fix(agents): use fatal UTF-8 decoding for provider JSON responses (#108849)

* fix(agents): use fatal UTF-8 decoding in provider response readers

* fix(agents): use fatal UTF-8 decoding only for JSON responses, preserve compatibility for text

src/agents/provider-http-errors.test.ts

@@ -360,6 +360,19 @@ describe("provider error utils", () => {
     expect(streamed.getReadCount()).toBeLessThan(20);
   });
 
+  it("rejects provider JSON responses with invalid UTF-8 bytes instead of silently replacing them", async () => {
+    const invalidUtf8Bytes = new Uint8Array([0x7b, 0x22, 0x6b, 0x65, 0x79, 0x22, 0x3a, 0xff, 0x7d]);
+    const response = new Response(invalidUtf8Bytes.buffer, {
+      status: 200,
+      headers: { "Content-Type": "application/json" },
+    });
+
+    await expect(readProviderJsonResponse(response, "Provider JSON failed")).rejects.toMatchObject({
+      message: "Provider JSON failed: malformed JSON response",
+      cause: expect.any(TypeError) as unknown,
+    });
+  });
+
   it("caps successful text responses instead of buffering oversized bodies", async () => {
     const streamed = createStreamingTextResponse({
       chunkCount: 20,

src/agents/provider-http-errors.ts

@@ -341,7 +341,7 @@ export async function readProviderJsonResponse<T>(
       new Error(`${label}: JSON response exceeds ${maxBytesLocal} bytes`),
   });
   try {
-    return JSON.parse(new TextDecoder().decode(bytes)) as T;
+    return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes)) as T;
   } catch (cause) {
     throw new Error(`${label}: malformed JSON response`, { cause });
   }