Reject ambiguous or embedded JSON in the local repair

Review of 451eae7 found three ways the parser took the wrong text:
- the fence regex backtracked for seconds on long whitespace, and ran
  before the plain parse;
- a fence inside a string of an unfinished object was taken as the answer;
- the first parsable span won, so "{} means omitted" beat the real object.

Plain JSON now parses first, a fence counts only when it wraps the whole
reply (found with indexOf, no regex), and a span is accepted only when it
is the one span in the reply that parses.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: Programcode

supabase/functions/ai/provider-errors_test.ts

@@ -52,8 +52,15 @@ Deno.test("common JSON slips are repaired locally instead of paying for a retry"
   assertEquals(parse('{"a":"keep , ] inside strings",}'), { a: "keep , ] inside strings" });
   // A broken outer object never yields one of its nested objects.
   assertThrows(() => parse('{"case": {"title": "x"}, oops}'));
-  // A reply cut off mid-object is not completed.
+  // A reply cut off mid-object is not completed, even around a fenced example.
   assertThrows(() => parse('{"contentions": [{"title": "x"}, {"title": "y"'));
+  assertThrows(() => parse('{"response":"Example:\n```\n{"response":"inner"}\n```\nunfinished'));
+  // Two objects that both parse leave the answer ambiguous.
+  assertThrows(() => parse('Note: {} means omitted. Answer: {"response":"Use evidence."}'));
+  // Fence-like text inside valid JSON parses at once.
+  const started = performance.now();
+  assertEquals(parse(JSON.stringify({ a: "```" + " ".repeat(20_000) + "x" })), { a: "```" + " ".repeat(20_000) + "x" });
+  assertEquals(performance.now() - started < 1_000, true);
 });
 
 Deno.test("a reply cut at the output cap is not retried, and a schema is sent as strict json_schema", async () => {

supabase/functions/ai/provider.ts

@@ -74,21 +74,34 @@ export function parseProviderContent(
  * second answer, so the common slips are fixed here first: markdown fences,
  * prose around the object, trailing commas, and raw line breaks inside
  * strings. A reply cut off mid-object is not completed: that would ship a
- * partial result as if it were whole.
+ * partial result as if it were whole. When prose holds more than one object
+ * that parses, the answer is ambiguous and the reply is rejected.
  */
 export function parseJsonFromText(text: string, providerName: string) {
   if (!text) throw new Error(`${providerName} returned empty response content`);
-  const candidates = [text];
-  const fenced = text.match(/```[a-z]*\s*([\s\S]*?)\s*```/i)?.[1];
-  if (fenced) candidates.push(fenced);
-  candidates.push(...balancedObjects(text));
-  for (const candidate of candidates) {
-    try { return JSON.parse(candidate); } catch { /* try the repaired text */ }
-    try { return JSON.parse(repairJsonText(candidate)); } catch { /* next candidate */ }
+  const whole = parseOrRepair(text);
+  if (whole.ok) return whole.value;
+  // A fence counts only when it wraps the reply. One inside a string of an
+  // unfinished object is an example, not the answer.
+  const trimmed = text.trim();
+  if (trimmed.startsWith("```")) {
+    const open = trimmed.indexOf("\n");
+    const close = trimmed.lastIndexOf("```");
+    if (open !== -1 && close > open) {
+      const fenced = parseOrRepair(trimmed.slice(open + 1, close));
+      if (fenced.ok) return fenced.value;
+    }
   }
+  const parsed = balancedObjects(text).map(parseOrRepair).filter((result): result is { ok: true; value: unknown } => result.ok);
+  if (parsed.length === 1) return parsed[0].value;
   throw new InvalidJsonResponseError(providerName, text);
 }
 
+function parseOrRepair(text: string): { ok: true; value: unknown } | { ok: false } {
+  try { return { ok: true, value: JSON.parse(text) }; } catch { /* try the repaired text */ }
+  try { return { ok: true, value: JSON.parse(repairJsonText(text)) }; } catch { return { ok: false }; }
+}
+
 // Prose before the answer may itself hold braces, so a few starts are tried.
 const MAX_OBJECT_STARTS = 8;