[HAYDEN-OAI]

Summary

• sanitize only built-in malformed newline-delimited JSON parsing in Stream.fromReadableStream, preventing raw streamed patient data, credentials, and other response contents from escaping through error messages, stack traces, or wrapper error causes
• preserve a fresh payload-free SyntaxError for the direct stream and the existing OpenAIError wrapper/cause behavior across public Chat Completions, Assistants, and Responses stream replay constructors
• retain unrelated exception identity, cancellation/reader cleanup, valid fragmented or unterminated NDJSON, configured line-size failures, disabled logging, and existing server-sent-event behavior

Security regression

The regression was written and run against unchanged main first: 6 failed and 8 passed. All four real public fromReadableStream surfaces exposed synthetic patient and credential values on the failing baseline. With the minimal parser-boundary fix, all 14 privacy and compatibility regressions pass without storing the original leaking exception as a nested cause.

Validation

• focused streaming suites: 9 files, 241 tests passed
• full handwritten suite: 122 files, 3,843 tests passed
• generated API suite against an isolated local Steady server: 82 suites, 559 tests passed (1 pre-existing skipped test)
• full repository formatter/lint and strict TypeScript checks passed
• production package build passed; emitted package types checked with current TypeScript and TypeScript 4.9
• package lint passed with its existing unrelated vendor-export warning
• packed npm artifact smoke-tested all four public stream constructors and verified payload-free outer errors and causes

Scope is exactly the handwritten stream implementation and one new dedicated regression test.

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 8.849s for Node SDK PR #2420.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	113ms
tests/chat-completions-create.test.ts	✅ Passed	197ms
tests/chat-completions-stream.test.ts	✅ Passed	159ms
tests/files-content-binary.test.ts	✅ Passed	118ms
tests/files-create-multipart.test.ts	✅ Passed	119ms
tests/files-list-pagination.test.ts	✅ Passed	110ms
tests/initialize-config.test.ts	✅ Passed	104ms
tests/instance-isolation.test.ts	✅ Passed	100ms
tests/models-list.test.ts	✅ Passed	97ms
tests/responses-background-lifecycle.test.ts	✅ Passed	154ms
tests/responses-body-method-errors.test.ts	✅ Passed	365ms
tests/responses-cancel-timeout.test.ts	✅ Passed	203ms
tests/responses-cancel.test.ts	✅ Passed	160ms
tests/responses-compact-retries.test.ts	✅ Passed	204ms
tests/responses-compact.test.ts	✅ Passed	194ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	62ms
tests/responses-create-advanced.test.ts	✅ Passed	143ms
tests/responses-create-disconnect.test.ts	✅ Passed	1.086s
tests/responses-create-errors.test.ts	✅ Passed	137ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	146ms
tests/responses-create-retries.test.ts	✅ Passed	203ms
tests/responses-create-stream-failures.test.ts	✅ Passed	161ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	2.122s
tests/responses-create-stream-wire.test.ts	✅ Passed	2.197s
tests/responses-create-stream.test.ts	✅ Passed	104ms
tests/responses-create-terminal-states.test.ts	✅ Passed	170ms
tests/responses-create-timeout.test.ts	✅ Passed	229ms
tests/responses-create.test.ts	✅ Passed	113ms
tests/responses-delete.test.ts	✅ Passed	140ms
tests/responses-input-items-errors.test.ts	✅ Passed	156ms
tests/responses-input-items-list.test.ts	✅ Passed	145ms
tests/responses-input-items-options.test.ts	✅ Passed	82ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	227ms
tests/responses-input-tokens-count.test.ts	✅ Passed	170ms
tests/responses-malformed-inputs.test.ts	✅ Passed	1.663s
tests/responses-not-found-errors.test.ts	✅ Passed	186ms
tests/responses-parse.test.ts	✅ Passed	121ms
tests/responses-retrieve-retries.test.ts	✅ Passed	207ms
tests/responses-retrieve.test.ts	✅ Passed	168ms
tests/responses-stored-method-errors.test.ts	✅ Passed	415ms
tests/retry-behavior.test.ts	✅ Passed	3.009s
tests/sdk-error-shape.test.ts	✅ Passed	345ms

View OkTest run #32288339243

_{SDK merge (545142516a6c) · head (171c00c6ed08) · base (387bbc8d267a) · OkTest (2b1bdfd25e98)}

[jbeckwith-oai]

Independent two-pass security review confirms malformed NDJSON now raises a fresh payload-free SyntaxError across public streams and Chat, Assistants, and Responses wrappers. Sensitive data stays out of error messages, causes, and stacks while unrelated errors, valid fragmented input, UTF-8, limits, cancellation, and reader cleanup retain their established behavior. Focused regressions and substantive CI are green; no actionable findings.