@bitkyc08/opencodex 2.7.36 → 2.7.37

package/src/server/management/system-routes.ts

@@ -0,0 +1,65 @@
+/**
+ * /api/system/* — service-process runtime/memory introspection (#314 WP3).
+ *
+ * Rides the standard management gate: every /api/* request already passed
+ * requireApiAuth("management") + the origin check before dispatch, so these
+ * routes add no auth of their own. NEVER expose this data on the
+ * unauthenticated /healthz surface.
+ *
+ * The payload is scalar-only (numbers, enum strings): no paths, no tokens, no
+ * account identifiers. `jscHeap` (bun:jsc heapStats) is the js-vs-native
+ * discriminator: a flat JS heap under a growing RSS points at native runtime
+ * memory (the #314 shape), not an app-level JS leak.
+ */
+import { decideEagerRelay } from "../../lib/bun-stream-caps";
+import { getActiveMemoryWatchdog } from "../memory-watchdog";
+import { jsonResponse } from "../auth-cors";
+import type { ManagementContext } from "./context";
+
+const ENDPOINT_SAMPLE_LIMIT = 60;
+
+export async function handleSystemRoutes(ctx: ManagementContext): Promise<Response | null> {
+  const { req, url, config } = ctx;
+  if (url.pathname === "/api/system/memory" && req.method === "GET") {
+    const usage = process.memoryUsage();
+    let jscHeap: { heapSize: number; heapCapacity: number; objectCount: number } | null = null;
+    try {
+      const { heapStats } = await import("bun:jsc");
+      const stats = heapStats();
+      jscHeap = {
+        heapSize: stats.heapSize,
+        heapCapacity: stats.heapCapacity,
+        objectCount: stats.objectCount,
+      };
+    } catch {
+      /* non-Bun tooling or unavailable introspection — omit the discriminator */
+    }
+    const watchdogInstance = getActiveMemoryWatchdog();
+    const watchdog = watchdogInstance
+      ? (() => {
+        const snap = watchdogInstance.snapshot();
+        return {
+          warnThresholdBytes: snap.warnThresholdBytes,
+          lastWarnAt: snap.lastWarnAt,
+          samples: snap.samples.slice(-ENDPOINT_SAMPLE_LIMIT),
+        };
+      })()
+      : null;
+    const streamMode = config.streamMode ?? "auto";
+    return jsonResponse({
+      pid: process.pid,
+      bunVersion: Bun.version,
+      bunRevision: Bun.revision,
+      platform: process.platform,
+      uptimeSeconds: process.uptime(),
+      rss: usage.rss,
+      heapUsed: usage.heapUsed,
+      heapTotal: usage.heapTotal,
+      jscHeap,
+      streamMode,
+      eagerRelay: process.platform === "win32" ? decideEagerRelay(streamMode) : null,
+      watchdog,
+    });
+  }
+  return null;
+}

package/src/server/management-api.ts

@@ -64,6 +64,7 @@ import { handleModelRoutes } from "./management/model-routes";
 import { handleAgentSettingsRoutes } from "./management/agent-settings-routes";
 import { handleOauthAccountRoutes } from "./management/oauth-account-routes";
 import { handleComboRoutes } from "./management/combo-routes";
+import { handleSystemRoutes } from "./management/system-routes";
 import type { ManagementContext } from "./management/context";
 export type { ManagementApiDeps } from "./management/context";
 import { fetchAllModels } from "./management/shared";
@@ -128,7 +129,8 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
     ??     (await handleModelRoutes(ctx))
     ??     (await handleAgentSettingsRoutes(ctx))
     ??     (await handleOauthAccountRoutes(ctx))
-    ??     (await handleComboRoutes(ctx));
+    ??     (await handleComboRoutes(ctx))
+    ??     (await handleSystemRoutes(ctx));
   if (routed) return routed;
 
   if (url.pathname === "/api/stop" && req.method === "POST") {

package/src/server/memory-watchdog.ts

@@ -0,0 +1,112 @@
+/**
+ * RSS memory watchdog (#314 WP3) — warn-only observability for the Windows
+ * native-memory growth reported upstream (Bun fetch buffers / socket handles).
