[ScriptedAlchemy]

Problem

The TypeScript client accumulated SSE lines and frame fields without a byte ceiling, and rescanned an unfinished line from its beginning after every transport chunk. A fragmented line could therefore cause quadratic delimiter scanning; an oversized response could retain unbounded parser state.

Changes

• Apply the Rust SDK's existing 64 KiB raw-line and retained event/ID/data policy, including line endings and data separators.
• Scan each incoming byte once into a fixed line buffer. Large transport chunks are handled incrementally without decoding or copying the whole chunk.
• Preserve streaming UTF-8, split CRLF, initial-only BOM handling and persistent last-event-ID accounting.
• Refuse overflow with TraceDecayMalformedResponseError and payload.limitBytes. The existing response owner cancels the body; overflow cannot reconnect, deliver the oversized frame or mask its failure with a cleanup error.
• Add a shared nine-case Rust/TypeScript framing corpus plus public-client tests for disposal, boundary conditions and deterministic linear byte inspection.
• Regenerate the extension's embedded server with its owning build script. Its app bundle and generated SDK contracts are unchanged.

The current server's bounded identifiers, test-result names, frontiers, progress and terminal receipts fit this existing allowance. PRs #4487 and #4489 cover separate JSON-body and cursor-delivery behavior; their unmerged changes are not included here.

Validation

• Before the fix: all 64 existing TypeScript SDK tests passed; nine new overflow checks failed and five compatibility checks passed.
• After the fix: 82/82 TypeScript SDK tests passed, including 18 new framing checks.
• SDK typecheck, package/declaration build and package dry run passed.
• Extension build, embedded artifact check and 41 unit checks passed.
• Pinned Rust formatting, commitlint and git diff --check passed.
• 24/24 Rust SDK client tests passed via Cargo, including the shared nine-case framing corpus and existing overflow, near-limit, terminal, reconnect and cancellation checks.
• Installed-package daemon conformance and 16 extension daemon integration cases could not start because this environment has no production tracedecay executable. These are not claimed as passing.

Fixes #4411.

[changeset-bot]

⚠️ No Changeset found

Latest commit: d942d80

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR