fix(api): add safe JSON parsing for upstream provider responses

backend/package.json

@@ -9,6 +9,7 @@
     "check:tsgo": "tsgo -p tsconfig.check.json",
     "check": "tsc -p tsconfig.check.json",
     "dev": "COMMIT_SHA=$(git rev-parse HEAD) CONSOLA_LEVEL=9999 FRONTEND_DIR=../frontend/dist DOCS_DIR=docs bun --watch --hot --no-clear-screen --inspect src/index.ts",
+    "test": "bun test",
     "fmt": "oxfmt .",
     "fmt:check": "oxfmt --check .",
     "lint": "oxlint --type-aware"

backend/src/adapters/request/openai-chat.ts

@@ -15,6 +15,7 @@ import type {
   ToolResultContentBlock,
   ToolUseContentBlock,
 } from "../types";
+import { safeParseToolArgs } from "@/utils/json";
 
 // =============================================================================
 // Helper Functions
@@ -191,7 +192,7 @@ function convertToolCalls(
     type: "tool_use" as const,
     id: tc.id,
     name: tc.function.name,
-    input: JSON.parse(tc.function.arguments) as Record<string, unknown>,
+    input: safeParseToolArgs(tc.function.arguments),
   }));
 }
 
@@ -229,10 +230,7 @@ function convertMessage(msg: OpenAIChatMessage): InternalMessage {
               type: "tool_use" as const,
               id: "legacy_function_call",
               name: msg.function_call.name,
-              input: JSON.parse(msg.function_call.arguments) as Record<
-                string,
-                unknown
-              >,
+              input: safeParseToolArgs(msg.function_call.arguments),
             },
           ]
         : undefined;

backend/src/adapters/tools.ts

@@ -8,6 +8,7 @@ import type {
   JsonSchema,
   ToolUseContentBlock,
 } from "./types";
+import { safeParseToolArgs } from "@/utils/json";
 
 // =============================================================================
 // OpenAI Tool Types
@@ -135,7 +136,7 @@ export function fromOpenAIToolCalls(
     type: "tool_use" as const,
     id: tc.id,
     name: tc.function.name,
-    input: parseJsonSafe(tc.function.arguments),
+    input: safeParseToolArgs(tc.function.arguments),
   }));
 }
 
@@ -283,17 +284,6 @@ export function fromAnthropicToolChoice(
 // Utility Functions
 // =============================================================================
 
-/**
- * Safely parse JSON string, returning empty object on failure
- */
-function parseJsonSafe(jsonString: string): Record<string, unknown> {
-  try {
-    return JSON.parse(jsonString) as Record<string, unknown>;
-  } catch {
-    return {};
-  }
-}
-
 /**
  * Generate a unique tool call ID
  */

backend/src/adapters/upstream/anthropic.ts

@@ -17,6 +17,7 @@ import type {
   ToolUseContentBlock,
   UpstreamAdapter,
 } from "../types";
+import { parseJsonResponse } from "@/utils/json";
 
 // =============================================================================
 // Anthropic Request/Response Types
@@ -487,7 +488,7 @@ export const anthropicUpstreamAdapter: UpstreamAdapter = {
 
   async parseResponse(response: Response): Promise<InternalResponse> {
     const text = await response.text();
-    const json = JSON.parse(text) as AnthropicResponse;
+    const json = parseJsonResponse<AnthropicResponse>(text, "Anthropic");
     return convertResponse(json);
   },
 

backend/src/adapters/upstream/openai-responses.ts

@@ -17,6 +17,7 @@ import type {
   UpstreamAdapter,
 } from "../types";
 import { convertImageToUrl, hasImages } from "./utils";
+import { safeParseToolArgs, parseJsonResponse } from "@/utils/json";
 
 // =============================================================================
 // Response API Types
@@ -237,7 +238,7 @@ function convertResponse(resp: ResponseApiResponse): InternalResponse {
         id: output.call_id || output.id || "",
         name: output.name || "",
         input: output.arguments
-          ? (JSON.parse(output.arguments) as Record<string, unknown>)
+          ? safeParseToolArgs(output.arguments)
           : {},
       } as ToolUseContentBlock);
     }
@@ -365,7 +366,7 @@ export const openaiResponsesUpstreamAdapter: UpstreamAdapter = {
 
   async parseResponse(response: Response): Promise<InternalResponse> {
     const text = await response.text();
-    const json = JSON.parse(text) as ResponseApiResponse;
+    const json = parseJsonResponse<ResponseApiResponse>(text, "OpenAI Responses");
     return convertResponse(json);
   },
 

backend/src/adapters/upstream/openai.ts

@@ -19,6 +19,7 @@ import type {
   UpstreamAdapter,
 } from "../types";
 import { convertImageToUrl, hasImages } from "./utils";
+import { safeParseToolArgs, parseJsonResponse } from "@/utils/json";
 