+ *
+ * Samples process.memoryUsage() on an unref'd interval into a bounded ring and
+ * logs ONE rate-limited warning when RSS crosses the threshold. It never
+ * restarts anything (threshold auto-restart is deliberately deferred; the
+ * service managers' crash-respawn already covers hard failures). The active
+ * instance is a module-level singleton so the management API can expose the
+ * snapshot without threading server state through route contexts.
+ *
+ * Privacy: samples are scalar numbers only; the warn line never interpolates
+ * paths, hostnames, or tokens.
+ */
+
+export type MemorySample = {
+  /** Epoch ms. */
+  at: number;
+  /** Resident set size in bytes. */
+  rss: number;
+  /** JS heap used in bytes (process.memoryUsage().heapUsed). */
+  heapUsed: number;
+  /** JS heap total in bytes. */
+  heapTotal: number;
+};
+
+export type MemoryWatchdogState = {
+  samples: MemorySample[];
+  warnThresholdBytes: number;
+  lastWarnAt: number | null;
+};
+
+export type MemoryWatchdog = {
+  stop(): void;
+  snapshot(): MemoryWatchdogState;
+};
+
+const DEFAULT_INTERVAL_MS = 60_000;
+const DEFAULT_WARN_THRESHOLD_BYTES = 4 * 1024 ** 3; // 4 GiB
+const DEFAULT_RING_SIZE = 360; // ≈6h at 60s
+const WARN_INTERVAL_MS = 30 * 60_000;
+const DOCS_URL = "https://lidge-jun.github.io/opencodex/troubleshooting/windows-memory/";
+
+let active: MemoryWatchdog | null = null;
+
+/** The running watchdog, if any — read by /api/system/memory. */
+export function getActiveMemoryWatchdog(): MemoryWatchdog | null {
+  return active;
+}
+
+function defaultSample(now: () => number): MemorySample {
+  const usage = process.memoryUsage();
+  return { at: now(), rss: usage.rss, heapUsed: usage.heapUsed, heapTotal: usage.heapTotal };
+}
+
+/**
+ * Start (or replace) the process-wide memory watchdog. Idempotent: a previous
+ * active instance is stopped first, so repeated startServer() calls in tests
+ * never accumulate intervals. The timer is unref'd; stop() is exposed for
+ * tests and clears the singleton.
+ */
+export function startMemoryWatchdog(opts?: {
+  intervalMs?: number;
+  warnThresholdBytes?: number;
+  ringSize?: number;
+  now?: () => number;
+  sample?: () => MemorySample;
+  warn?: (msg: string) => void;
+}): MemoryWatchdog {
+  active?.stop();
+  const intervalMs = opts?.intervalMs ?? DEFAULT_INTERVAL_MS;
+  const warnThresholdBytes = opts?.warnThresholdBytes ?? DEFAULT_WARN_THRESHOLD_BYTES;
+  const ringSize = opts?.ringSize ?? DEFAULT_RING_SIZE;
+  const now = opts?.now ?? Date.now;
+  const sample = opts?.sample ?? (() => defaultSample(now));
+  const warn = opts?.warn ?? ((msg: string) => console.warn(msg));
+
+  const samples: MemorySample[] = [];
+  let lastWarnAt: number | null = null;
+
+  const tick = () => {
+    let s: MemorySample;
+    try {
+      s = sample();
+    } catch {
+      return; // sampling must never break the server
+    }
+    samples.push(s);
+    if (samples.length > ringSize) samples.splice(0, samples.length - ringSize);
+    if (s.rss >= warnThresholdBytes && (lastWarnAt === null || now() - lastWarnAt >= WARN_INTERVAL_MS)) {
+      lastWarnAt = now();
+      const rssMb = Math.round(s.rss / (1024 * 1024));
+      const thresholdMb = Math.round(warnThresholdBytes / (1024 * 1024));
+      warn(`⚠️  opencodex RSS ${rssMb}MB exceeds the ${thresholdMb}MB watch threshold. On Windows this is usually the upstream Bun runtime memory issue — see ${DOCS_URL}`);
+    }
+  };
+
+  const timer = setInterval(tick, intervalMs);
+  (timer as { unref?: () => void }).unref?.();
+
+  const instance: MemoryWatchdog = {
+    stop() {
+      clearInterval(timer);
+      if (active === instance) active = null;
+    },
+    snapshot() {
+      return { samples: [...samples], warnThresholdBytes, lastWarnAt };
+    },
+  };
+  active = instance;
+  return instance;
+}

package/src/server/relay-eager.ts

@@ -0,0 +1,199 @@
+/**
+ * Eager bounded single-reader SSE relay (#314 mitigation, WP2).
