@bitkyc08/opencodex 2.52.0-preview.20260912 → 2.53.0-preview.20260913

package/src/server/audio-upstream.ts

@@ -0,0 +1,153 @@
+import { formatErrorResponse } from "../bridge";
+import {
+  CodexAccountCooldownError,
+  CodexMainProfileDrainingError,
+  codexMainProfileDrainingResponse,
+  cooldownErrorResponse,
+  isCodexAuthContextUsable,
+  materializeCodexUpstreamAuth,
+  releaseCodexAuthContextProbeLease,
+  resolveCodexAuthContext,
+  type CodexAuthContext,
+} from "../codex/auth-context";
+import { formatCodexProviderForLog } from "../codex/routing";
+import type { AdmissionLease } from "../lib/admission";
+import { captureExplicitOpenAiCallerAuth, resolveFirstUsableOpenAiSidecar, selectOpenAiImagesProvider } from "../providers/openai-sidecar";
+import type { OcxConfig } from "../types";
+import {
+  isProxyAdmissionSecret,
+  resolveDataPlaneAdmissionSecret,
+  validateForwardAdmissionCredential,
+  type DataPlaneAdmission,
+} from "./auth-cors";
+import { codexAccountSelectionForTurn } from "./lifecycle";
+import type { RequestLogContext } from "./request-log";
+
+export const TRANSCRIPTION_MODEL = "gpt-4o-transcribe";
+export const LIVE_AUDIO_MODEL = "gpt-live-1-codex";
+
+/** Audio keys remain identifiable even on the otherwise unauthenticated local listener. */
+export function resolveAudioAdmission(headers: Headers, config: OcxConfig): DataPlaneAdmission | null {
+  const dedicated = headers.get("x-opencodex-api-key")?.trim();
+  if (dedicated) return resolveDataPlaneAdmissionSecret(dedicated, config, "dedicated");
+  const authorization = headers.get("authorization")?.trim();
+  if (authorization) {
+    const token = /^Bearer\s+([^\s,]+)$/i.exec(authorization)?.[1];
+    return token ? resolveDataPlaneAdmissionSecret(token, config, "bearer") : null;
+  }
+  const key = headers.get("x-api-key")?.trim();
+  return key ? resolveDataPlaneAdmissionSecret(key, config, "x-api-key") : null;
+}
+
+export interface AudioUpstream {
+  providerName: string;
+  providerBaseUrl: string;
+  headers: Record<string, string>;
+  keyed: boolean;
+  authContext?: CodexAuthContext;
+  recordOutcome?: (status: number | "timeout" | "connect_error") => void;
+  release: () => void;
+}
+
+export interface AudioUpstreamOptions {
+  admission: DataPlaneAdmission;
+  model: string;
+  lease?: AdmissionLease;
+  exactAccountId?: string;
+  providerName?: string;
+  signal?: AbortSignal;
+}
+
+/** Keep client admission, account selection, and outbound credentials as separate values. */
+export async function resolveAudioUpstream(
+  incoming: Headers,
+  config: OcxConfig,
+  log: RequestLogContext,
+  options: AudioUpstreamOptions,
+): Promise<AudioUpstream | Response> {
+  const candidates = selectOpenAiImagesProvider(config);
+  if (options.providerName) {
+    candidates.forwardCandidates = candidates.forwardCandidates.filter(candidate => candidate.providerName === options.providerName);
+    if (candidates.keyed?.providerName !== options.providerName) delete candidates.keyed;
+  }
+  const headers = new Headers(incoming);
+  const bearer = headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim();
+  if (bearer && isProxyAdmissionSecret(bearer, config)) {
+    headers.delete("authorization");
+    headers.delete("chatgpt-account-id");
+  }
+  headers.delete("x-opencodex-api-key");
+  headers.delete("x-api-key");
+  headers.delete("sec-websocket-protocol");
+  let context: CodexAuthContext | undefined;
+  try {
