[Type Safety][Warning] JSON.parse results used without Zod validation in dashboard SSE handlers

[OneStepAt4time]

Summary

Multiple dashboard components parse SSE/WebSocket data via JSON.parse(e.data) and then directly cast the result to typed interfaces without runtime validation:

1. TranscriptViewer.tsx:72-76 — const data: ParsedEntry = raw.data (annotation, not validation)
2. TerminalPassthrough.tsx:105-107 — same pattern
3. resilient-websocket.ts:66 — JSON.parse(event.data as string) passed directly to callbacks

Meanwhile, useSessionPolling.ts:182 correctly uses SessionSSEEventDataSchema.safeParse().

Files Affected

• dashboard/src/components/session/TranscriptViewer.tsx:72-76
• dashboard/src/components/session/TerminalPassthrough.tsx:105-107
• dashboard/src/api/resilient-websocket.ts:66

Suggested Fix

Use the existing SessionSSEEventDataSchema.safeParse() pattern in all SSE/WebSocket message handlers, matching the approach already used in useSessionPolling.ts.

---

Code review finding from full codebase audit (2026-04-04)

[OneStepAt4time]

Closing per decisione Ema.

[OneStepAt4time]

🔧 Starting work. Approach: add Zod safeParse() to TranscriptViewer, TerminalPassthrough, and resilient-websocket matching the existing pattern in useSessionPolling.ts.

[OneStepAt4time]

PR #1265 merged — Zod validation added to SSE/WebSocket handlers.