+ *
+ * Replaces the tee()+background-inspection passthrough shape on runtimes where
+ * the Bun#32111 async-pull cancel fix is present (src/lib/bun-stream-caps.ts):
+ * ONE eager producer loop reads upstream, feeds every chunk through the shared
+ * SSE inspector (terminal outcome, quota, request log, context cache), and
+ * enqueues it into a byte-bounded client queue. When the queue is full the
+ * producer pauses — no unbounded tee branch queue can build up behind a slow
+ * client.
+ *
+ * Honesty caveats (audit M5): full leak relief additionally assumes the
+ * runtime carries the Bun#29831 fetch receive-backpressure fix and that Bun's
+ * native Response sink pull-paces a JS ReadableStream. Neither is provable in
+ * bun:test (a JS reader always paces); both remain "awaiting Windows user
+ * verification".
+ *
+ * #44 cancel semantics: after client cancel the relay keeps reading upstream in
+ * DISCARD-DRAIN mode (inspection only) until a terminal is seen or the bounded
+ * drain window (ms/bytes) expires — a genuinely reached terminal records as
+ * completed/failed, never downgraded to cancel. Only when no terminal arrives
+ * within bounds does onClientCancel fire. This bounds today's unbounded tee
+ * drain; the tradeoff is that client-cancel log finalization may be delayed by
+ * up to the drain window.
+ */
+
+export type EagerRelayHooks = {
+  /** Feed one upstream chunk through SSE inspection (createSseInspector.feed). */
+  inspectChunk: (chunk: Uint8Array) => void;
+  /** Flush inspection at upstream end (createSseInspector.finish). */
+  finishInspection: () => void;
+  /** True once inspection has reported a protocol terminal (inspector.reported). */
+  sawTerminal: () => boolean;
+  /** Record a synthetic terminal (caller decides incomplete vs failed-502). */
+  onSynthetic: (kind: "incomplete" | "failed") => void;
+  /** Client cancelled and NO terminal arrived within the drain bounds. */
+  onClientCancel: () => void;
+  /** Exactly once, after the producer fully stops (unregisterTurn parity). */
+  onDone: () => void;
+};
+
+export type EagerRelayOptions = {
+  /** Bounded client queue in bytes; producer pauses above it. Default 8 MiB. */
+  maxQueueBytes?: number;
+  /** Post-cancel discard-drain wall-clock bound. Default 15 000 ms. */
+  postCancelDrainMs?: number;
+  /** Post-cancel discard-drain byte bound. Default 32 MiB. */
+  postCancelDrainBytes?: number;
+  /** Injectable clock for tests. */
+  now?: () => number;
+};
+
+const DEFAULT_MAX_QUEUE_BYTES = 8 * 1024 * 1024;
+const DEFAULT_DRAIN_MS = 15_000;
+const DEFAULT_DRAIN_BYTES = 32 * 1024 * 1024;
+
+/**
+ * Relay `body` to the returned stream with eager bounded reading and inline
+ * inspection. `upstream` is aborted on cancel-drain expiry and observed for
+ * shutdown teardown (its abort wakes a paused producer and suppresses
+ * synthetic terminals — audit M3).