+    options.signal?.throwIfAborted();
+    const candidate = candidates.forwardCandidates[0];
+    if (candidate) {
+      let selected: Headers;
+      let recordOutcome: AudioUpstream["recordOutcome"];
+      const beginCodexAccountSelection = codexAccountSelectionForTurn(options.lease);
+      if (candidate.accountMode === "direct" && options.exactAccountId === undefined
+        && !captureExplicitOpenAiCallerAuth(incoming, config)) {
+        context = await resolveCodexAuthContext(headers, config, "direct", {
+          admission: options.admission,
+          substituteMainCredentialForDirect: true,
+          beginCodexAccountSelection,
+          signal: options.signal,
+        });
+        options.signal?.throwIfAborted();
+        selected = materializeCodexUpstreamAuth(headers, context, {
+          config,
+          admission: options.admission,
+          substituteMainCredential: true,
+        });
+      } else {
+        const resolved = await resolveFirstUsableOpenAiSidecar(candidates.forwardCandidates, headers, config, {
+          admission: options.admission,
+          beginCodexAccountSelection,
+          signal: options.signal,
+          ...(options.exactAccountId ? { exactAccount: { accountId: options.exactAccountId, modelId: options.model } } : {}),
+        });
+        if (!resolved) return formatErrorResponse(401, "authentication_error", "Connect a ChatGPT account to use audio");
+        context = resolved.authContext;
+        selected = resolved.headers;
+        recordOutcome = resolved.recordOutcome;
+      }
+      options.signal?.throwIfAborted();
+      if (!isCodexAuthContextUsable(context, config)) {
+        releaseCodexAuthContextProbeLease(context);
+        return formatErrorResponse(401, "authentication_error", "Selected audio account is unavailable");
+      }
+      validateForwardAdmissionCredential(selected, config);
+      log.provider = formatCodexProviderForLog(candidate.providerName, context.accountId, config);
+      log.model = options.model;
+      return {
+        providerName: candidate.providerName,
+        providerBaseUrl: candidate.provider.baseUrl,
+        headers: Object.fromEntries(selected),
+        keyed: false,
+        authContext: context,
+        recordOutcome,
+        release: () => releaseCodexAuthContextProbeLease(context),
+      };
+    }
+    if (candidates.keyed && options.exactAccountId === undefined) {
+      const { providerName, provider, apiKey } = candidates.keyed;
+      const selected = new Headers(provider.headers);
+      selected.set("authorization", `Bearer ${apiKey}`);
+      validateForwardAdmissionCredential(selected, config);
+      log.provider = providerName;
+      log.model = options.model;
+      return {
+        providerName, providerBaseUrl: provider.baseUrl, headers: Object.fromEntries(selected),
+        keyed: true, release: () => {},
+      };
+    }
+    return formatErrorResponse(400, "invalid_request_error", "Audio requires a connected ChatGPT account or OpenAI API provider");
+  } catch (error) {
+    releaseCodexAuthContextProbeLease(context);
+    if (error instanceof CodexAccountCooldownError) return cooldownErrorResponse(error);
+    if (error instanceof CodexMainProfileDrainingError) return codexMainProfileDrainingResponse();
+    return formatErrorResponse(401, "authentication_error", "Audio account authentication unavailable; reconnect the selected OpenAI account");
+  }
+}

