Catch the Decode Error Too, at Both Reads That Parse a File

`report` and `registration_problems` each caught JSONDecodeError and
OSError, and a file holding bytes no decoder accepts raises
UnicodeDecodeError before the JSON parser is reached. A partially written
stamp therefore crashed the read-only report with a traceback, which is
what those handlers exist to prevent.
Both catch ValueError now, which covers JSONDecodeError and
UnicodeDecodeError alike, rather than naming the subclass and missing its
sibling.
Two cases added, one per call site, both failing against the previous code.
The settings one is included because the finding named only the stamp and
the same shape was two hundred lines above it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: ptr727

host-setup/agent-safety/install.py

@@ -294,7 +294,9 @@ def registration_problems(claude_home):
 return ["settings.json is missing, so the hook is not registered"]
 try:
 data=json.loads(settings.read_text(encoding="utf-8") or"{}")
-except (json.JSONDecodeError, OSError) ase:
+# ValueError rather than JSONDecodeError, since it also covers UnicodeDecodeError.
+# A partially written or non-UTF-8 file raises that before the JSON parser is ever reached.
+except (ValueError, OSError) ase:
 return [f"settings.json cannot be read ({e})"]
 ifnotisinstance(data, dict):
 return ["settings.json does not hold an object at its root"]
@@ -353,7 +355,9 @@ def report(claude_home):
 return2
 try:
 stamp=json.loads(path.read_text(encoding="utf-8"))
-except (json.JSONDecodeError, OSError) ase:
+# ValueError rather than JSONDecodeError, since it also covers UnicodeDecodeError.
+# A partially written or non-UTF-8 file raises that before the JSON parser is ever reached.
+except (ValueError, OSError) ase:
 sys.stderr.write(f"Stamp at {path} is unreadable ({e}). Re-run the installer to rewrite it.\n")
 return2
 # Valid JSON is not a usable stamp: a hand edit or an older format parses and then breaks the read.

host-setup/agent-safety/test_install.py

@@ -211,6 +211,23 @@ def test_a_stamp_missing_required_keys_gives_a_verdict_rather_than_a_traceback(s
 self.assertIn("missing", r.stderr)
 self.assertNotIn("Traceback", r.stderr)
 
+deftest_a_stamp_holding_invalid_utf8_gives_a_verdict_rather_than_a_traceback(self):
+"""A partial write leaves bytes no decoder accepts, which raises before JSON is reached."""
+self.install()
+self.stamp.write_bytes(b'{"host": "\xff\xfe not utf-8"}')
+r=run(self.home, "--report")
+self.assertEqual(r.returncode, 2, r.stdout+r.stderr)
+self.assertIn("unreadable", r.stderr)
+self.assertNotIn("Traceback", r.stderr)
+
+deftest_settings_holding_invalid_utf8_reports_stale_rather_than_a_traceback(self):
+"""The registration read has the same shape and needed the same widening."""
+self.install()
+ (self.home/"settings.json").write_bytes(b'{"hooks": "\xff\xfe"}')
+r=run(self.home, "--report")
+self.assertEqual(r.returncode, 1, r.stdout+r.stderr)
+self.assertNotIn("Traceback", r.stderr)
+
 deftest_a_stamp_holding_a_non_object_gives_a_verdict_rather_than_a_traceback(self):
 self.install()
 self.stamp.write_text("[]\n", encoding="utf-8")