+ */
+export function relaySseEagerBounded(
+  body: ReadableStream<Uint8Array>,
+  upstream: AbortController,
+  hooks: EagerRelayHooks,
+  opts?: EagerRelayOptions,
+): ReadableStream<Uint8Array> {
+  const maxQueueBytes = opts?.maxQueueBytes ?? DEFAULT_MAX_QUEUE_BYTES;
+  const drainMs = opts?.postCancelDrainMs ?? DEFAULT_DRAIN_MS;
+  const drainBytes = opts?.postCancelDrainBytes ?? DEFAULT_DRAIN_BYTES;
+  const now = opts?.now ?? Date.now;
+
+  const reader = body.getReader();
+  let queuedBytes = 0;
+  let cancelled = false;
+  let done = false;
+  // Pause gate: resolved by client pull, client cancel, or upstream abort so a
+  // paused producer ALWAYS resumes (audit blocker 2 — no deadlock; onDone and
+  // turn unregistration stay reachable, drainAndShutdown never hangs).
+  let wake: (() => void) | null = null;
+  const wakeUp = () => { const w = wake; wake = null; w?.(); };
+  const paused = () => new Promise<void>(resolve => { wake = resolve; });
+  upstream.signal.addEventListener("abort", wakeUp, { once: true });
+
+  let controllerRef: ReadableStreamDefaultController<Uint8Array> | null = null;
+  let doneFired = false;
+  let drainTimer: ReturnType<typeof setTimeout> | null = null;
+  const fireDone = () => {
+    if (doneFired) return;
+    doneFired = true;
+    if (drainTimer) { clearTimeout(drainTimer); drainTimer = null; }
+    try { hooks.onDone(); } catch { /* lifecycle callbacks must not break teardown */ }
+  };
+  // A silent upstream after cancel would park the drain loop in reader.read();
+  // the wall-clock bound must fire regardless, so cancel arms a hard timer that
+  // aborts upstream at the deadline (the abort wakes the read).
+  const armDrainTimer = () => {
+    if (drainTimer) return;
+    drainTimer = setTimeout(() => {
+      drainTimer = null;
+      upstream.abort(new Error("post-cancel drain window expired"));
+    }, drainMs);
+    (drainTimer as { unref?: () => void }).unref?.();
+  };
+
+  const producer = async () => {
+    let syntheticKind: "incomplete" | "failed" | null = null;
+    // reader.read() is not intrinsically tied to the upstream AbortController
+    // (a fetch body usually rejects on abort, but that coupling is the fetch
+    // implementation's, not the stream's). Race every read against the abort
+    // signal so cancel-drain expiry and shutdown teardown ALWAYS break the
+    // loop even on a silent upstream.
+    const aborted: Promise<"aborted"> = new Promise(resolve => {
+      if (upstream.signal.aborted) resolve("aborted");
+      else upstream.signal.addEventListener("abort", () => resolve("aborted"), { once: true });
+    });
+    try {
+      for (;;) {
+        const result = await Promise.race([reader.read(), aborted]);
+        if (result === "aborted") break;
+        const { done: upstreamDone, value } = result;
+        if (upstreamDone) {
+          hooks.finishInspection();
+          if (!hooks.sawTerminal() && !cancelled && !upstream.signal.aborted) {
+            syntheticKind = "incomplete";
+          }
+          break;
+        }
+        hooks.inspectChunk(value);
+        if (cancelled) {
+          // Discard-drain: inspection only, nothing queued. Stop at terminal
+          // or when the bounded window expires.
+          drainedBytes += value.byteLength;
+          if (hooks.sawTerminal() || drainedBytes >= drainBytes || now() >= drainDeadline) {
+            break;
+          }
+          continue;
+        }
+        queuedBytes += value.byteLength;
+        try {
+          controllerRef?.enqueue(value);
+        } catch {
+          // Controller already torn down (client went away without cancel()).
+          cancelled = true;
+          drainDeadline = now() + drainMs;
+          armDrainTimer();
+          continue;
+        }
+        while (queuedBytes > maxQueueBytes && !cancelled && !upstream.signal.aborted) {
+          await paused();
+        }
+      }
+    } catch {
+      // Upstream read failure. Distinguish genuine mid-stream reset from
+      // abort-driven teardown (shutdown/cancel-expiry) — audit M3.
