[HAYDEN-OAI]

Summary

Fix a response-backed SSE iterator lifecycle hang: after receiving an event, breaking from for await or returning the iterator could wait indefinitely for asynchronous body cancellation before the request controller was aborted.

Abort before the locally owned SSE-message iterator begins nested cleanup. This reuses the existing abort-aware cleanup and completion-sentinel state; normal EOF and [DONE], unused/completed iterators, original errors, and tee sibling ownership are preserved.

This is a nine-line production change plus focused public-API regressions. No parser, buffering, timeout, generated code, public declaration, dependency, or retry changes. Native async-generator return queued behind an unresolved next remains outside this fix.

Review follow-up (626aa57b)

Moved the nine public Responses early-exit lifecycle cases and their setup into tests/lib/streaming-early-exit.test.ts, addressing the maintainability review. All executable test code and helper declarations are unchanged. tests/lib/streaming-core.test.ts is byte-identical to the PR base (961 lines), so it is no longer part of the overall PR diff. Production code is unchanged from the initial implementation.

CI identified that the deliberate one-event for await loop had moved outside an existing filename-scoped lint exception. A single documented next-line no-unreachable-loop exception preserves that regression without changing the loop or broadening lint policy. The initial local check used the pinned linter binary with an older shared Ultracite preset; final validation below uses a clean, frozen installation of the complete pinned toolchain.

• The relocated suite retained its original before-fix detection on base 31bf7e79: four expected deferred-cancellation failures and five passing controls.
• Final full canonical handwritten unit run: 7,540/7,540 tests passed across 191 files, using Node 24.19.0 and pinned Vitest 4.1.11. The earlier cached-formatter failure is absent with the complete pinned installation.
• The combined core and early-exit suites passed all 75 tests (66 core + 9 early-exit) on Node 22.22.3, 24.19.0, and 26.7.0 with Vitest 4.1.11.
• Full canonical ./scripts/lint, TypeScript 6.0.3 checking, and whitespace checks passed with Ultracite 7.10.5, Oxfmt 0.62.0, and Oxlint 1.79.0. Normal pnpm 11.5.1 install --frozen-lockfile retained all dependency and supply-chain policies; no dependency or configuration files changed.
• Repeated adversarial self-review and independent equivalence reviews confirmed unchanged assertions, error identity, cancellation ordering, listener cleanup, imports, and test discovery. Both test paths are wholly handwritten.

The updated head is also subject to the repository's full CI. The implementation-level results below were collected before this test-only extraction.

Initial implementation verification (194a49a6)

• Four new public responses.create({ stream: true }) regressions failed on clean main before the fix; all nine new lifecycle cases now pass.
• 177 focused streaming tests pass on Node 22.22.2 and 24.19.0, including tee, SSE sentinel/error/privacy, and Bedrock Runtime coverage. The original combined streaming-core suite passed 75/75.
• 150 independent built-package checks pass across CJS/ESM and exact Node 22.0.0, 24.19.0, and 26.7.0. They cover public Responses/chat, ordinary/thread/synthesized SSE, pending/rejecting/throwing cleanup, error identity, locks/listeners, ordinary/nested tees, and real native-fetch loopback disconnects. All 30 baseline hang cases were reproduced before rebuilding.
• Canonical build, full TypeScript check, pinned Oxfmt 0.62.0, cached Oxlint 1.76.0, and whitespace checks pass. Root and core-streaming CJS/ESM declarations are byte-identical to main. All 24 streaming benchmarks completed successfully; no performance comparison is claimed.
• Final complete handwritten unit run: 7,539 passed / 7,540 total. The sole failure also reproduces on untouched main: the cached formatter fixture leaves an assignment unformatted. Local dependencies contain Vitest 4.1.10 rather than pinned 4.1.11, and Oxlint 1.76.0 rather than pinned 1.79.0; pinned CI remains authoritative.

Adversarial review

Independent reviews checked security, compatibility, cancellation/error ordering, [DONE], unstarted/unused/completed iterators, cleanup rejection observation, and tee ownership. Test cleanup was tightened to guarantee listener removal on failures and assert exactly-once cancellation after delayed cleanup settles. No blocking findings remain.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-05T07:47:45.347202Z	3e7a4f7	New commits
🔒 Security Review	✅ Completed 2026-09-05T07:49:12.199121Z	3e7a4f7	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 9.061s for Node SDK PR #2613.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	89ms
tests/chat-completions-create.test.ts	✅ Passed	116ms
tests/chat-completions-stream.test.ts	✅ Passed	129ms
tests/files-content-binary.test.ts	✅ Passed	143ms
tests/files-create-multipart.test.ts	✅ Passed	113ms
tests/files-list-pagination.test.ts	✅ Passed	136ms
tests/initialize-config.test.ts	✅ Passed	102ms
tests/instance-isolation.test.ts	✅ Passed	78ms
tests/models-list.test.ts	✅ Passed	88ms
tests/responses-background-lifecycle.test.ts	✅ Passed	152ms
tests/responses-body-method-errors.test.ts	✅ Passed	265ms
tests/responses-cancel-timeout.test.ts	✅ Passed	184ms
tests/responses-cancel.test.ts	✅ Passed	128ms
tests/responses-compact-retries.test.ts	✅ Passed	210ms
tests/responses-compact.test.ts	✅ Passed	139ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	68ms
tests/responses-create-advanced.test.ts	✅ Passed	123ms
tests/responses-create-disconnect.test.ts	✅ Passed	1.13s
tests/responses-create-errors.test.ts	✅ Passed	160ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	118ms
tests/responses-create-retries.test.ts	✅ Passed	201ms
tests/responses-create-stream-failures.test.ts	✅ Passed	144ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	2.117s
tests/responses-create-stream-wire.test.ts	✅ Passed	2.469s
tests/responses-create-stream.test.ts	✅ Passed	74ms
tests/responses-create-terminal-states.test.ts	✅ Passed	127ms
tests/responses-create-timeout.test.ts	✅ Passed	222ms
tests/responses-create.test.ts	✅ Passed	110ms
tests/responses-delete.test.ts	✅ Passed	166ms
tests/responses-input-items-errors.test.ts	✅ Passed	144ms
tests/responses-input-items-list.test.ts	✅ Passed	138ms
tests/responses-input-items-options.test.ts	✅ Passed	77ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	185ms
tests/responses-input-tokens-count.test.ts	✅ Passed	150ms
tests/responses-malformed-inputs.test.ts	✅ Passed	2.008s
tests/responses-not-found-errors.test.ts	✅ Passed	160ms
tests/responses-parse.test.ts	✅ Passed	131ms
tests/responses-retrieve-retries.test.ts	✅ Passed	185ms
tests/responses-retrieve.test.ts	✅ Passed	140ms
tests/responses-stored-method-errors.test.ts	✅ Passed	791ms
tests/retry-behavior.test.ts	✅ Passed	2.958s
tests/sdk-error-shape.test.ts	✅ Passed	218ms

