fix(http): force identity encoding so compressed API responses parse

lib/alerts.ts

@@ -1,6 +1,4 @@
-import { httpRequest } from '@socketsecurity/lib/http-request/request'
-
-import { buildJsonApiHeaders } from './http-helpers.ts'
+import { buildJsonApiHeaders, socketHttpRequest } from './http-helpers.ts'
 
 export interface AlertsFilters {
   // Comma-separated subset of: low,medium,high,critical
@@ -85,7 +83,9 @@ export async function fetchAlerts(
   const qs = buildAlertsQuery(options.filters).toString()
   const url = `${baseUrl}/v0/orgs/${encodeURIComponent(options.orgSlug)}/alerts${qs ? `?${qs}` : ''}`
 
-  const res = await httpRequest(url, { headers: buildJsonApiHeaders(options) })
+  const res = await socketHttpRequest(url, {
+    headers: buildJsonApiHeaders(options),
+  })
   if (!res.ok) {
     throw new Error(`alerts endpoint ${res.status}: ${res.text()}`)
   }

lib/blob.ts

@@ -1,4 +1,4 @@
-import { httpRequest } from '@socketsecurity/lib/http-request/request'
+import { socketHttpRequest } from './http-helpers.ts'
 
 export interface BlobResult {
   bytes: number
@@ -188,7 +188,7 @@ export async function fetchRawBytes(
   options.onRequest?.(url)
   let res
   try {
-    res = await httpRequest(url, { headers })
+    res = await socketHttpRequest(url, { headers })
   } catch (e) {
     throw new Error(`blob request to ${url} failed: ${(e as Error).message}`)
   }

lib/files.ts

@@ -1,6 +1,4 @@
-import { httpRequest } from '@socketsecurity/lib/http-request/request'
-
-import { buildJsonApiHeaders } from './http-helpers.ts'
+import { buildJsonApiHeaders, socketHttpRequest } from './http-helpers.ts'
 
 export function buildTree(entries: FileListEntry[]): TreeNode {
   const root: TreeNode = { name: '', isFile: false, children: new Map() }
@@ -126,7 +124,7 @@ export async function fetchFileList(
   options.onRequest?.(url)
   let res
   try {
-    res = await httpRequest(url, { headers })
+    res = await socketHttpRequest(url, { headers })
   } catch (e) {
     throw new Error(
       `file-list request to ${url} failed: ${(e as Error).message}`,

lib/http-helpers.ts

@@ -2,6 +2,9 @@ import readline from 'node:readline'
 import type { IncomingMessage, ServerResponse } from 'node:http'
 
 import { errorMessage } from '@socketsecurity/lib/errors'
+import { httpRequest } from '@socketsecurity/lib/http-request/request'
+import type { HttpRequestOptions } from '@socketsecurity/lib/http-request/request-types'
+import type { HttpResponse } from '@socketsecurity/lib/http-request/response-types'
 
 import { getTrustProxy } from './env.ts'
 import { logger } from './logger.ts'
@@ -193,6 +196,26 @@ export function parseJsonObject(
   }
 }
 
+// `@socketsecurity/lib@6.0.6`'s `httpRequest` advertises `Accept-Encoding:
+// gzip, br` but never decompresses the response on its main path — only the
+// unused `readIncomingResponse` bypass decodes. A `Content-Encoding: br` reply
+// (e.g. the Socket file-list endpoint) then reaches `.json()`/`.text()` as raw
+// compressed bytes and fails to parse with `Unexpected token '�'`. Until
+// the lib decodes on its main path, force `Accept-Encoding: identity` so the
+// server returns uncompressed bodies. The override is appended last so it wins
+// the lib's header merge (and any caller header) regardless of order. Route
+// every Socket-bound request through this wrapper so no call site can fall
+// back onto the broken decode path.
+export function socketHttpRequest(
+  url: string,
+  options: HttpRequestOptions = {},
+): Promise<HttpResponse> {
+  return httpRequest(url, {
+    ...options,
+    headers: { ...options.headers, 'Accept-Encoding': 'identity' },
+  })
+}
+
 // Helper for emitting JSON HTTP responses with a consistent Content-Type
 // and optional extra headers (used by writeOAuthError to attach
 // WWW-Authenticate).

