refactor(server,app): lift return types and parse at boundaries (T2 typeaware production sweep) (#758)

* refactor(server,app): lift return types and parse at boundaries (T2 typeaware production sweep)

* fix(server): align acp-agent test assertions with pino call shape

packages/app/e2e/helpers/desktop-updates.ts

@@ -32,12 +32,13 @@ export async function loadRealDaemonState(): Promise<RealDaemonState> {
   if (!paseoHome) throw new Error("E2E_PASEO_HOME not set — globalSetup must run first");
 
   const resp = await fetch(`http://127.0.0.1:${port}/api/status`);
-  const data = (await resp.json()) as DaemonApiStatus;
+  const data: DaemonApiStatus = await resp.json();
 
   let pid: number | null = null;
   try {
     const raw = readFileSync(`${paseoHome}/paseo.pid`, "utf8");
-    pid = (JSON.parse(raw) as PidFileContent).pid ?? null;
+    const pidContent: PidFileContent = JSON.parse(raw);
+    pid = pidContent.pid ?? null;
   } catch (err) {
     // PID file may not be present yet on a very fresh daemon start
     console.warn("[desktop-updates] paseo.pid not found:", err);
@@ -70,6 +71,12 @@ export interface ConfirmDialogCall {
   title: string | undefined;
 }
 
+declare global {
+  interface Window {
+    __capturedDialogCall: ConfirmDialogCall | undefined;
+  }
+}
+
 /**
  * Injects window.paseoDesktop before app load so all Electron-gated code
  * activates. The update-check IPC is mocked at the boundary so the real
@@ -151,12 +158,14 @@ export async function injectDesktopBridge(page: Page, config: DesktopBridgeConfi
         }
 
         if (command === "patch_desktop_settings") {
-          const patchDaemon =
-            args?.daemon && typeof args.daemon === "object"
-              ? (args.daemon as Record<string, unknown>)
-              : {};
-          if (typeof patchDaemon.manageBuiltInDaemon === "boolean") {
-            manageDaemon = patchDaemon.manageBuiltInDaemon;
+          const daemon = args?.daemon;
+          if (
+            daemon !== null &&
+            typeof daemon === "object" &&
+            "manageBuiltInDaemon" in daemon &&
+            typeof daemon.manageBuiltInDaemon === "boolean"
+          ) {
+            manageDaemon = daemon.manageBuiltInDaemon;
           }
           return {
             releaseChannel: "stable",
@@ -183,9 +192,9 @@ export async function injectDesktopBridge(page: Page, config: DesktopBridgeConfi
       },
       dialog: {
         ask: async (message: string, options?: Record<string, unknown>) => {
-          (window as unknown as Record<string, unknown>).__capturedDialogCall = {
+          window.__capturedDialogCall = {
             message,
-            title: options?.title,
+            title: typeof options?.title === "string" ? options.title : undefined,
           };
           return cfg.confirmShouldAccept ?? false;
         },
@@ -228,13 +237,8 @@ export async function interceptDaemonManagementConfirmDialog(
   page: Page,
 ): Promise<ConfirmDialogCall> {
   await page.getByRole("switch", { name: "Manage built-in daemon" }).click();
-  await page.waitForFunction(
-    () => !!(window as unknown as Record<string, unknown>).__capturedDialogCall,
-    { timeout: 5_000 },
-  );
-  return page.evaluate(
-    () => (window as unknown as Record<string, unknown>).__capturedDialogCall as ConfirmDialogCall,
-  );
+  await page.waitForFunction(() => !!window.__capturedDialogCall, { timeout: 5_000 });
+  return page.evaluate(() => window.__capturedDialogCall!);
 }
 
 export async function toggleDaemonManagement(