View OkTest run #33953756002

_{SDK merge (c40be16d76c6) · head (626aa57bd46c) · base (31bf7e79a3bc) · OkTest (2b1bdfd25e98)}

[github-actions]

Castiron custom code

✅ No new custom-code files detected.

32 mixed files remain; 0 existing customizations changed.

Compared 31bf7e79a3bc → 626aa57bd46c. Generated baselines verified.

32 existing customizations unchanged

• api.md
• scripts/castiron/README.md
• scripts/castiron/custom_code_report.py
• scripts/castiron/test_custom_code_report.py
• src/client.ts
• src/resources/audio/transcriptions.ts
• src/resources/audio/translations.ts
• src/resources/beta/assistants.ts
• src/resources/beta/beta.ts
• src/resources/beta/index.ts
• src/resources/beta/responses/internal-base.ts
• src/resources/beta/responses/responses.ts
• src/resources/beta/threads/index.ts
• src/resources/beta/threads/runs/index.ts
• src/resources/beta/threads/runs/runs.ts
• src/resources/beta/threads/threads.ts
• src/resources/chat/completions/completions.ts
• src/resources/chat/completions/index.ts
• src/resources/conversations/index.ts
• src/resources/embeddings.ts
• src/resources/files.ts
• src/resources/fine-tuning/checkpoints/permissions.ts
• src/resources/images.ts
• src/resources/responses/internal-base.ts
• src/resources/responses/responses.ts
• src/resources/skills/skills.ts
• src/resources/skills/versions/versions.ts
• src/resources/vector-stores/file-batches.ts
• src/resources/vector-stores/files.ts
• src/resources/webhooks/index.ts
• src/resources/webhooks/webhooks.ts
• tests/lib/data-residency.test.ts

A changed generated baseline means this report cannot reliably identify which handwritten lines changed.

Inspect the custom-code diff

Download the exact patch produced by this run (requires repository access):

gh run download 33953800196 --repo openai/openai-node \
  --name castiron-custom-code-33953800196-1 --dir /tmp/castiron-custom-code-33953800196-1
git apply --stat /tmp/castiron-custom-code-33953800196-1/custom-code.patch
cat /tmp/castiron-custom-code-33953800196-1/custom-code.patch

Or reproduce it from an SDK checkout containing the vendored reporter:

git fetch --no-tags origin 31bf7e79a3bc7a9ab2911abe547d215a12ab6d68 626aa57bd46c7333e90191e2b571868d608aefe6
python3 scripts/castiron/custom_code_report.py report \
  --base 31bf7e79a3bc7a9ab2911abe547d215a12ab6d68 \
  --head 626aa57bd46c7333e90191e2b571868d608aefe6 --fetch --require-head-hash --public \
  --out /tmp/castiron-custom-code-626aa57bd46c
cat /tmp/castiron-custom-code-626aa57bd46c/custom-code.patch

This is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR.

Full report and patch

[markstuart-oai]

The early-exit fix reproduces against fresh main and resolves the hang. I found no functional regression, but the new test suite should be decomposed as noted inline before approval.

Validation at 194a49a6bf58938c3007f18140b6722d5a0bce74: 166 focused streaming tests passed on both Node 22.23.2 and 24.19.0. All four new deferred-cancellation cases failed against fresh main and pass with this change. The canonical build, eight built-package CJS/ESM public Responses checks, changed-file Oxfmt/Oxlint checks, and diff whitespace checks passed. Full type-checking was limited by unavailable example dependencies (including Azure Identity, dotenv, and Express); the SDK build type-checks passed. I did not rerun the complete unit suite, ecosystem matrix, or real-network tests.

[markstuart-oai]

Re-reviewed the complete change at 626aa57 and the test reorganization since my prior review. The earlier decomposition finding is addressed: public Responses early-exit coverage now lives in a focused 176-line suite, and streaming-core.test.ts is back below 1,000 lines. The production change is unchanged from the previously inspected version; abort-before-cleanup ordering, unused-iterator ownership, completion handling, and error identity remain covered. No substantive correctness or maintainability issues remain.

Validation: 110 focused tests passed on Node 24.19.0 through the canonical scripts/test entrypoint, including the extracted early-exit suite, core streaming tests, and line decoder tests. Verified production source and dependency files are unchanged since my prior review; git diff --check passed. I did not repeat the full package build, complete test suite, or browser/runtime matrix.