Fix stream compatibility and vision model exposure

internal/devcapture/store.go

@@ -10,6 +10,8 @@ import (
 	"sync"
 	"time"
 
+	"ds2api/internal/util"
+
 	"github.com/google/uuid"
 )
 
@@ -194,7 +196,8 @@ func (c *captureBody) append(chunk string) {
 	}
 	remain := maxLen - current
 	if len(chunk) > remain {
-		c.buf.WriteString(chunk[:remain])
+		truncated, _ := util.TruncateUTF8Bytes(chunk, remain)
+		c.buf.WriteString(truncated)
 		c.truncated = true
 		return
 	}

internal/devcapture/store_test.go

@@ -4,6 +4,7 @@ import (
 	"io"
 	"strings"
 	"testing"
+	"unicode/utf8"
 )
 
 func TestNewFromEnvDefaults(t *testing.T) {
@@ -82,3 +83,28 @@ func TestWrapBodyTruncatesByLimit(t *testing.T) {
 		t.Fatalf("expected account id, got %q", items[0].AccountID)
 	}
 }
+
+func TestWrapBodyTruncatesUTF8WithoutBreakingRune(t *testing.T) {
+	s := &Store{enabled: true, limit: 5, maxBodyBytes: 5}
+	session := s.Start("test", "http://x", "acc1", map[string]any{"x": 1})
+	if session == nil {
+		t.Fatal("expected session")
+	}
+	rc := session.WrapBody(io.NopCloser(strings.NewReader("😀xy")), 200)
+	_, _ = io.ReadAll(rc)
+	_ = rc.Close()
+
+	items := s.Snapshot()
+	if len(items) != 1 {
+		t.Fatalf("expected 1 item, got %d", len(items))
+	}
+	if !utf8.ValidString(items[0].ResponseBody) {
+		t.Fatalf("expected valid utf-8 response body, got %q", items[0].ResponseBody)
+	}
+	if items[0].ResponseBody != "😀x" {
+		t.Fatalf("expected rune-safe truncation, got %q", items[0].ResponseBody)
+	}
+	if !items[0].ResponseTruncated {
+		t.Fatal("expected truncated flag true")
+	}
+}