package/src/server/auth-cors.ts

@@ -1,3 +1,4 @@
+import { modelCapabilitiesConfigError } from "../config/provider-validation";
 import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import { initialModelSelection } from "../providers/initial-model-selection";
 import { extractAccountId } from "../oauth/chatgpt";
@@ -13,6 +14,8 @@ import {
 } from "../config";
 import {
   apiKeyTransportConfigError,
+  autoReviewModelOverridesConfigError,
+  autoReviewModelTargetConfigError,
   booleanRecordConfigError,
   providerReasoningPinsConfigError,
   modelAdapterRecordConfigError,
@@ -482,6 +485,9 @@ export interface ApiAuthMatrixRow {
  * against every cell rather than reading the table back to itself.
  */
 export const AUTH_MATRIX: readonly ApiAuthMatrixRow[] = [
+  { endpoint: "/v1/audio/transcriptions", bearer: "accepted", dedicated: "accepted", xApiKey: "accepted" },
+  { endpoint: "/v1/live", bearer: "accepted", dedicated: "accepted", xApiKey: "accepted" },
+  { endpoint: "/v1/realtime/calls", bearer: "accepted", dedicated: "accepted", xApiKey: "accepted" },
   // #1686: a bearer that is one of OUR admission secrets is now accepted here. It is safe
   // because materializeCodexUpstreamAuth substitutes the stored main credential rather than
   // forwarding it; a bearer that is NOT our secret stays unadmitted and remains Codex Direct
@@ -499,6 +505,8 @@ export const AUTH_MATRIX: readonly ApiAuthMatrixRow[] = [
   // it forwards no caller credential upstream and its body is booleans plus model ids — and it
   // 404s on any host whose runtimeRole is not "hub", so no standalone install gains a surface.
   { endpoint: "/v1/hub-state", bearer: "accepted", dedicated: "accepted", xApiKey: "accepted" },
+  // Usage additionally requires a configured key identity; unscoped environment keys are refused.
+  { endpoint: "/v1/usage", bearer: "rejected", dedicated: "accepted", xApiKey: "rejected" },
 ];
 
