit/Write calls are no-ops — allow immediately
   const toolInput = request.context?.toolInput;
   if (toolInput && typeof toolInput === 'object' && Object.keys(toolInput).length === 0) {
     console.error('[Bouncer] ⚡ Fast path: Empty tool parameters (no-op)');
-    const latencyMs = Math.round(performance.now() - startTime);
-
-    const decision: BouncerDecision = {
-      decision: 'allow',
-      confidence: 95,
-      reasoning: 'Empty tool parameters - operation is a no-op with no side effects.',
-      threatLevel: 'low'
-    };
-
-    logBouncerDecision(
-      operation,
-      decision.decision,
-      decision.confidence,
-      decision.reasoning,
-      { context: request.context, threatLevel: decision.threatLevel, layer: 'pattern-noop', latencyMs }
-    );
-
-    return decision;
+    return fin({ decision: 'allow', confidence: 95, reasoning: 'Empty tool parameters - operation is a no-op with no side effects.', threatLevel: 'low' }, 'pattern-noop', { skipAnalytics: true });
   }
 
-  // ========================================
   // LAYER 1: Pattern-Based Fast Path (< 5ms)
-  // ========================================
 
-  // Check safe operations FIRST - allows trusted sources (e.g., brew, rustup)
+  // Check safe operations FIRST — allows trusted sources (e.g., brew, rustup)
   // to pass before hitting critical threat patterns like curl|bash
   const safeOperation = matchesPattern(operation, SAFE_OPERATIONS);
   if (safeOperation) {
     console.error('[Bouncer] ⚡ Fast path: Safe operation approved');
-    const latencyMs = Math.round(performance.now() - startTime);
-
-    const decision: BouncerDecision = {
-      decision: 'allow',
-      confidence: 95,
-      reasoning: 'Operation matches known-safe patterns. No security concerns detected.',
-      threatLevel: 'low'
-    };
-
-    logBouncerDecision(
-      operation,
-      decision.decision,
-      decision.confidence,
-      decision.reasoning,
-      { context: request.context, threatLevel: decision.threatLevel, layer: 'pattern-safe', latencyMs }
-    );
-    trackEvent(AnalyticsEvents.BOUNCER_TOOL_ALLOWED, {
-      layer: 'pattern-safe',
-      operation_length: operation.length,
-      threat_level: 'low',
-      confidence: 95,
-      latency_ms: latencyMs,
-    });
-
-    return decision;
+    return fin({ decision: 'allow', confidence: 95, reasoning: 'Operation matches known-safe patterns. No security concerns detected.', threatLevel: 'low' }, 'pattern-safe');
   }
 
-  // Check critical threats (catastrophic operations like rm -rf /, fork bombs)
-  // These are ALWAYS denied - no context can justify them
+  // Critical threats (rm -rf /, fork bombs) — ALWAYS denied
   const criticalThreat = matchesPattern(operation, CRITICAL_THREATS);
   if (criticalThreat) {
     console.error('[Bouncer] ⚡ Fast path: CRITICAL THREAT detected');
-    const latencyMs = Math.round(performance.now() - startTime);
-
-    const decision: BouncerDecision = {
-      decision: 'deny',
-      confidence: 99,
-      reasoning: `🚨 CRITICAL THREAT: ${criticalThreat.reason}`,
-      threatLevel: 'critical',
+    return fin({
+      decision: 'deny', confidence: 99, reasoning: `🚨 CRITICAL THREAT: ${criticalThreat.reason}`, threatLevel: 'critical',
       alternative: 'This operation should never be performed. If you need to accomplish a specific task, please describe your goal and I can suggest safe alternatives.',
-      enforceable: true
-    };
-
-    logBouncerDecision(
-      operation,
-      decision.decision,
-      decision.confidence,
-      decision.reasoning,
-      { context: request.context, threatLevel: decision.threatLevel, layer: 'pattern-critical', latencyMs }
-    );
-    trackEvent(AnalyticsEvents.BOUNCER_TOOL_DENIED, {
-      layer: 'pattern-critical',
-      operation_length: operation.length,
-      threat_level: 'critical',
-      confidence: 99,
-      latency_ms: latencyMs,
-    });
-
-    return decision;
+      enforceable: true,
+    }, 'pattern-critical');
   }
 
