fix(governance): restack fatal UTF-8 production evidence on 293e338 main

scripts/production-environment-governance-audit.mjs

@@ -42,10 +42,25 @@ export function createGhSubprocessEnvironment(sourceEnvironment = process.env) {
   return childEnvironment;
 }
 
+/**
+ * Decode GitHub CLI output without allowing replacement characters to convert
+ * malformed remote evidence into a different, parseable JSON document.
+ *
+ * @param {Uint8Array} value Raw subprocess bytes.
+ * @param {string} [label="output"] Diagnostic stream label.
+ * @returns {string} Exact UTF-8 text.
+ */
+export function decodeGhOutput(value, label = "output") {
+  try {
+    return new TextDecoder("utf-8", { fatal: true }).decode(value);
+  } catch {
+    throw new Error(`GitHub CLI returned invalid UTF-8 in ${label}.`);
+  }
+}
+
 function runGh(args) {
   const childEnvironment = createGhSubprocessEnvironment();
   const completed = spawnSync("gh", args, {
-    encoding: "utf8",
     env: childEnvironment,
     maxBuffer: MAX_GH_OUTPUT_BYTES,
     shell: false,
@@ -55,11 +70,18 @@ function runGh(args) {
     throw new Error(`GitHub CLI could not start: ${bound(detail)}`);
   }
   if (completed.status !== 0) {
-    const rawDetail = completed.stderr || completed.stdout || `exit ${completed.status}`;
+    let rawDetail;
+    if (completed.stderr?.length) {
+      rawDetail = decodeGhOutput(completed.stderr, "stderr");
+    } else if (completed.stdout?.length) {
+      rawDetail = decodeGhOutput(completed.stdout, "stdout");
+    } else {
+      rawDetail = `exit ${completed.status}`;
+    }
     const detail = redactSensitiveValue(rawDetail, [childEnvironment.GH_TOKEN]);
     throw new Error(`GitHub CLI failed: ${bound(detail)}`);
   }
-  return completed.stdout.trim();
+  return decodeGhOutput(completed.stdout, "stdout").trim();
 }
 
 function collectEnvironment(repository) {

test/production-environment-governance-utf8.test.ts

@@ -0,0 +1,78 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  decodeGhOutput,
+  runGh,
+} from "../scripts/production-environment-governance-audit.mjs";
+
+function failureMessage(action: () => unknown) {
+  try {
+    action();
+  } catch (error) {
+    return error instanceof Error ? error.message : String(error);
+  }
+  throw new Error("expected action to fail");
+}
+
+describe("production environment governance GitHub CLI UTF-8 boundary", () => {
+  it("rejects malformed UTF-8 instead of replacement-decoding production evidence", () => {
+    expect(() =>
+      decodeGhOutput(
+        Uint8Array.from([0x7b, 0x22, 0xff, 0x22, 0x7d]),
+        "stdout",
+      ),
+    ).toThrow("GitHub CLI returned invalid UTF-8 in stdout.");
+  });
+
+  it("decodes valid UTF-8 bytes exactly", () => {
+    const bytes = new TextEncoder().encode('{"name":"production"}\n');
+    expect(decodeGhOutput(bytes, "stdout")).toBe('{"name":"production"}\n');
+  });
+
+  it("prefers stderr and redacts GH_TOKEN on the real runGh failure path", () => {
+    const token = "read-only-secret-token";
+    const message = failureMessage(() =>
+      runGh(["api", "example"], {
+        sourceEnvironment: { PATH: "/usr/bin:/bin", GH_TOKEN: token },
+        spawnSyncImpl: () => ({
+          status: 1,
+          stdout: Buffer.from(`stdout exposed ${token}`, "utf8"),
+          stderr: Buffer.from(`stderr exposed ${token}`, "utf8"),
+        }),
+      }),
+    );
+
+    expect(message).toBe("GitHub CLI failed: stderr exposed [REDACTED]");
+    expect(message).not.toContain(token);
+    expect(message).not.toContain("stdout exposed");
+  });
+
+  it("falls back to stdout and redacts GH_TOKEN when stderr is empty", () => {
+    const token = "read-only-secret-token";
+    const message = failureMessage(() =>
+      runGh(["api", "example"], {
+        sourceEnvironment: { PATH: "/usr/bin:/bin", GH_TOKEN: token },
+        spawnSyncImpl: () => ({
+          status: 1,
+          stdout: Buffer.from(`stdout exposed ${token}`, "utf8"),
+          stderr: Buffer.alloc(0),
+        }),
+      }),
+    );
+
+    expect(message).toBe("GitHub CLI failed: stdout exposed [REDACTED]");
+    expect(message).not.toContain(token);
+  });
+
+  it.each([
+    ["stderr", Buffer.from([0xff]), Buffer.from("valid stdout", "utf8")],
+    ["stdout", Buffer.alloc(0), Buffer.from([0xff])],
+  ] as const)("fails closed on malformed %s bytes from runGh", (label, stderr, stdout) => {
+    expect(() =>
+      runGh(["api", "example"], {
+        sourceEnvironment: { PATH: "/usr/bin:/bin", GH_TOKEN: "secret" },
+        spawnSyncImpl: () => ({ status: 1, stdout, stderr }),
+      }),
+    ).toThrow(`GitHub CLI returned invalid UTF-8 in ${label}.`);
+  });
+});