lib/oauth.ts

@@ -6,14 +6,14 @@ import {
 } from './env.ts'
 import { getSocketDebug } from '@socketsecurity/lib/env/socket'
 import { errorMessage } from '@socketsecurity/lib/errors'
-import { httpRequest } from '@socketsecurity/lib/http-request/request'
 import { envAsBoolean } from '@socketsecurity/lib-stable/env/boolean'
 import type { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js'
 import type { IncomingMessage, ServerResponse } from 'node:http'
 import {
   assertSafeHttpUrl,
   getRequestHeaderValue,
   parseJsonObject,
+  socketHttpRequest,
   writeJson,
   writeOAuthError,
 } from './http-helpers.ts'
@@ -230,7 +230,7 @@ export async function loadOAuthMetadata(
         'SOCKET_OAUTH_ISSUER',
         ALLOW_LOCAL_OAUTH,
       )
-      const response = await httpRequest(
+      const response = await socketHttpRequest(
         new URL(OAUTH_WELL_KNOWN_PATH, issuerUrl).href,
       )
       const responseText = response.text()
@@ -344,7 +344,7 @@ export async function verifyAccessToken(
     'OAuth introspection_endpoint',
     ALLOW_LOCAL_OAUTH,
   ).href
-  const response = await httpRequest(introspectionUrl, {
+  const response = await socketHttpRequest(introspectionUrl, {
     method: 'POST',
     headers: {
       'Content-Type': 'application/x-www-form-urlencoded',

lib/threat-feed.ts

@@ -1,6 +1,4 @@
-import { httpRequest } from '@socketsecurity/lib/http-request/request'
-
-import { buildJsonApiHeaders } from './http-helpers.ts'
+import { buildJsonApiHeaders, socketHttpRequest } from './http-helpers.ts'
 
 export interface ThreatFeedFilters {
   // 1..100. API caps at 100 and defaults to 30.
@@ -98,7 +96,9 @@ export async function fetchThreatFeed(
   const qs = buildThreatFeedQuery(options.filters).toString()
   const url = `${baseUrl}/v0/orgs/${encodeURIComponent(options.orgSlug)}/threat-feed${qs ? `?${qs}` : ''}`
 
-  const res = await httpRequest(url, { headers: buildJsonApiHeaders(options) })
+  const res = await socketHttpRequest(url, {
+    headers: buildJsonApiHeaders(options),
+  })
   if (!res.ok) {
     throw new Error(`threat-feed endpoint ${res.status}: ${res.text()}`)
   }

lib/tool-depscore.ts

@@ -3,11 +3,10 @@ import { Type } from '@sinclair/typebox'
 import { getSocketDebug } from '@socketsecurity/lib/env/socket'
 import { errorMessage } from '@socketsecurity/lib/errors'
 import { envAsBoolean } from '@socketsecurity/lib-stable/env/boolean'
-import { httpRequest } from '@socketsecurity/lib/http-request/request'
 
 import { deduplicateArtifacts } from './artifacts.ts'
 import { getSocketApiUrl } from './env.ts'
-import { buildSocketHeaders } from './http-helpers.ts'
+import { buildSocketHeaders, socketHttpRequest } from './http-helpers.ts'
 import { logger } from './logger.ts'
 import { buildPurl } from './purl.ts'
 import { AUTH_REQUIRED_MSG, errorResult, resolveAuthToken } from './server.ts'
@@ -139,7 +138,7 @@ export async function handleDepscore(
 
   let response
   try {
-    response = await httpRequest(SOCKET_API_URL, {
+    response = await socketHttpRequest(SOCKET_API_URL, {
       method: 'POST',
       headers: buildSocketHeaders(accessToken),
       body: JSON.stringify({ components }),

package.json

@@ -68,8 +68,8 @@
     "@sinclair/typebox": "catalog:",
     "@socketregistry/packageurl-js": "catalog:",
     "@socketregistry/packageurl-js-stable": "catalog:",
-    "@socketsecurity/lib": "npm:@socketsecurity/lib@6.0.3",
-    "@socketsecurity/lib-stable": "npm:@socketsecurity/lib@6.0.3",
+    "@socketsecurity/lib": "npm:@socketsecurity/lib@6.0.7",
+    "@socketsecurity/lib-stable": "npm:@socketsecurity/lib@6.0.7",
     "@socketsecurity/sdk": "catalog:",
     "@socketsecurity/sdk-stable": "catalog:",
     "@types/node": "^24.12.4",

pnpm-workspace.yaml

@@ -14,8 +14,8 @@ catalog:
   '@sinclair/typebox': 0.34.49
   '@socketregistry/packageurl-js': 1.4.2
   '@socketregistry/packageurl-js-stable': npm:@socketregistry/packageurl-js@1.4.2
-  '@socketsecurity/lib': 6.0.6
-  '@socketsecurity/lib-stable': npm:@socketsecurity/lib@6.0.6
+  '@socketsecurity/lib': 6.0.7
+  '@socketsecurity/lib-stable': npm:@socketsecurity/lib@6.0.7
   '@socketsecurity/registry': 2.0.2
   '@socketsecurity/registry-stable': npm:@socketsecurity/registry@2.0.2
   '@socketsecurity/sdk': 4.0.1