+      if (!hooks.sawTerminal() && !cancelled && !upstream.signal.aborted) {
+        syntheticKind = "failed";
+        try { controllerRef?.error(new Error("upstream stream failed")); } catch { /* torn down */ }
+      }
+    } finally {
+      if (syntheticKind) hooks.onSynthetic(syntheticKind);
+      if (cancelled && !hooks.sawTerminal()) {
+        hooks.onClientCancel();
+      }
+      if (cancelled || upstream.signal.aborted) {
+        upstream.abort();
+        reader.cancel().catch(() => {});
+      }
+      if (!cancelled) {
+        try { controllerRef?.close(); } catch { /* already closed/errored */ }
+      }
+      fireDone();
+    }
+  };
+
+  let drainedBytes = 0;
+  let drainDeadline = Number.POSITIVE_INFINITY;
+
+  return new ReadableStream<Uint8Array>({
+    start(controller) {
+      controllerRef = controller;
+      void producer();
+    },
+    pull() {
+      // The client consumed from the queue; approximate accounting: reset on
+      // pull below cap. desiredSize reflects internal queue in chunks, not
+      // bytes, so we track bytes ourselves and drain optimistically.
+      queuedBytes = 0;
+      wakeUp();
+    },
+    cancel() {
+      cancelled = true;
+      drainDeadline = now() + drainMs;
+      armDrainTimer();
+      wakeUp();
+    },
+  });
+}

package/src/server/relay.ts

@@ -159,15 +159,22 @@ export function completedResponseFromSsePayload(payload: string): { id?: unknown
   if (payload === "[DONE]") return null;
   try {
     const json = JSON.parse(payload) as { type?: unknown; response?: unknown };
-    if (json.type !== "response.completed") return null;
-    const response = json.response;
-    if (!response || typeof response !== "object" || Array.isArray(response)) return null;
-    return response as { id?: unknown; output?: unknown; status?: unknown };
+    return completedResponseFromParsedEvent(json);
   } catch {
     return null;
   }
 }
 
+/** Extract the response object from an already-parsed `response.completed` event, or null. */
+function completedResponseFromParsedEvent(
+  json: { type?: unknown; response?: unknown } | null,
+): { id?: unknown; output?: unknown; status?: unknown } | null {
+  if (!json || json.type !== "response.completed") return null;
+  const response = json.response;
+  if (!response || typeof response !== "object" || Array.isArray(response)) return null;
+  return response as { id?: unknown; output?: unknown; status?: unknown };
+}
+
 export function trackSseForRequestLog(
   body: ReadableStream<Uint8Array>,
   onTerminal: (status: ResponsesTerminalStatus) => void,
@@ -404,6 +411,116 @@ export function relaySseWithHeartbeat(
  * Background-consume an SSE stream purely for terminal-outcome inspection (quota tracking).
  * Does not produce output; safe to ignore errors (the client-facing stream is separate).
  */
+export type SseInspector = {
+  /** Feed one upstream chunk through the SSE scanning state machine. */
+  feed(chunk: Uint8Array): void;
+  /** Flush the decoder + trailing unterminated buffer (upstream cleanly done). */
+  finish(): void;
+  /** True once a protocol terminal was detected and reported. */
+  reported(): boolean;
+};
+
+/**
+ * Per-chunk SSE inspection state machine shared by consumeForInspection,
+ * consumeForResponseLogMetadata, and the eager bounded relay (relay-eager.ts).
+ *
+ * Extraction-fidelity invariants (devlog/_plan/260723_win_mem_safestream/020):
+ * - logCtx SSE inspection is gated on !reported; in the metadata configuration
+ *   (no onTerminal) `reported` stays permanently false, which reproduces the
+ *   metadata consumer's unconditional inspection through the same gate.
+ * - finish() skips the trailing-buffer scan once reported, while per-block
+ *   onCompletedResponse continues firing after reported — an intentional
+ *   asymmetry inherited from consumeForInspection.
+ * - logCtx.transportPhase/terminalSource are mutated BEFORE onTerminal fires.
+ * - Synthetic terminals (incomplete / failed-502) are the CALLER's decision:
+ *   the caller owns `cancelled` state and reads `reported()` to decide.