-  // ========================================
   // LAYER 2: Haiku AI Analysis (~200-500ms)
-  // ========================================
 
-  // Only invoke AI for operations that truly need context
+  // Default allow for operations that don't need AI review
   if (!requiresAIReview(operation)) {
-    // Default allow for operations that don't match any pattern
     console.error('[Bouncer] ⚡ Fast path: No concerning patterns, allowing');
-    const latencyMs = Math.round(performance.now() - startTime);
-
-    const decision: BouncerDecision = {
-      decision: 'allow',
-      confidence: 80,
-      reasoning: 'Operation appears safe based on pattern analysis. No obvious threats detected.',
-      threatLevel: 'low'
-    };
-
-    logBouncerDecision(
-      operation,
-      decision.decision,
-      decision.confidence,
-      decision.reasoning,
-      { context: request.context, threatLevel: decision.threatLevel, layer: 'pattern-default', latencyMs }
-    );
-    trackEvent(AnalyticsEvents.BOUNCER_TOOL_ALLOWED, {
-      layer: 'pattern-default',
-      operation_length: operation.length,
-      threat_level: 'low',
-      confidence: 80,
-      latency_ms: latencyMs,
-    });
-
-    return decision;
+    return fin({ decision: 'allow', confidence: 80, reasoning: 'Operation appears safe based on pattern analysis. No obvious threats detected.', threatLevel: 'low' }, 'pattern-default');
   }
 
-  // Check if AI analysis is enabled
-  const useAI = process.env.BOUNCER_USE_AI !== 'false';
-
-  if (!useAI) {
+  if (process.env.BOUNCER_USE_AI === 'false') {
     console.error('[Bouncer] AI analysis disabled (BOUNCER_USE_AI=false)');
-    const latencyMs = Math.round(performance.now() - startTime);
-
-    const decision: BouncerDecision = {
-      decision: 'warn_allow',
-      confidence: 60,
-      reasoning: 'Operation requires review but AI analysis is disabled. Proceeding with caution.',
-      threatLevel: 'medium'
-    };
-
-    logBouncerDecision(
-      operation,
-      decision.decision,
-      decision.confidence,
-      decision.reasoning,
-      { context: request.context, threatLevel: decision.threatLevel, layer: 'ai-disabled', latencyMs }
-    );
-
-    return decision;
+    return fin({ decision: 'warn_allow', confidence: 60, reasoning: 'Operation requires review but AI analysis is disabled. Proceeding with caution.', threatLevel: 'medium' }, 'ai-disabled', { skipCache: true, skipAnalytics: true });
   }
 
   console.error('[Bouncer] 🤖 Invoking Haiku for AI analysis...');
-  trackEvent(AnalyticsEvents.BOUNCER_HAIKU_REVIEW, {
-    operation_length: operation.length,
-  });
+  trackEvent(AnalyticsEvents.BOUNCER_HAIKU_REVIEW, { operation_length: operation.length });
 
-  // Get Claude command and working directory from context or use defaults
   const claudeCommand = process.env.CLAUDE_COMMAND || 'claude';
   const workingDir = request.context?.workingDirectory || process.cwd();
 
