fix(deepseek): restore progressive Responses streaming

[baileyh8]

Summary

• Restore native upstream streaming for deepseek-v4-flash on the Responses passthrough path so Codex receives reasoning, text, and tool-call progress incrementally instead of waiting for one bounded JSON body.
• Add a provider/model-scoped terminal repair layer for DeepSeek Responses streams. It forwards healthy streams byte-for-byte and only synthesizes response.completed after every opened output item has a structurally complete output_item.done; partial, malformed, duplicate, contradictory, or unknown lifecycles fail closed with response.incomplete.
• Apply the same repaired event lifecycle to HTTP and WebSocket transports before inspection and item-ID rewriting, while preserving backpressure and the existing translator memory budget.
• Document the DeepSeek Responses streaming behavior in English and Chinese provider guides and add focused regression coverage for normal terminals, delayed/missing terminals, unsafe streams, aborts, and HTTP/WebSocket parity.

This branch is based on dev commit 18b46cf5478c9f682d28503d0636e169fbbad9ed.

Verification

• bun run typecheck — passed.
• bun run privacy:scan — passed.
• bun run test — 8,475 passed, 8 skipped, 0 failed across 8,483 tests in 543 files.
• ASTRO_TELEMETRY_DISABLED=1 bun run build in docs-site/ — 216 pages built successfully.
• Focused Responses/DeepSeek regression matrix — 170 passed, 0 failed.
• HTTP/WebSocket terminal-repair integration tests — 46 passed, 0 failed.
• DeepSeek Responses item-ID integration tests — 25 passed, 0 failed.
• Official DeepSeek streaming smoke through this branch's handleResponses path — HTTP 200, first output in about 0.7 seconds, reasoning and function-call events observed, and exactly one response.completed terminal.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I fixed all correct Codex and CodeRabbit findings.

• My PR is ready for review.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 396ab61a-3867-42f5-a581-51cfd42467cc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Review readiness checklist

This PR is kept in draft until every requirement below is fulfilled. The tickable checklist has been added to your PR description — tick all four boxes there.

• ⬜ All CI tests are green on my local testing.
• ⬜ I pushed my PR to the latest dev commit.
• ⬜ I fixed all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

0/4 boxes ticked.

This PR stays in draft until every box above is ticked.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[lidge-jun]

Reviewed as part of a sweep of the bug-labelled backlog. This is the strongest fix in that set — recording the verdict so it is not sitting in an unread queue.

The bug is real: dev forces deepseek-v4-flash to non-streaming upstream JSON (src/providers/registry.ts:1254-1257) because its native SSE can omit a terminal event, so clients get nothing until the whole response lands. Users experience that as a dead session.

What makes the fix defensible rather than merely effective is that it does not simply trust the stream. It removes the forced-JSON setting for that one model, wraps only its SSE path before the inspection/client split, and synthesizes response.completed only after every opened output item has a structurally complete output_item.done. Partial, malformed, duplicate, contradictory or unknown lifecycles fail closed with response.incomplete, and a real upstream completed/failed/incomplete stays authoritative. That is the right default: repair what is provably complete, refuse to invent the rest.

The terminal-repair tests are genuine — fragmentation, timer races, malformed calls, cancellation, budget exhaustion, plus HTTP and WebSocket integration. Each would fail without the wrapper.

Your remaining blocker is mechanical, not technical. The PR is still a draft and the head is 341 commits behind dev. The readiness gate checks two of the four checklist claims itself — the head's ci must be green and the branch must be at most 10 commits behind dev — so it will not accept a completion at this distance. Rebase onto current dev, re-run the suite, then tick the boxes.

Two files you are touching have moved since your base, so please rebase rather than merging dev in.

Nothing else from me. Once it is rebased and out of draft this is ready for a maintainer.