+ */
+export function createSseInspector(handlers: {
+  onTerminal?: (status: ResponsesTerminalStatus, httpStatusOverride?: number) => void;
+  logCtx?: RequestLogContext;
+  onCompletedResponse?: (response: { id?: unknown; output?: unknown; status?: unknown }) => void;
+  onFirstOutput?: () => void;
+}): SseInspector {
+  const decoder = new TextDecoder();
+  let buffer = "";
+  let reported = false;
+  const reportFirstOutput = createFirstOutputReporter(handlers.onFirstOutput);
+  // Allocate reconstruction state only for persistence-capable inspectors.
+  const completedItemsByOutputIndex = handlers.onCompletedResponse
+    ? new Map<number, unknown>()
+    : null;
+
+  const scanPayload = (payload: string | null): void => {
+    if (!reported && handlers.logCtx) inspectResponseLogSsePayload(handlers.logCtx, payload);
+    reportFirstOutput(payload);
+    if (!payload) return;
+    if (!reported && handlers.onTerminal) {
+      const status = terminalStatusFromSsePayload(payload);
+      if (status) {
+        reported = true;
+        if (handlers.logCtx) {
+          handlers.logCtx.transportPhase = "terminal_sse";
+          handlers.logCtx.terminalSource = "upstream";
+        }
+        handlers.onTerminal(status);
+      }
+    }
+    if (handlers.onCompletedResponse) {
+      type ParsedSseEvent = { type?: unknown; output_index?: unknown; item?: unknown; response?: unknown };
+      let parsedEvent: ParsedSseEvent | null = null;
+      try {
+        if (payload !== "[DONE]") parsedEvent = JSON.parse(payload) as ParsedSseEvent;
+      } catch {
+        /* malformed SSE payloads remain best-effort/no-throw */
+      }
+      const doneItem = parsedEvent?.type === "response.output_item.done" ? parsedEvent.item : undefined;
+      if (parsedEvent
+        && doneItem !== undefined
+        && Number.isInteger(parsedEvent.output_index)
+        && (parsedEvent.output_index as number) >= 0
+        && typeof doneItem === "object"
+        && doneItem !== null
+        && !Array.isArray(doneItem)
+        && typeof (doneItem as { type?: unknown }).type === "string") {
+        completedItemsByOutputIndex!.set(parsedEvent.output_index as number, doneItem);
+      }
+
+      let response = completedResponseFromParsedEvent(parsedEvent);
+      if (response
+        && (!Array.isArray(response.output) || response.output.length === 0)
+        && completedItemsByOutputIndex!.size > 0) {
+        response = {
+          ...response,
+          output: [...completedItemsByOutputIndex!.entries()]
+            .sort(([left], [right]) => left - right)
+            .map(([, item]) => item),
+        };
+      }
+      if (response) handlers.onCompletedResponse(response);
+    }
+  };
+
+  return {
+    feed(chunk) {
+      buffer += decoder.decode(chunk, { stream: true });
+      let next: { block: string; rest: string } | null;
+      while ((next = nextSseBlock(buffer))) {
+        buffer = next.rest;
+        if (reported && !handlers.onCompletedResponse) continue;
+        scanPayload(sseDataPayload(next.block));
+      }
+    },
+    finish() {
+      buffer += decoder.decode();
+      if (buffer.trim() && !reported) {
+        scanPayload(sseDataPayload(buffer));
+      }
+      buffer = "";
+    },
+    reported: () => reported,
+  };
+}
+
 export function consumeForInspection(
   body: ReadableStream<Uint8Array>,
   onTerminal: (status: ResponsesTerminalStatus, httpStatusOverride?: number) => void,
@@ -415,11 +532,8 @@ export function consumeForInspection(
   onFirstOutput?: () => void,
 ): void {
   const reader = body.getReader();
-  const decoder = new TextDecoder();
-  let buffer = "";
-  let reported = false;
+  const inspector = createSseInspector({ onTerminal, logCtx, onCompletedResponse, onFirstOutput });
   let cancelled = false;
-  const reportFirstOutput = createFirstOutputReporter(onFirstOutput);
   if (signal) {
     if (signal.aborted) {
       // Aborted before we could read anything (Codex disconnects the instant it finishes reading).
