fix(responses): bound synthesized SSE expansion

[luvs01]

Summary

• cap bounded-JSON Responses synthesis at 10,000 output items across HTTP and WebSocket reframing;
• generate the shared Responses event sequence lazily;
• stream HTTP SSE frames one pull at a time instead of retaining the expanded event array and joined body;
• fail a streaming HTTP request with a local 502 when the synthesis cap is exceeded;
• preserve DeepSeek item-id repair, status, headers, and the exact [DONE] trailer.

Why

A bounded upstream JSON response can still contain many output items. The previous HTTP path materialized both a complete event array and the complete SSE string, amplifying a provider-controlled response in memory. The shared WebSocket event sequence also had no item-count ceiling.

The cap is checked before a stream is returned. Malformed/non-object JSON retains the existing plain-response fallback, while a cap violation is not swallowed by that fallback. If item-id repair fails, the path also falls back instead of synthesizing unrepaired identifiers.

Verification

• Bun 1.3.14: focused Responses event and DeepSeek bounded-JSON suites 13/13 passed.
• Bun 1.4.0-canary.1 (b22e0e6d0): the same suites 13/13 passed.
• Handler regression proves a stream:true request above the cap returns JSON HTTP 502 with the standard server_error shape and no [DONE] stream.
• Helper regressions prove synchronous cap enforcement and one-frame-per-pull serialization.
• bun x tsc --noEmit: passed.
• bun scripts/privacy-scan.ts: passed.
• git diff --check: passed.
• Independent read-only review found no blocking P0/P1 issue; the shared WebSocket cap is intentional and documented.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

Summary by CodeRabbit

• Bug Fixes

  • Capped synthesized response output at 10,000 items to prevent oversized event streams.
  • Oversized responses now return a clear server error instead of producing incomplete output.

• Improvements

  • SSE responses are generated and delivered incrementally, reducing memory usage.
  • Streaming responses preserve status handling and conclude with the [DONE] marker.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: a29f49f1-775d-4e46-a517-af8af13252d1

📥 Commits

Reviewing files that changed from the base of the PR and between 44dce33 and b50f239.

📒 Files selected for processing (5)

• src/server/responses-json-events.ts
• src/server/responses/core.ts
• structure/04_transports-and-sidecars.md
• tests/deepseek-responses-item-id-repair.test.ts
• tests/responses-json-events.test.ts

---

📝 Walkthrough

Walkthrough

The PR limits synthesized output to 10,000 items. It generates response frames incrementally, adds SSE stream conversion, updates bounded JSON handling, and adds overflow and streaming tests.

Changes

Synthesized SSE output handling

Layer / File(s)	Summary
Bounded frame generation src/server/responses-json-events.ts:10-11, src/server/responses-json-events.ts:21-52	Adds MAX_SYNTHESIZED_OUTPUT_ITEMS and uses a shared generator to yield response frames while enforcing the item limit.
Incremental SSE integration src/server/responses-json-events.ts:67-90, src/server/responses/core.ts:194, src/server/responses/core.ts:2326-2365, structure/04-transports-and-sidecars.md:221-222	Adds responsesJsonToSseStream, updates bounded JSON conversion to use it, preserves item-ID repair, and maps oversized synthesis to a 502 response.
Limit and stream validation tests/deepseek-responses-item-id-repair.test.ts:9, tests/deepseek-responses-item-id-repair.test.ts:162-190, tests/responses-json-events.test.ts:3-6, tests/responses-json-events.test.ts:65-88	Tests overflow handling for body and stream conversion, HTTP 502 behavior without [DONE], and incremental frame emission with a final [DONE] chunk.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant BoundedJSONPath
  participant responsesJsonToSseStream
  participant ReadableStream
  BoundedJSONPath->>responsesJsonToSseStream: pass repaired bounded JSON response
  responsesJsonToSseStream->>ReadableStream: enqueue encoded frames incrementally
  responsesJsonToSseStream->>ReadableStream: enqueue data: [DONE]\n\n

Loading

Possibly related PRs

• lidge-jun/opencodex#1006: Both modify the bounded JSON-to-SSE conversion path in src/server/responses/core.ts.
• lidge-jun/opencodex#1088: Both modify bounded JSON response handling in src/server/responses/core.ts.
• lidge-jun/opencodex#1095: Both modify Responses streaming conversion and related tests.

Suggested reviewers: lidge-jun, wibias

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: limiting synthesized SSE expansion for Responses.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• review readiness checklist open (2/4 boxes ticked).

What to do

• Tick all four boxes in the PR description once you're done (currently 2/4).

Review readiness checklist

• ✅ All CI tests are green on my local testing.
• ✅ I pushed my PR to the latest dev commit.
• ⬜ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

2/4 boxes ticked.

This PR stays in draft until every box above is ticked.

[luvs01]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.