fix(infra): decode bounded JSON with TextDecoder to preserve BOM semantics

solodmd · claude · solodmd · commit 24c8d081bea2 · 2026-06-24T18:30:37.000+08:00
JSON.parse(buffer.toString('utf8')) retains a UTF-8 BOM, while
Response.json() strips it. A provider usage response with a BOM
prefix would be rejected as malformed. Use new TextDecoder().decode()
to match the sibling bounded-read pattern in provider-http-errors.ts.

Co-Authored-By: Claude &lt;noreply@anthropic.com&gt;
diff --git a/src/infra/provider-usage.fetch.shared.test.ts b/src/infra/provider-usage.fetch.shared.test.ts
@@ -163,6 +163,26 @@ describe("provider usage fetch shared helpers", () => {
       });
     });
 
+    it("parses UTF-8 BOM-prefixed JSON that response.json() would accept", async () => {
+      // \xEF\xBB\xBF is the UTF-8 BOM; response.json() strips it before
+      // JSON.parse, but Buffer.toString("utf8") preserves it. The bounded
+      // reader must use TextDecoder to match response.json() BOM semantics.
+      const bom = new Uint8Array([0xef, 0xbb, 0xbf]);
+      const json = new TextEncoder().encode(JSON.stringify({ windows: [] }));
+      const combined = new Uint8Array(bom.length + json.length);
+      combined.set(bom);
+      combined.set(json, bom.length);
+      const response = new Response(combined, {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      });
+      const result = await readUsageJson("anthropic", response);
+      expect(result).toEqual({
+        ok: true,
+        data: { windows: [] },
+      });
+    });
+
     it("rejects an oversized JSON response", async () => {
       let pullCount = 0;
       const cancel = vi.fn(async () => undefined);
diff --git a/src/infra/provider-usage.fetch.shared.ts b/src/infra/provider-usage.fetch.shared.ts
@@ -75,7 +75,7 @@ export async function readUsageJson(
       onOverflow: ({ size }) =>
         new Error(`Provider ${provider} usage response too large: ${size} bytes`),
     });
-    return { ok: true, data: JSON.parse(buffer.toString("utf8")) };
+    return { ok: true, data: JSON.parse(new TextDecoder().decode(buffer)) };
   } catch {
     return {
       ok: false,