@@ -444,64 +558,20 @@ export function consumeForInspection(
       for (;;) {
         const { done, value } = await reader.read();
         if (done) {
-          buffer += decoder.decode();
-          if (buffer.trim() && !reported) {
-            const payload = sseDataPayload(buffer);
-            if (logCtx) inspectResponseLogSsePayload(logCtx, payload);
-            reportFirstOutput(payload);
-            if (payload) {
-              const status = terminalStatusFromSsePayload(payload);
-              if (status) {
-                reported = true;
-                if (logCtx) {
-                  logCtx.transportPhase = "terminal_sse";
-                  logCtx.terminalSource = "upstream";
-                }
-                onTerminal(status);
-              }
-              if (onCompletedResponse) {
-                const response = completedResponseFromSsePayload(payload);
-                if (response) onCompletedResponse(response);
-              }
-            }
-          }
-          if (!reported && !cancelled) {
+          inspector.finish();
+          if (!inspector.reported() && !cancelled) {
             if (logCtx) logCtx.terminalSource = "synthetic";
             onTerminal("incomplete");
           }
           return;
         }
-        buffer += decoder.decode(value, { stream: true });
-        let next: { block: string; rest: string } | null;
-        while ((next = nextSseBlock(buffer))) {
-          buffer = next.rest;
-          if (reported && !onCompletedResponse) continue;
-          const payload = sseDataPayload(next.block);
-          if (!reported && logCtx) inspectResponseLogSsePayload(logCtx, payload);
-          reportFirstOutput(payload);
-          if (!payload) continue;
-          if (!reported) {
-            const status = terminalStatusFromSsePayload(payload);
-            if (status) {
-              reported = true;
-              if (logCtx) {
-                logCtx.transportPhase = "terminal_sse";
-                logCtx.terminalSource = "upstream";
-              }
-              onTerminal(status);
-            }
-          }
-          if (onCompletedResponse) {
-            const response = completedResponseFromSsePayload(payload);
-            if (response) onCompletedResponse(response);
-          }
-        }
+        inspector.feed(value);
       }
     } catch {
       // Upstream read failure after HTTP 200 (mid-stream socket reset) is not a
       // protocol `response.incomplete` terminal. Report a synthetic 502 so account
       // health treats it as transient; abort-driven client cancellation still wins.
-      if (!reported && !cancelled) {
+      if (!inspector.reported() && !cancelled) {
         if (logCtx) {
           logCtx.transportPhase = "mid_stream";
           logCtx.terminalSource = "synthetic";
@@ -524,9 +594,9 @@ export function consumeForResponseLogMetadata(
   onFirstOutput?: () => void,
 ): void {
   const reader = body.getReader();
-  const decoder = new TextDecoder();
-  let buffer = "";
-  const reportFirstOutput = createFirstOutputReporter(onFirstOutput);
+  // No onTerminal → the inspector's `reported` gate stays permanently false,
+  // reproducing this consumer's unconditional logCtx inspection.
+  const inspector = createSseInspector({ logCtx, onCompletedResponse, onFirstOutput });
   if (signal) {
     if (signal.aborted) {
       reader.cancel(signal.reason).catch(() => {});
@@ -542,30 +612,10 @@ export function consumeForResponseLogMetadata(
       for (;;) {
         const { done, value } = await reader.read();
         if (done) {
-          buffer += decoder.decode();
-          if (buffer.trim()) {
-            const payload = sseDataPayload(buffer);
-            inspectResponseLogSsePayload(logCtx, payload);
-            reportFirstOutput(payload);
-            if (payload && onCompletedResponse) {
-              const response = completedResponseFromSsePayload(payload);
-              if (response) onCompletedResponse(response);
-            }
-          }
+          inspector.finish();
           return;
         }
-        buffer += decoder.decode(value, { stream: true });
-        let next: { block: string; rest: string } | null;
-        while ((next = nextSseBlock(buffer))) {
-          buffer = next.rest;
-          const payload = sseDataPayload(next.block);
-          inspectResponseLogSsePayload(logCtx, payload);
-          reportFirstOutput(payload);
-          if (payload && onCompletedResponse) {
-            const response = completedResponseFromSsePayload(payload);
-            if (response) onCompletedResponse(response);
-          }
-        }
+        inspector.feed(value);
       }
     } catch {
       /* metadata inspection must not affect the client-facing stream */