 /** Whether `token` is the environment-provided management secret. */
@@ -602,6 +610,23 @@ function sameCanonicalProviderSeed(actual: Record<string, unknown>, expected: Oc
   return actualKeys.every(key => JSON.stringify(actual[key]) === JSON.stringify((expected as unknown as Record<string, unknown>)[key]));
 }
 
+/**
+ * Operator-overlay tolerant variant of the canonical seed check: every key the registry
+ * seed defines must still match the submitted provider verbatim, but keys the seed never
+ * defines are ignored instead of failing the comparison. Field-masked writes (PATCH,
+ * the provider editor, reload) merge onto the persisted row, so the submitted candidate
+ * legitimately carries stored operator overlays like `selectedModels` or `disabled`.
+ * Those fields are validated by their own write boundaries and cannot widen what the
+ * forward proxy claims. Full-object writes (POST) keep the strict exact-key comparison
+ * so a forged overlay cannot ride in on a canonical transport seed.
+ */
+function matchesCanonicalProviderSeed(actual: Record<string, unknown>, expected: OcxProviderConfig): boolean {
+  return Object.keys(expected).every(
+    key => Object.hasOwn(actual, key)
+      && JSON.stringify(actual[key]) === JSON.stringify((expected as unknown as Record<string, unknown>)[key]),
+  );
+}
+
 function positiveWindowValue(value: unknown): boolean {
   return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
 }
@@ -638,13 +663,41 @@ function nativeContextOverlayError(raw: Record<string, unknown>): string | null
  * string, or null when the provider may be persisted. Caller-controlled names/fields are
  * redacted and JSON-escaped so secrets never reach the response.
  */
-export function providerManagementConfigError(name: unknown, provider: unknown): string | null {
+export function providerManagementConfigError(
+  name: unknown,
+  provider: unknown,
+  options?: { allowOperatorOverlays?: boolean },
+): string | null {
   if (typeof name !== "string" || !provider || typeof provider !== "object" || Array.isArray(provider)) {
     return "provider must be a plain object";
   }
   const raw = provider as Record<string, unknown>;
+  const capabilitiesError = modelCapabilitiesConfigError(raw.modelCapabilities);
+  if (capabilitiesError) return capabilitiesError;
   const pinsError = providerReasoningPinsConfigError(raw);
   if (pinsError) return pinsError;
+  if (name === "openai" && (Object.hasOwn(raw, "autoReviewModel") || Object.hasOwn(raw, "autoReviewModelOverrides"))) {
+    return "provider openai must not include autoReviewModel or autoReviewModelOverrides";
+  }
+  // Canonical OpenAI is the ChatGPT forward seed. allowPrivateNetwork is the explicit
+  // opt-in that skips destination DNS classification (loopback, RFC1918, metadata).
+  // Overlay-tolerant comparison would otherwise treat it as an extra key and persist it.
+  if (name === "openai" && Object.hasOwn(raw, "allowPrivateNetwork")) {
+    return "provider openai must not include allowPrivateNetwork";
+  }
+  // The same reasoning applies to `headers`, and it is not hypothetical. Canonical OpenAI
+  // has no registry `staticHeaders`, so any header block on this row is operator-authored,
+  // and the forward adapter copies it onto the ChatGPT request BEFORE the incoming forward
+  // headers — a persisted value therefore wins whenever the caller omits that header. The
+  // exact-key comparison rejected it as an extra key; overlay tolerance would silently admit
+  // it on every merge-based write path while POST still refused it.
+  if (name === "openai" && Object.hasOwn(raw, "headers")) {
+    return "provider openai must not include headers";
+  }
+  const autoReviewTargetError = autoReviewModelTargetConfigError(raw.autoReviewModel, "autoReviewModel", true);
+  if (autoReviewTargetError) return autoReviewTargetError;
+  const autoReviewMapError = autoReviewModelOverridesConfigError(raw.autoReviewModelOverrides, "autoReviewModelOverrides", true);
+  if (autoReviewMapError) return autoReviewMapError;
   for (const field of FORBIDDEN_PROVIDER_RUNTIME_FIELDS) {
     if (Object.hasOwn(raw, field)) return `provider ${name} must not include runtime field "${field}"`;
   }
@@ -683,7 +736,9 @@ export function providerManagementConfigError(name: unknown, provider: unknown):
     // validation and then rejected by the seed comparison, so canonical OpenAI could never
     // set OR clear it — the value was admitted and then refused in the same request.
     delete canonicalCandidate.annotateEmptyToolOutputs;
-    const canonical = seed && sameCanonicalProviderSeed(canonicalCandidate, seed);
+    const canonical = seed && (options?.allowOperatorOverlays
+      ? matchesCanonicalProviderSeed(canonicalCandidate, seed)
+      : sameCanonicalProviderSeed(canonicalCandidate, seed));
     if (!canonical) {
       return `provider ${name} must equal the canonical built-in provider seed`;
     }
@@ -888,6 +943,7 @@ const PROVIDER_CONFIG_FIELD_POLICY = {
   contextWindow: "editor",
   modelContextWindows: "editor",
   modelInputModalities: "editor",
+  modelCapabilities: "editor",
   modelMaxInputTokens: "runtime",
   modelAutoCompactTokenLimits: "editor",
   defaultMaxOutputTokens: "editor",
@@ -910,6 +966,8 @@ const PROVIDER_CONFIG_FIELD_POLICY = {
   modelDefaultReasoningEfforts: "editor",
   pinnedReasoningEffort: "editor",
   modelPinnedReasoningEfforts: "editor",
+  autoReviewModel: "editor",
+  autoReviewModelOverrides: "editor",
   modelSupportsReasoningSummaries: "editor",
   modelSupportsVerbosity: "editor",
   supportsVerbosity: "editor",
@@ -942,6 +1000,7 @@ const PROVIDER_CONFIG_FIELD_POLICY = {
   autoToolChoiceOnlyModels: "editor",
   preserveReasoningContentModels: "editor",
   requiresReasoningPlaceholderModels: "editor",
+  showThinkingSummary: "editor",
   retryOn429: "editor",
   transientRetryOn5xx: "editor",
   reasoningSplitModels: "editor",

package/src/server/chat-completions.ts

@@ -288,7 +288,7 @@ async function handleChatCompletionsWithBudget(
   try {
     internalBodyJson = JSON.stringify(internalBody);
     translatorBudget.chargeRetained(
-      new TextEncoder().encode(internalBodyJson).byteLength,
+      Buffer.byteLength(internalBodyJson, "utf8"),
       { kind: "request_copies" },
     );
   } catch (err) {

package/src/server/chat-native-sse.ts

@@ -7,7 +7,8 @@ import {
   type TranslatorBudget,
 } from "../lib/translator-budget";
 import type { OcxUsage } from "../types";
-import { nextSseBlock, replaceSseDataPayload, sseDataPayload } from "./sse-payload-rewrite";
+import { resolveStallTimeoutSec } from "../stall-timeout";
+import { createSseBlockBuffer, replaceSseDataPayload, sseDataPayload } from "./sse-payload-rewrite";
 
 type Rec = Record<string, unknown>;
 
