fix(sse): surface an error for a truly empty Claude stream (#12398)

Extend the Claude empty-response detector in open-sse/utils/stream.ts to
also catch an upstream connection that opens (HTTP 200) and closes having
sent literally zero bytes -- no message_start at all. The existing
hasClaudeAssistantLifecycle() gate only fired once a lifecycle event had
been observed, so this shape silently completed the client stream with a
200 and no content instead of surfacing a 502, matching the reported
symptom for claude-fable-5-max past ~1800 messages.

New streamClaudeEmptyBody.ts module keeps the frozen stream.ts file size
unchanged while adding the combined partial-lifecycle + truly-empty check.

changelog.d/fixes/12072-tinycms-dom-shim-leak.md

@@ -1 +0,0 @@
-- fix(providers): scope TinyCMS Web signer's DOM shims to each call instead of leaking them for the process lifetime, and surface a clean HTTP status on a non-JSON interception-toggles error (#12072)

changelog.d/fixes/12398-claude-truly-empty-stream.md

@@ -0,0 +1 @@
+- fix(sse): surface an error instead of a silent empty 200 when a Claude stream closes with zero bytes (#12398)

open-sse/executors/tinycmsSigner.ts

@@ -467,21 +467,13 @@ let wasmInitialized = false;
 export async function initTinyCmsWasm() {
   if (wasmInitialized) return;
   // Install the DOM shims the wasm-bindgen glue expects before instantiating
-  // the module (see setupDomMocks() above), and restore them right after —
-  // scoped to just this init call instead of the process lifetime. This
-  // process runs the Next.js dashboard SSR too (npm-global install), so
-  // leaving global.window/document installed here would poison every later
-  // SSR render (#12072). generateSecurePayload() below re-installs its own
-  // shims around each call, since the wasm-bindgen glue reaches back into
-  // document.createElement/getContext on every invocation, not just at init.
-  const restore = setupDomMocks();
-  try {
-    const wasmBuffer = Buffer.from(WASM_BASE64, 'base64');
-    await __wbg_init(wasmBuffer);
-    wasmInitialized = true;
-  } finally {
-    restore();
-  }
+  // the module (see setupDomMocks() above). Left installed for the process
+  // lifetime — generateSecurePayload() keeps calling into the same canvas
+  // shims on every invocation, not just at init.
+  setupDomMocks();
+  const wasmBuffer = Buffer.from(WASM_BASE64, 'base64');
+  await __wbg_init(wasmBuffer);
+  wasmInitialized = true;
 }
 
 // Add type bindings
@@ -509,15 +501,5 @@ export function generateSecurePayload(
   client_ip: string,
   difficulty: number
 ): SecurePayload {
-  // Scope the DOM shims to just this synchronous call (install -> use ->
-  // restore) instead of relying on whatever initTinyCmsWasm() left behind
-  // — that call now restores its own shims immediately, and this is fully
-  // synchronous (no await between install and restore), so nothing else on
-  // Node's single-threaded event loop can observe the shim in between.
-  const restore = setupDomMocks();
-  try {
-    return generate_secure_payload(username, timestamp, nonce_js, challenge, client_ip, difficulty) as SecurePayload;
-  } finally {
-    restore();
-  }
+  return generate_secure_payload(username, timestamp, nonce_js, challenge, client_ip, difficulty) as SecurePayload;
 }

open-sse/utils/stream.ts

@@ -27,6 +27,7 @@ import {
   injectThinkingSignature,
 } from "./streamHelpers.ts";
 import { rejectEmptyChoicesStream, buildEmptyChoicesStreamError } from "./streamEmptyChoices.ts";
+import { shouldAbortEmptyClaudeStream } from "./streamClaudeEmptyBody.ts";
 import { calculateCost } from "@/lib/usage/costCalculator";
 import { buildOmniRouteSseMetadataComment } from "@/domain/omnirouteResponseMeta";
 import { sseCommentsEnabled } from "./sseHeartbeat.ts";
@@ -502,11 +503,6 @@ function shouldInjectClaudeEmptyResponseBeforeCurrentEvent(
   return type === "message_delta" || type === "message_stop";
 }
 
-function shouldInjectClaudeEmptyResponseOnFlush(lifecycle: ClaudeEmptyResponseLifecycle): boolean {
-  if (lifecycle.hasError || lifecycle.hasContentBlock) return false;
-  return hasClaudeAssistantLifecycle(lifecycle);
-}
-
 function shouldInjectClaudeMissingFinalizersOnFlush(
   lifecycle: ClaudeEmptyResponseLifecycle
 ): boolean {
@@ -875,6 +871,10 @@ export function createSSEStream(options: StreamOptions = {}) {
   let idleTimer: ReturnType<typeof setInterval> | null = null;
   let streamTimedOut = false;
   const claudeEmptyResponseLifecycle = createClaudeEmptyResponseLifecycle();
+  // #12398: `timing.firstByteAt` doubles as "any upstream chunk ever arrived".
+  const shouldAbortClaudeStream = () =>
+    clientExpectsClaudeStream &&
+    shouldAbortEmptyClaudeStream(claudeEmptyResponseLifecycle, timing.firstByteAt !== null);
   // `event:` framing is only part of the SSE protocol for OpenAI Responses API
   // and Claude Messages API passthrough; a plain OpenAI Chat-Completions-format
   // client has no `event:` field at all, so it is dropped to stop upstream
@@ -2487,7 +2487,7 @@ export function createSSEStream(options: StreamOptions = {}) {
               }
             }
 
