- xAI tools: report malformed web search, X search, and code execution JSON with provider-owned errors instead of leaking raw parser failures.

- Nextcloud Talk: report malformed room-info and bot-admin JSON with channel-owned errors instead of leaking raw parser failures.

- Microsoft Teams: report malformed Graph and delegated OAuth JSON with channel-owned errors instead of leaking raw parser failures.

- Google Chat: report malformed Chat API and certificate JSON with channel-owned errors instead of leaking raw parser failures.

- Twilio voice-call: report malformed successful API JSON responses with provider-owned errors instead of leaking raw parser failures.

- Voice-call provider APIs: report malformed successful guarded JSON responses with provider-prefixed errors instead of leaking raw parser failures.

- Realtime transcription: report malformed provider websocket JSON frames with owned parser errors instead of leaking raw `SyntaxError` objects.

const CHAT_API_BASE = "https://chat.googleapis.com/v1";

const CHAT_UPLOAD_BASE = "https://chat.googleapis.com/upload/v1";

async function readGoogleChatJsonResponse<T>(response: Response, label: string): Promise<T> {

try {

return (await response.json()) as T;

} catch (cause) {

throw new Error(`${label}: malformed JSON response`, { cause });

}

}

const headersToObject = (headers?: HeadersInit): Record<string, string> =>

headers instanceof Headers

? Object.fromEntries(headers.entries())

},

},

auditContext: "googlechat.api.json",

handleResponse: async (response) => (await response.json()) as T,

handleResponse: async (response) =>

await readGoogleChatJsonResponse<T>(response, "Google Chat API request failed"),

});

}

auditContext: "googlechat.upload",

errorPrefix: "Google Chat upload",

handleResponse: async (response) =>

(await response.json()) as {

await readGoogleChatJsonResponse<{

attachmentDataRef?: { attachmentUploadToken?: string };

},

}>(response, "Google Chat upload failed"),

});

return {

attachmentUploadToken: payload.attachmentDataRef?.attachmentUploadToken,

const CHAT_CERTS_URL =

"https://www.googleapis.com/service_accounts/v1/metadata/x509/chat@system.gserviceaccount.com";

async function readGoogleChatCertsResponse(response: Response): Promise<Record<string, string>> {

try {

return (await response.json()) as Record<string, string>;

} catch (cause) {

throw new Error("Google Chat cert fetch failed: malformed JSON response", { cause });

}

}

// Size-capped to prevent unbounded growth in long-running deployments (#4948)

const MAX_AUTH_CACHE_SIZE = 32;

type GoogleAuthModule = typeof import("google-auth-library");

if (!response.ok) {

throw new Error(`Failed to fetch Chat certs (${response.status})`);

}

const certs = (await response.json()) as Record<string, string>;

const certs = await readGoogleChatCertsResponse(response);

cachedCerts = { fetchedAt: now, certs };

return certs;

} finally {

const url = mockCallArg(fetchMock);

expect(String(url)).not.toContain("messageReplyOption=");

});

it("reports malformed send JSON with a stable API error", async () => {

vi.stubGlobal(

"fetch",

vi.fn().mockResolvedValue(

new Response("{ nope", {

status: 200,

headers: { "content-type": "application/json" },

}),

),

);

await expect(

sendGoogleChatMessage({

account,

space: "spaces/AAA",

text: "hello",

}),

).rejects.toThrow("Google Chat API request failed: malformed JSON response");

});

});

function mockTicket(payload: Record<string, unknown>) {

);

expect(release).toHaveBeenCalledOnce();

});

it("reports malformed Chat cert JSON with a stable auth error", async () => {

authTesting.resetGoogleChatAuthForTests();

const release = vi.fn(async () => {});

mocks.fetchWithSsrFGuard.mockResolvedValueOnce({

response: new Response("{ nope", {

status: 200,

headers: { "content-type": "application/json" },

}),

release,

});

await expect(

verifyGoogleChatRequest({

bearer: "token",

audienceType: "project-number",

audience: "123456789",

}),

).rejects.toThrow("Google Chat cert fetch failed: malformed JSON response");

expect(release).toHaveBeenCalledOnce();

});

});