@@ -65,6 +66,10 @@ export function jsonCompletionSse(value: Rec, requestedModel: string, budget?: T
   const id = typeof value.id === "string" ? value.id : `chatcmpl-${crypto.randomUUID().replace(/-/g, "").slice(0, 24)}`;
   const created = typeof value.created === "number" ? value.created : Math.floor(Date.now() / 1000);
   const model = requestedModel;
+  // Relay the upstream service-tier echo on every chunk, matching how OpenAI/xAI
+  // annotate streamed chat chunks, so streaming callers see the same confirmation
+  // the non-streaming body carries.
+  const serviceTier = typeof value.service_tier === "string" ? { service_tier: value.service_tier } : {};
   const choices = Array.isArray(value.choices) ? value.choices : [];
   const choice = isRec(choices[0]) ? choices[0] : {};
   const message = isRec(choice.message) ? choice.message : {};
@@ -73,6 +78,7 @@ export function jsonCompletionSse(value: Rec, requestedModel: string, budget?: T
     object: "chat.completion.chunk",
     created,
     model,
+    ...serviceTier,
     choices: [{ index: 0, delta: { role: "assistant", content: "" }, finish_reason: null }],
   }];
   const delta: Rec = {};
@@ -85,13 +91,14 @@ export function jsonCompletionSse(value: Rec, requestedModel: string, budget?: T
     delta.tool_calls = message.tool_calls.filter(isRec).map((tool, index) => ({ ...tool, index }));
   }
   if (Object.keys(delta).length > 0) {
-    frames.push({ id, object: "chat.completion.chunk", created, model, choices: [{ index: 0, delta, finish_reason: null }] });
+    frames.push({ id, object: "chat.completion.chunk", created, model, ...serviceTier, choices: [{ index: 0, delta, finish_reason: null }] });
   }
   frames.push({
     id,
     object: "chat.completion.chunk",
     created,
     model,
+    ...serviceTier,
     choices: [{ index: 0, delta: {}, finish_reason: typeof choice.finish_reason === "string" ? choice.finish_reason : "stop" }],
     ...(value.usage !== undefined ? { usage: value.usage } : {}),
   });
@@ -121,6 +128,7 @@ interface NativeChatSseOptions {
   requestedModel: string;
   translatorBudget: TranslatorBudget;
   signal: AbortSignal;
+  stallTimeoutSec?: number;
   onFirstOutput?: () => void;
   onUsage: (usage: OcxUsage) => void;
   onTerminal?: (status: number, message?: string) => void;
@@ -135,8 +143,11 @@ export function nativeChatSse(
   const decoder = new TextDecoder();
   const encoder = new TextEncoder();
   const scope = { kind: "live_transient" as const };
-  let buffer = "";
-  let bufferBytes = 0;
+  const buffer = createSseBlockBuffer(options.translatorBudget, nextBytes => {
+    if (nextBytes > TRANSLATOR_MAX_SSE_EVENT_BYTES) {
+      throw new Error("upstream SSE event exceeded the safe limit", { cause: { code: "translation_buffer_limit" } });
+    }
+  });
   let queuedBytes = 0;
   let sawFinish = false;
   let sawDone = false;
@@ -144,50 +155,31 @@ export function nativeChatSse(
   let settled = false;
   let cancelled = false;
   let cancelledBySignal = false;
+  const stallMs = resolveStallTimeoutSec(options.stallTimeoutSec) * 1_000;
+  // Count only active upstream consumption; downstream backpressure must not
+  // consume the provider's inactivity allowance. Comments and empty deltas do.
+  let remainingStallMs = stallMs;
+  let pullDeadline = 0;
+  const stalled = new Error("upstream stream stalled without meaningful progress");
 
