fix(responses): bound synthesized SSE expansion

[luvs01]

Summary

• cap bounded-JSON Responses synthesis at 10,000 output items across HTTP and WebSocket reframing;
• generate the shared Responses event sequence lazily;
• stream HTTP SSE frames one pull at a time instead of retaining the expanded event array and joined body;
• fail a streaming HTTP request with a local 502 when the synthesis cap is exceeded;
• preserve DeepSeek item-id repair, status, headers, and the exact [DONE] trailer.

Why

A bounded upstream JSON response can still contain many output items. The previous HTTP path materialized both a complete event array and the complete SSE string, amplifying a provider-controlled response in memory. The shared WebSocket event sequence also had no item-count ceiling.

The cap is checked before a stream is returned. Malformed/non-object JSON retains the existing plain-response fallback, while a cap violation is not swallowed by that fallback. If item-id repair fails, the path also falls back instead of synthesizing unrepaired identifiers.

Verification

• Bun 1.3.14: focused Responses event and DeepSeek bounded-JSON suites 13/13 passed.
• Bun 1.4.0-canary.1 (b22e0e6d0): the same suites 13/13 passed.
• Handler regression proves a stream:true request above the cap returns JSON HTTP 502 with the standard server_error shape and no [DONE] stream.
• Helper regressions prove synchronous cap enforcement and one-frame-per-pull serialization.
• bun x tsc --noEmit: passed.
• bun scripts/privacy-scan.ts: passed.
• git diff --check: passed.
• Independent read-only review found no blocking P0/P1 issue; the shared WebSocket cap is intentional and documented.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

Summary by CodeRabbit

• Bug Fixes

  • Capped synthesized response output at 10,000 items to prevent oversized event streams.
  • Oversized responses now return a clear server error instead of producing incomplete output.

• Improvements

  • SSE responses are generated and delivered incrementally, reducing memory usage.
  • Streaming responses preserve status handling and conclude with the [DONE] marker.

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR limits synthesized output to 10,000 items. It generates response frames incrementally, adds SSE stream conversion, updates bounded JSON handling, and adds overflow and streaming tests.

Changes

Synthesized SSE output handling

Layer / File(s)	Summary
Bounded frame generation src/server/responses-json-events.ts:10-11, src/server/responses-json-events.ts:21-52	Adds MAX_SYNTHESIZED_OUTPUT_ITEMS and uses a shared generator to yield response frames while enforcing the item limit.
Incremental SSE integration src/server/responses-json-events.ts:67-90, src/server/responses/core.ts:194, src/server/responses/core.ts:2326-2365, structure/04-transports-and-sidecars.md:221-222	Adds responsesJsonToSseStream, updates bounded JSON conversion to use it, preserves item-ID repair, and maps oversized synthesis to a 502 response.
Limit and stream validation tests/deepseek-responses-item-id-repair.test.ts:9, tests/deepseek-responses-item-id-repair.test.ts:162-190, tests/responses-json-events.test.ts:3-6, tests/responses-json-events.test.ts:65-88	Tests overflow handling for body and stream conversion, HTTP 502 behavior without [DONE], and incremental frame emission with a final [DONE] chunk.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant BoundedJSONPath
  participant responsesJsonToSseStream
  participant ReadableStream
  BoundedJSONPath->>responsesJsonToSseStream: pass repaired bounded JSON response
  responsesJsonToSseStream->>ReadableStream: enqueue encoded frames incrementally
  responsesJsonToSseStream->>ReadableStream: enqueue data: [DONE]\n\n

Loading

Possibly related PRs

• lidge-jun/opencodex#1006: Both modify the bounded JSON-to-SSE conversion path in src/server/responses/core.ts.
• lidge-jun/opencodex#1088: Both modify bounded JSON response handling in src/server/responses/core.ts.
• lidge-jun/opencodex#1095: Both modify Responses streaming conversion and related tests.

Suggested reviewers: lidge-jun, wibias

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: limiting synthesized SSE expansion for Responses.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• review readiness checklist open (2/4 boxes ticked).

What to do

• Tick all four boxes in the PR description once you're done (currently 2/4).

Review readiness checklist

• ✅ All CI tests are green on my local testing.
• ✅ I pushed my PR to the latest dev commit.
• ⬜ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

2/4 boxes ticked.

This PR stays in draft until every box above is ticked.

[luvs01]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[lidge-jun]

Reran the cancelled Cross-platform CI run at b50f23943 and it came back success. The earlier cancelled was not a failure of yours — Linux shards have been hanging intermittently and getting killed at the job timeout today, which I filed as #1302.

One thing that green does not cover: this branch is 325 commits behind dev. A pass against a base that old says the code worked then, not that it works now. A rebase would make the result mean something, and it is yours to do rather than mine — I have been republishing stale contributor PRs today where the rebase was mechanical, but I would rather you keep authorship of this one if you are still on it.

Still a draft pending your four readiness boxes. Tell me if you would rather I take the rebase, or if you would rather close it.

[lidge-jun]

Landed on dev as 20969a6 with your authorship preserved, plus one corrective commit on top (3bfe807).

Your generator, the 10,000-item cap, and the incremental HTTP stream were the right shape — src/server/responses-json-events.ts:24-38 really did materialize the whole event array before framing. What blocked it was staleness rather than design: dev commit 0b8e608c0 retired DeepSeek production bounded-JSON opt-in, so after rebase your handler regression failed with expected 502, received 200 — it was no longer exercising the capped path at all.

The correction moves that over-cap 502 regression onto the existing synthetic modelResponsesUpstreamStreaming:false fixture, and keeps current dev's "no production registry entry opts in" wording in structure/04_transports-and-sidecars.md with your cap guarantee appended rather than overwriting it. Red ablation confirmed the moved test still catches the bug: removing the cap reproduces Expected: 502, Received: 200.

Full suite green on the landed head. Thanks.