fix(api): enforce utf8 request bodies

tests/integration/work-product-url-policy.spec.ts

@@ -93,6 +93,46 @@ async function createHarness() {
 }
 
 describe("work product URL API policy", () => {
+  it("rejects JSON bodies that declare a non UTF-8 charset", async () => {
+    const harness = await createHarness();
+    try {
+      const response = await fetch(`${harness.baseUrl}/api/issues/${harness.taskId}/work-products`, {
+        method: "POST",
+        headers: {
+          ...harness.headers,
+          "Content-Type": "application/json; charset=gbk",
+        },
+        body: JSON.stringify({ type: "link", provider: "external", title: "Report" }),
+      });
+
+      expect(response.status).toBe(415);
+      expect(harness.db.queryAll("select id from work_products")).toHaveLength(0);
+    } finally {
+      harness.server.stop();
+      harness.db.close();
+    }
+  });
+
+  it("rejects JSON bodies with duplicate charset declarations", async () => {
+    const harness = await createHarness();
+    try {
+      const response = await fetch(`${harness.baseUrl}/api/issues/${harness.taskId}/work-products`, {
+        method: "POST",
+        headers: {
+          ...harness.headers,
+          "Content-Type": "application/json; charset=gbk; charset=utf-8",
+        },
+        body: JSON.stringify({ type: "link", provider: "external", title: "Report" }),
+      });
+
+      expect(response.status).toBe(415);
+      expect(harness.db.queryAll("select id from work_products")).toHaveLength(0);
+    } finally {
+      harness.server.stop();
+      harness.db.close();
+    }
+  });
+
   it("rejects unknown work product taxonomy during creation", async () => {
     const harness = await createHarness();
     try {

tests/unit/api-body-encoding.test.ts

@@ -0,0 +1,20 @@
+import { describe, expect, it } from "vitest";
+import { decodeBodyToUtf8 } from "../../src/main/api-server/server-core";
+
+describe("API request body encoding", () => {
+  it("decodes valid UTF-8 JSON", () => {
+    const raw = Buffer.from(JSON.stringify({ text: "中文" }), "utf8");
+
+    expect(decodeBodyToUtf8(raw)).toBe("{\"text\":\"中文\"}");
+  });
+
+  it("rejects GBK bytes instead of repairing them", () => {
+    const raw = Buffer.from([
+      0x7b, 0x22, 0x74, 0x65, 0x78, 0x74, 0x22, 0x3a, 0x22,
+      0xd6, 0xd0, 0xce, 0xc4,
+      0x22, 0x7d,
+    ]);
+
+    expect(() => decodeBodyToUtf8(raw)).toThrow();
+  });
+});