   try {
     const decision = await analyzeWithHaiku(request, claudeCommand, workingDir);
-    const latencyMs = Math.round(performance.now() - startTime);
-    console.error(`[Bouncer] ✓ Haiku decision: ${decision.decision} (${decision.confidence}% confidence) [${latencyMs}ms]`);
+    console.error(`[Bouncer] ✓ Haiku decision: ${decision.decision} (${decision.confidence}% confidence) [${Math.round(performance.now() - startTime)}ms]`);
     console.error(`[Bouncer] Reasoning: ${decision.reasoning}`);
+    return fin(decision, 'haiku-ai');
+  } catch (error: unknown) {
+    const errorMessage = error instanceof Error ? error.message : String(error);
+
+    if (errorMessage.includes('timed out')) {
+      console.error(`[Bouncer] ⚠️  Haiku analysis timed out after ${HAIKU_TIMEOUT_MS}ms — defaulting to ALLOW`);
+      captureException(error, { context: 'bouncer.haiku_timeout', operation });
+      return fin({ decision: 'allow', confidence: 50, reasoning: `Security analysis timed out after ${HAIKU_TIMEOUT_MS}ms. Defaulting to allow — user initiated the action.`, threatLevel: 'medium' }, 'haiku-timeout', { skipCache: true });
+    }
 
-    logBouncerDecision(
-      operation,
-      decision.decision,
-      decision.confidence,
-      decision.reasoning,
-      { context: request.context, threatLevel: decision.threatLevel, layer: 'haiku-ai', latencyMs }
-    );
-    trackEvent(decision.decision === 'deny' ? AnalyticsEvents.BOUNCER_TOOL_DENIED : AnalyticsEvents.BOUNCER_TOOL_ALLOWED, {
-      layer: 'haiku-ai',
-      operation_length: operation.length,
-      threat_level: decision.threatLevel,
-      confidence: decision.confidence,
-      latency_ms: latencyMs,
-    });
-
-    return decision;
-
-  } catch (error: any) {
-    const latencyMs = Math.round(performance.now() - startTime);
-    console.error(`[Bouncer] ⚠️  Haiku analysis failed: ${error.message}`);
+    console.error(`[Bouncer] ⚠️  Haiku analysis failed: ${errorMessage}`);
     captureException(error, { context: 'bouncer.haiku_analysis', operation });
-
-    // Fail-safe: deny on AI failure
-    const decision: BouncerDecision = {
-      decision: 'deny',
-      confidence: 0,
-      reasoning: `Security analysis failed: ${error.message}. Denying for safety.`,
-      threatLevel: 'critical'
-    };
-
-    logBouncerDecision(
-      operation,
-      decision.decision,
-      decision.confidence,
-      decision.reasoning,
-      { context: request.context, threatLevel: decision.threatLevel, layer: 'ai-error', latencyMs, error: error.message }
-    );
-
-    return decision;
+    return fin({ decision: 'deny', confidence: 0, reasoning: `Security analysis failed: ${errorMessage}. Denying for safety.`, threatLevel: 'critical' }, 'ai-error', { skipCache: true, skipAnalytics: true, error: errorMessage });
   }
 }
 

package/server/mcp/security-audit.ts

@@ -19,7 +19,7 @@ export interface AuditLogEntry {
   timestamp: string;
   sessionId?: string;
   operation: string;
-  context?: any;
+  context?: unknown;
   decision: 'allow' | 'deny' | 'warn_allow';
   confidence: number;
   reasoning: string;
@@ -68,7 +68,7 @@ export class SecurityAuditLogger {
     confidence: number,
     reasoning: string,
     metadata?: {
-      context?: any;
+      context?: unknown;
       threatLevel?: string;
       layer?: BouncerLayer;
       latencyMs?: number;
@@ -109,14 +109,14 @@ export function logBouncerDecision(
   decision: 'allow' | 'deny' | 'warn_allow' | undefined,
   confidence: number,
   reasoning: string,
-  metadata?: any
+  metadata?: Record<string, unknown>
 ): void {
   // Defensive: handle undefined or invalid decision
   const safeDecision = decision ?? 'deny';
   const validDecisions = ['allow', 'deny', 'warn_allow'];
   const normalizedDecision = validDecisions.includes(safeDecision) ? safeDecision : 'deny';
 
