Guard dev health JSON parsing

Co-Authored-By: Paperclip <noreply@paperclip.ing>

server/src/__tests__/dev-runner-output.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { createCapturedOutputBuffer } from "../../../scripts/dev-runner-output.mjs";
+import { createCapturedOutputBuffer, parseJsonResponseWithLimit } from "../../../scripts/dev-runner-output.mjs";
 
 describe("createCapturedOutputBuffer", () => {
   it("keeps small output unchanged", () => {
@@ -26,4 +26,20 @@ describe("createCapturedOutputBuffer", () => {
     expect(result.text).toContain("total 12 bytes");
     expect(result.text.endsWith("efghijkl")).toBe(true);
   });
+
+  it("parses bounded JSON responses", async () => {
+    const response = new Response(JSON.stringify({ ok: true }), {
+      headers: { "content-type": "application/json" },
+    });
+
+    await expect(parseJsonResponseWithLimit<{ ok: boolean }>(response, 64)).resolves.toEqual({ ok: true });
+  });
+
+  it("rejects oversized JSON responses before parsing them", async () => {
+    const response = new Response(JSON.stringify({ payload: "x".repeat(128) }), {
+      headers: { "content-type": "application/json" },
+    });
+
+    await expect(parseJsonResponseWithLimit(response, 32)).rejects.toThrow("Response exceeds 32 bytes");
+  });
 });

server/src/__tests__/dev-server-status.test.ts

@@ -63,4 +63,14 @@ describe("dev server status helpers", () => {
       waitingForIdle: true,
     });
   });
+
+  it("ignores oversized persisted status files", () => {
+    const filePath = createTempStatusFile({
+      dirty: true,
+      changedPathsSample: ["x".repeat(70 * 1024)],
+      pendingMigrations: [],
+    });
+
+    expect(readPersistedDevServerStatus({ PAPERCLIP_DEV_SERVER_STATUS_FILE: filePath })).toBeNull();
+  });
 });