   const releaseQueued = () => {
     if (queuedBytes === 0) return;
     options.translatorBudget.releaseRetained(queuedBytes, scope);
     queuedBytes = 0;
   };
-  const replaceBuffer = (next: string) => {
-    const nextBytes = encoder.encode(next).byteLength;
-    const reservation = options.translatorBudget.reserveTransient(nextBytes, scope);
-    reservation.commitRetained();
-    options.translatorBudget.releaseRetained(bufferBytes, scope);
-    buffer = next;
-    bufferBytes = nextBytes;
-  };
-  const appendBuffer = (fragment: string) => {
-    if (!fragment) return;
-    const fragmentBytes = encoder.encode(fragment).byteLength;
-    const nextBytes = bufferBytes + fragmentBytes;
-    if (nextBytes > TRANSLATOR_MAX_SSE_EVENT_BYTES) {
-      throw new Error("upstream SSE event exceeded the safe limit", { cause: { code: "translation_buffer_limit" } });
-    }
-    const reservation = options.translatorBudget.reserveTransient(nextBytes, scope);
+  const enqueue = (controller: ReadableStreamDefaultController<Uint8Array>, text: string) => {
+    const byteLength = Buffer.byteLength(text);
+    const reservation = options.translatorBudget.reserveTransient(byteLength, scope);
     try {
-      buffer += fragment;
+      controller.enqueue(encoder.encode(text));
       reservation.commitRetained();
-      options.translatorBudget.releaseRetained(bufferBytes, scope);
-      bufferBytes = nextBytes;
+      queuedBytes += byteLength;
     } catch (error) {
       reservation.release();
       throw error;
     }
   };
-  const enqueue = (controller: ReadableStreamDefaultController<Uint8Array>, text: string) => {
-    const bytes = encoder.encode(text);
-    const reservation = options.translatorBudget.reserveTransient(bytes.byteLength, scope);
-    controller.enqueue(bytes);
-    reservation.commitRetained();
-    queuedBytes += bytes.byteLength;
-  };
-  const releaseBuffer = () => {
-    options.translatorBudget.releaseRetained(bufferBytes, scope);
-    buffer = "";
-    bufferBytes = 0;
-  };
+  const releaseBuffer = () => buffer.clear();
   const settle = (status: number, message?: string) => {
     if (settled) return;
     settled = true;
@@ -219,13 +211,20 @@ export function nativeChatSse(
   ): void => {
     const payload = sseDataPayload(block);
     if (payload === null) {
+      if (performance.now() >= pullDeadline) throw stalled;
       enqueue(controller, block + delimiter);
       return;
     }
     const trimmed = payload.trim();
+    if (trimmed === "") {
+      if (performance.now() >= pullDeadline) throw stalled;
+      enqueue(controller, block + delimiter);
+      return;
+    }
     if (trimmed === "[DONE]") {
       sawDone = true;
       enqueue(controller, replaceSseDataPayload(block, "[DONE]") + delimiter);
+      releaseBuffer();
       settle(200);
       try { void reader.cancel().catch(() => {}); } catch { /* already closed */ }
       controller.close();
@@ -254,6 +253,7 @@ export function nativeChatSse(
       }
       const safe = chatCompletionsErrorBody(status, classified.message, classified.type, classified.code);
       enqueue(controller, replaceSseDataPayload(block, JSON.stringify(safe)) + delimiter);
+      releaseBuffer();
       settle(isCyberPolicyCode(classified.code) ? 400 : status, classified.message);
       try { void reader.cancel(new Error(classified.message)).catch(() => {}); } catch { /* already closed */ }
       controller.close();
@@ -262,16 +262,28 @@ export function nativeChatSse(
     const usage = usageFromChat(parsed.usage);
     if (usage) options.onUsage(usage);
     const choices = Array.isArray(parsed.choices) ? parsed.choices : [];
-    if (choices.some(choice => isRec(choice) && typeof choice.finish_reason === "string" && choice.finish_reason.length > 0)) {
-      sawFinish = true;
-    }
-    if (!firstOutput && choices.some(choice => {
+    const finished = choices.some(choice => isRec(choice) && typeof choice.finish_reason === "string" && choice.finish_reason.length > 0);
+    if (finished) sawFinish = true;
+    const hasProgress = choices.some(choice => {
       if (!isRec(choice) || !isRec(choice.delta)) return false;
       const delta = choice.delta;
       return (typeof delta.content === "string" && delta.content.length > 0)
         || (typeof delta.reasoning_content === "string" && delta.reasoning_content.length > 0)
-        || (Array.isArray(delta.tool_calls) && delta.tool_calls.length > 0);
-    })) {
+        || (typeof delta.reasoning === "string" && delta.reasoning.length > 0)
+        || (Array.isArray(delta.reasoning_details) && delta.reasoning_details.some(detail =>
+          isRec(detail) && typeof detail.text === "string" && detail.text.length > 0))
+        || (typeof delta.refusal === "string" && delta.refusal.length > 0)
+        || (Array.isArray(delta.tool_calls) && delta.tool_calls.some(tool => {
+          if (!isRec(tool)) return false;
+          const fn = isRec(tool.function) ? tool.function : {};
+          return (typeof tool.id === "string" && tool.id.length > 0)
+            || (typeof fn.name === "string" && fn.name.length > 0)
+            || (typeof fn.arguments === "string" && fn.arguments.length > 0);
+        }));
+    });
+    if (hasProgress || finished) pullDeadline = performance.now() + stallMs;
+    else if (performance.now() >= pullDeadline) throw stalled;
+    if (!firstOutput && hasProgress) {
       firstOutput = true;
       options.onFirstOutput?.();
     }
@@ -280,6 +292,7 @@ export function nativeChatSse(
 