-  const workingDir = metadata?.context?.workingDirectory;
+  const workingDir = (metadata?.context as Record<string, unknown> | undefined)?.workingDirectory as string | undefined;
   const logger = getAuditLogger(workingDir);
   logger.logDecision(operation, normalizedDecision as 'allow' | 'deny' | 'warn_allow', confidence, reasoning, metadata);
 

package/server/mcp/server.ts

@@ -73,7 +73,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
   const { tool_name, input } = request.params.arguments as {
     tool_name: string;
-    input: Record<string, any>;
+    input: Record<string, unknown>;
   };
 
   console.error(`[MCP Bouncer] Analyzing ${tool_name} request...`);
@@ -84,7 +84,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
   // Extract file path with multiple property name support
   // Claude Code may use file_path, filePath, or path depending on context
-  const getFilePath = (inp: Record<string, any>) =>
+  const getFilePath = (inp: Record<string, unknown>) =>
     inp.file_path || inp.filePath || inp.path;
 
   if (tool_name === 'Bash' && input.command) {
@@ -141,8 +141,9 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         },
       ],
     };
-  } catch (error: any) {
-    console.error(`[MCP Bouncer] Error: ${error.message}`);
+  } catch (error: unknown) {
+    const errorMessage = error instanceof Error ? error.message : String(error);
+    console.error(`[MCP Bouncer] Error: ${errorMessage}`);
 
     // Fail-safe: deny on error
     return {
@@ -151,7 +152,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           type: 'text',
           text: JSON.stringify({
             behavior: 'deny',
-            message: `Security analysis failed: ${error.message}. Denying for safety.`,
+            message: `Security analysis failed: ${errorMessage}. Denying for safety.`,
           }),
         },
       ],

package/server/services/analytics.ts

@@ -158,7 +158,7 @@ function getDistinctId(): string {
 /**
  * Get common properties included with all events
  */
-function getCommonProperties(): Record<string, any> {
+function getCommonProperties(): Record<string, unknown> {
   return {
     os: platform(),
     arch: arch(),
@@ -171,7 +171,7 @@ function getCommonProperties(): Record<string, any> {
 /**
  * Track a custom event
  */
-export function trackEvent(event: string, properties?: Record<string, any>): void {
+export function trackEvent(event: string, properties?: Record<string, unknown>): void {
   if (!client || !isTelemetryEnabled()) return
 
   client.capture({
@@ -187,7 +187,7 @@ export function trackEvent(event: string, properties?: Record<string, any>): voi
 /**
  * Identify a user (call after login)
  */
-export function identifyUser(userId: string, properties?: Record<string, any>): void {
+export function identifyUser(userId: string, properties?: Record<string, unknown>): void {
   if (!client || !isTelemetryEnabled()) return
 
