From 36ad56a6c6667a2f2eb6cc0f8cf228ea4a779caa Mon Sep 17 00:00:00 2001
From: William Valentin <william.valentin.info@gmail.com>
Date: Mon, 16 Feb 2026 19:45:01 -0800
Subject: [PATCH] fix(companion): type-guard event wait name validation

---
 docs/plans/state.json               | 12 ++++++++++++
 src/companion/runtimeClient.test.ts |  6 ++++++
 src/companion/runtimeClient.ts      |  8 ++++++--
 3 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/docs/plans/state.json b/docs/plans/state.json
index da58db1..0a20a76 100644
--- a/docs/plans/state.json
+++ b/docs/plans/state.json
@@ -820,6 +820,18 @@
       ],
       "test_status": "pnpm test:run src/companion/runtimeClient.test.ts src/companion/platformClients.test.ts src/companion/heartbeatLoop.test.ts src/companion/platformClients.integration.test.ts + pnpm typecheck passing"
     },
+    "companion-runtime-event-name-type-guard": {
+      "status": "completed",
+      "date": "2026-02-17",
+      "updated": "2026-02-17",
+      "summary": "Hardened runtime event-name validation with explicit string type guards so `waitForEvent()`/`waitForAnyEvent()` reject non-string inputs deterministically.",
+      "files_modified": [
+        "src/companion/runtimeClient.ts",
+        "src/companion/runtimeClient.test.ts",
+        "docs/plans/state.json"
+      ],
+      "test_status": "pnpm test:run src/companion/runtimeClient.test.ts src/companion/platformClients.test.ts src/companion/heartbeatLoop.test.ts src/companion/platformClients.integration.test.ts + pnpm typecheck passing"
+    },
     "browser-tools-activation-clarity": {
       "status": "completed",
       "date": "2026-02-17",
diff --git a/src/companion/runtimeClient.test.ts b/src/companion/runtimeClient.test.ts
index 991818e..b006ab9 100644
--- a/src/companion/runtimeClient.test.ts
+++ b/src/companion/runtimeClient.test.ts
@@ -350,6 +350,9 @@ describe('CompanionRuntimeClient', () => {
 
     expect(() => client.waitForEvent('')).toThrow('eventName must be a non-empty string');
     expect(() => client.waitForEvent('   ')).toThrow('eventName must be a non-empty string');
+    expect(() => client.waitForEvent(123 as unknown as string)).toThrow(
+      'eventName must be a non-empty string',
+    );
   });
 
   it('waitForEvent supports AbortSignal cancellation', async () => {
@@ -585,6 +588,9 @@ describe('CompanionRuntimeClient', () => {
     expect(() => client.waitForAnyEvent(['agent.stream', '  '])).toThrow(
       'eventNames must not contain empty values',
     );
+    expect(() => client.waitForAnyEvent(['agent.stream', 123 as unknown as string])).toThrow(
+      'eventNames must not contain empty values',
+    );
   });
 
   it('connects and performs node registration + capability discovery', async () => {
diff --git a/src/companion/runtimeClient.ts b/src/companion/runtimeClient.ts
index 053528d..aa9a652 100644
--- a/src/companion/runtimeClient.ts
+++ b/src/companion/runtimeClient.ts
@@ -437,7 +437,7 @@ export class CompanionRuntimeClient {
       signal?: AbortSignal;
     },
   ): Promise<TData> {
-    if (eventName.trim().length === 0) {
+    if (typeof eventName !== 'string' || eventName.trim().length === 0) {
       throw new Error('eventName must be a non-empty string');
     }
     const timeoutMs = options?.timeoutMs ?? this.requestTimeoutMs;
@@ -505,7 +505,11 @@ export class CompanionRuntimeClient {
     if (eventNames.length === 0) {
       throw new Error('eventNames must contain at least one event name');
     }
-    if (eventNames.some((eventName) => eventName.trim().length === 0)) {
+    if (
+      eventNames.some(
+        (eventName) => typeof eventName !== 'string' || eventName.trim().length === 0,
+      )
+    ) {
       throw new Error('eventNames must not contain empty values');
     }
     const eventNameSet = new Set(eventNames);