 // =============================================================================
 // OpenAI Request/Response Types
@@ -321,7 +322,7 @@ function convertResponse(resp: OpenAIChatResponse): InternalResponse {
         type: "tool_use",
         id: tc.id,
         name: tc.function.name,
-        input: JSON.parse(tc.function.arguments) as Record<string, unknown>,
+        input: safeParseToolArgs(tc.function.arguments),
       } as ToolUseContentBlock);
     }
   }
@@ -450,7 +451,7 @@ export const openaiUpstreamAdapter: UpstreamAdapter = {
 
   async parseResponse(response: Response): Promise<InternalResponse> {
     const text = await response.text();
-    const json = JSON.parse(text) as OpenAIChatResponse;
+    const json = parseJsonResponse<OpenAIChatResponse>(text, "OpenAI Chat");
     return convertResponse(json);
   },
 

backend/src/api/v1/completions.ts

@@ -643,7 +643,17 @@ export const completionsApi = new Elysia({
 
           if (errorResult.type === "upstream_error") {
             set.status = errorResult.status;
-            return JSON.parse(errorResult.body) as Record<string, unknown>;
+            try {
+              return JSON.parse(errorResult.body) as Record<string, unknown>;
+            } catch {
+              return {
+                error: {
+                  message: errorResult.body,
+                  type: "upstream_error",
+                  code: "unparseable_error",
+                },
+              };
+            }
           }
 
           set.status = 502;
@@ -730,7 +740,17 @@ export const completionsApi = new Elysia({
 
           if (errorResult.type === "upstream_error") {
             set.status = errorResult.status;
-            return JSON.parse(errorResult.body) as Record<string, unknown>;
+            try {
+              return JSON.parse(errorResult.body) as Record<string, unknown>;
+            } catch {
+              return {
+                error: {
+                  message: errorResult.body,
+                  type: "upstream_error",
+                  code: "unparseable_error",
+                },
+              };
+            }
           }
 
           set.status = 502;

backend/src/api/v1/messages.ts

@@ -40,6 +40,7 @@ import {
   type ReqIdContext,
 } from "@/utils/reqIdHandler";
 import type { CachedResponseType } from "@/db/schema";
+import { safeParseToolArgs } from "@/utils/json";
 
 const logger = consola.withTag("messagesApi");
 
@@ -292,7 +293,7 @@ async function* processStreamingResponse(
                   type: "tool_use",
                   id: tc.id,
                   name: tc.function.name,
-                  input: JSON.parse(tc.function.arguments || "{}"),
+                  input: safeParseToolArgs(tc.function.arguments || "{}"),
                 });
               }
             }
@@ -625,7 +626,18 @@ export const messagesApi = new Elysia({
 
           if (errorResult.type === "upstream_error") {
             set.status = errorResult.status;
-            return JSON.parse(errorResult.body) as Record<string, unknown>;
+            try {
+              return JSON.parse(errorResult.body) as Record<string, unknown>;
+            } catch {
+              return {
+                type: "error",
+                error: {
+                  type: "api_error",
+                  message: errorResult.body,
+                  code: "unparseable_error",
+                },
+              };
+            }
           }
 
           set.status = 502;
@@ -713,7 +725,18 @@ export const messagesApi = new Elysia({
 
           if (errorResult.type === "upstream_error") {
             set.status = errorResult.status;
-            return JSON.parse(errorResult.body) as Record<string, unknown>;
+            try {
+              return JSON.parse(errorResult.body) as Record<string, unknown>;
+            } catch {
+              return {
+                type: "error",
+                error: {
+                  type: "api_error",
+                  message: errorResult.body,
+                  code: "unparseable_error",
+                },
+              };
+            }
           }
 
           set.status = 502;

backend/src/api/v1/responses.ts

@@ -675,7 +675,18 @@ export const responsesApi = new Elysia({
 
           if (errorResult.type === "upstream_error") {
             set.status = errorResult.status;
-            return JSON.parse(errorResult.body) as Record<string, unknown>;
+            try {
+              return JSON.parse(errorResult.body) as Record<string, unknown>;
+            } catch {
+              return {
+                object: "error",
+                error: {
+                  type: "upstream_error",
+                  message: errorResult.body,
+                  code: "unparseable_error",
+                },
+              };
+            }
           }
 
           set.status = 502;
@@ -763,7 +774,18 @@ export const responsesApi = new Elysia({
 
           if (errorResult.type === "upstream_error") {
             set.status = errorResult.status;
-            return JSON.parse(errorResult.body) as Record<string, unknown>;
+            try {
+              return JSON.parse(errorResult.body) as Record<string, unknown>;
+            } catch {
+              return {
+                object: "error",
+                error: {
+                  type: "upstream_error",
+                  message: errorResult.body,
+                  code: "unparseable_error",
+                },
+              };
+            }
           }
 
           set.status = 502;