   // Link the client ID to the user ID

package/server/services/files.ts

@@ -332,9 +332,9 @@ export function listDirectory(
       success: true,
       entries: directoryEntries
     }
-  } catch (error: any) {
+  } catch (error: unknown) {
     // Handle permission errors gracefully
-    if (error.code === 'EACCES') {
+    if (error instanceof Error && 'code' in error && (error as NodeJS.ErrnoException).code === 'EACCES') {
       return {
         success: false,
         error: 'Permission denied'
@@ -344,7 +344,7 @@ export function listDirectory(
     console.error('[FileService] Error listing directory:', error)
     return {
       success: false,
-      error: error.message || 'Failed to list directory'
+      error: error instanceof Error ? error.message : 'Failed to list directory'
     }
   }
 }
@@ -408,11 +408,11 @@ export function writeFile(
       success: true,
       path: resolvedPath.replace(`${workingDir}/`, '')
     }
-  } catch (error: any) {
+  } catch (error: unknown) {
     console.error('[FileService] Error writing file:', error)
     return {
       success: false,
-      error: error.message || 'Failed to write file'
+      error: error instanceof Error ? error.message : 'Failed to write file'
     }
   }
 }
@@ -471,11 +471,11 @@ export function createFile(
       success: true,
       path: resolvedPath.replace(`${workingDir}/`, '')
     }
-  } catch (error: any) {
+  } catch (error: unknown) {
     console.error('[FileService] Error creating file:', error)
     return {
       success: false,
-      error: error.message || 'Failed to create file'
+      error: error instanceof Error ? error.message : 'Failed to create file'
     }
   }
 }
@@ -536,11 +536,11 @@ export function createDirectory(
       success: true,
       path: resolvedPath.replace(`${workingDir}/`, '')
     }
-  } catch (error: any) {
+  } catch (error: unknown) {
     console.error('[FileService] Error creating directory:', error)
     return {
       success: false,
-      error: error.message || 'Failed to create directory'
+      error: error instanceof Error ? error.message : 'Failed to create directory'
     }
   }
 }
@@ -618,11 +618,11 @@ export function deleteFile(
       success: true,
       path: resolvedPath.replace(`${workingDir}/`, '')
     }
-  } catch (error: any) {
+  } catch (error: unknown) {
     console.error('[FileService] Error deleting file:', error)
     return {
       success: false,
-      error: error.message || 'Failed to delete'
+      error: error instanceof Error ? error.message : 'Failed to delete'
     }
   }
 }
@@ -700,11 +700,11 @@ export function renameFile(
       success: true,
       path: resolvedNewPath.replace(`${workingDir}/`, '')
     }
-  } catch (error: any) {
+  } catch (error: unknown) {
     console.error('[FileService] Error renaming file:', error)
     return {
       success: false,
-      error: error.message || 'Failed to rename'
+      error: error instanceof Error ? error.message : 'Failed to rename'
     }
   }
 }

package/server/services/pathUtils.ts

@@ -71,12 +71,12 @@ export function validatePathWithinWorkingDir(
       valid: true,
       resolvedPath
     };
-  } catch (error: any) {
+  } catch (error: unknown) {
     console.error('[PathUtils] Error validating path:', error);
     return {
       valid: false,
       resolvedPath: '',
-      error: `Invalid path: ${error.message}`
+      error: `Invalid path: ${error instanceof Error ? error.message : String(error)}`
     };
   }
 }

package/server/services/platform.ts

@@ -121,7 +121,7 @@ interface ConnectionCallbacks {
   onError?: (error: string) => void
   onWebConnected?: () => void
   onWebDisconnected?: () => void
-  onRelayedMessage?: (message: any) => void
+  onRelayedMessage?: (message: unknown) => void
 }
 
 /**
@@ -351,15 +351,15 @@ export class PlatformConnection {
     }
   }
 
-  private handleMessage(message: any): void {
+  private handleMessage(message: Record<string, unknown>): void {
     switch (message.type) {
       case 'paired':
         this.isConnected = true
-        this.connectionId = message.connectionId
+        this.connectionId = message.connectionId as string
         // Connection status printed by onConnected callback
         // Start heartbeat to keep server-side TTL refreshed
         this.startHeartbeat()
-        this.callbacks.onConnected?.(message.connectionId)
+        this.callbacks.onConnected?.(message.connectionId as string)
         break
 
       case 'web_connected':
@@ -404,7 +404,7 @@ export class PlatformConnection {
   /**
    * Send message to platform (will be relayed to web if connected)
    */
-  send(message: any): void {
+  send(message: unknown): void {
     if (this.ws && this.ws.readyState === WebSocketImpl.OPEN) {
       this.ws.send(JSON.stringify(message))
     }

package/server/services/sentry.ts

@@ -65,7 +65,7 @@ export function initSentry(): void {
   })
 }
 
-export function captureException(error: unknown, context?: Record<string, any>): void {
+export function captureException(error: unknown, context?: Record<string, unknown>): void {
   if (!initialized) return
   Sentry.captureException(error, context ? { extra: context } : undefined)
 }