   function onAbort() {
     cancelledBySignal = true;
+    releaseBuffer();
     if (!settled) {
       settled = true;
       options.onCancel?.();
@@ -292,15 +305,39 @@ export function nativeChatSse(
   return new ReadableStream<Uint8Array>({
     async pull(controller) {
       releaseQueued();
+      pullDeadline = performance.now() + remainingStallMs;
       try {
         for (;;) {
-          const next = nextSseBlock(buffer);
+          if (cancelledBySignal) {
+            releaseBuffer();
+            controller.close();
+            return;
+          }
+          const next = buffer.next();
           if (next) {
-            replaceBuffer(next.rest);
+            buffer.compact();
             processBlock(controller, next.block, next.delimiter);
             return;
           }
-          const { done, value } = await reader.read();
+          if (performance.now() >= pullDeadline) throw stalled;
+          let timeout: ReturnType<typeof setTimeout> | undefined;
+          let read: Awaited<ReturnType<typeof reader.read>>;
+          try {
+            read = await Promise.race([
+              reader.read(),
+              new Promise<never>((_, reject) => {
+                const check = () => {
+                  const remaining = pullDeadline - performance.now();
+                  if (remaining <= 0) reject(stalled);
+                  else timeout = setTimeout(check, Math.min(remaining, 2_147_483_647));
+                };
+                check();
+              }),
+            ]);
+          } finally {
+            if (timeout !== undefined) clearTimeout(timeout);
+          }
+          const { done, value } = read;
           if (cancelled) return;
           if (cancelledBySignal) {
             releaseBuffer();
@@ -308,11 +345,11 @@ export function nativeChatSse(
             return;
           }
           if (!done) {
-            appendBuffer(decoder.decode(value, { stream: true }));
+            buffer.append(decoder.decode(value, { stream: true }));
             continue;
           }
-          appendBuffer(decoder.decode());
-          if (buffer.trim().length > 0) {
+          buffer.append(decoder.decode());
+          if (buffer.tail().trim().length > 0) {
             fail(controller, "upstream SSE ended with an unterminated event", "upstream_sse_unterminated");
             return;
           }
@@ -327,13 +364,20 @@ export function nativeChatSse(
           return;
         }
       } catch (error) {
+        if (cancelled || cancelledBySignal) {
+          releaseBuffer();
+          try { controller.close(); } catch { /* already closed */ }
+          return;
+        }
         const overflow = isTranslatorBudgetExceededError(error)
           || (error instanceof Error && (error.cause as { code?: unknown } | undefined)?.code === "translation_buffer_limit");
         fail(
           controller,
           overflow ? "upstream SSE event exceeded the safe limit" : error instanceof Error ? error.message : String(error),
-          overflow ? "translation_buffer_limit" : "upstream_sse_error",
+          overflow ? "translation_buffer_limit" : error === stalled ? "upstream_stall_timeout" : "upstream_sse_error",
         );
+      } finally {
+        remainingStallMs = Math.max(0, pullDeadline - performance.now());
       }
     },
     cancel(reason) {