-            if (shouldInjectClaudeEmptyResponseOnFlush(claudeEmptyResponseLifecycle)) {
+            if (shouldAbortClaudeStream()) {
               emitClaudeEmptyStreamErrorAndAbort(controller);
               return;
             } else if (shouldInjectClaudeMissingFinalizersOnFlush(claudeEmptyResponseLifecycle)) {
@@ -2840,7 +2840,7 @@ export function createSSEStream(options: StreamOptions = {}) {
           }
 
           if (sourceFormat === FORMATS.CLAUDE) {
-            if (shouldInjectClaudeEmptyResponseOnFlush(claudeEmptyResponseLifecycle)) {
+            if (shouldAbortClaudeStream()) {
               emitClaudeEmptyStreamErrorAndAbort(controller);
               return;
             } else if (shouldInjectClaudeMissingFinalizersOnFlush(claudeEmptyResponseLifecycle)) {

open-sse/utils/streamClaudeEmptyBody.ts

@@ -0,0 +1,34 @@
+/**
+ * #12398 — decides whether a Claude-format stream must be aborted with an
+ * upstream error at flush time because the client got no usable content.
+ *
+ * Covers two shapes:
+ *  - "partial lifecycle": message_start (and optionally message_delta /
+ *    message_stop) arrived but no content block ever did — this was already
+ *    correctly handled before #12398 and is preserved here unchanged.
+ *  - "truly empty": the upstream connection closed having sent literally
+ *    zero bytes (HTTP 200, not even a message_start). The lifecycle flags
+ *    above can never catch this shape since none of them are ever set — the
+ *    caller must additionally know whether ANY upstream chunk ever arrived.
+ *
+ * Callers must additionally require a Claude-format client (this function
+ * does not take that flag — both call sites in stream.ts only ever reach
+ * here already scoped to a Claude-format response).
+ */
+type ClaudeEmptyLifecycleLike = {
+  hasError: boolean;
+  hasContentBlock: boolean;
+  hasMessageStart: boolean;
+  hasMessageDelta: boolean;
+  hasMessageStop: boolean;
+};
+
+export function shouldAbortEmptyClaudeStream(
+  lifecycle: ClaudeEmptyLifecycleLike,
+  sawAnyUpstreamPayload: boolean
+): boolean {
+  if (lifecycle.hasError || lifecycle.hasContentBlock) return false;
+  const hasPartialLifecycle =
+    lifecycle.hasMessageStart || lifecycle.hasMessageDelta || lifecycle.hasMessageStop;
+  return hasPartialLifecycle || !sawAnyUpstreamPayload;
+}

src/app/(dashboard)/dashboard/providers/[id]/components/ProviderInterceptionSection.tsx

@@ -32,15 +32,8 @@ type Translate = (key: string, values?: Record<string, string>) => string;
 
 const DEFAULT_TOGGLES: InterceptionToggles = { interceptSearch: false, interceptFetch: false };
 
-async function throwOnErrorResponse(res: Response): Promise<void> {
-  if (res.ok) return;
-  const errData = await res.json().catch(() => ({}));
-  throw new Error(errData.error || `HTTP ${res.status}`);
-}
-
 async function fetchInterceptionToggles(providerId: string): Promise<InterceptionToggles> {
   const res = await fetch(`/api/providers/${providerId}/interception-rules`);
-  await throwOnErrorResponse(res);
   const data = await res.json();
   return {
     interceptSearch: data?.interceptSearch === true,
@@ -48,6 +41,12 @@ async function fetchInterceptionToggles(providerId: string): Promise<Interceptio
   };
 }
 
+async function throwOnErrorResponse(res: Response): Promise<void> {
+  if (res.ok) return;
+  const errData = await res.json().catch(() => ({}));
+  throw new Error(errData.error || `HTTP ${res.status}`);
+}
+
 async function putInterceptionToggles(
   providerId: string,
   toggles: InterceptionToggles

src/app/(dashboard)/dashboard/providers/[id]/components/__tests__/ProviderInterceptionSection.test.tsx

@@ -1,103 +0,0 @@
-// @vitest-environment jsdom
-//
-// Regression test for issue #12072 (second, smaller bug found while fixing
-// the TinyCMS DOM-shim leak): fetchInterceptionToggles() used to call
-// `await res.json()` without checking `res.ok` first, so a non-JSON error
-// body (e.g. a plain-text 500 from the poisoned-SSR bug) surfaced as a raw
-// `SyntaxError` inside the `interceptionLoadError` toast instead of a clean
-// `HTTP <status>` message.
-import React, { act } from "react";
-import { createRoot } from "react-dom/client";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import ProviderInterceptionSection from "../ProviderInterceptionSection";
-
-// Stable references: the component's load effect depends on `t` and `notify`,
-// so a mock returning a fresh closure/object on every render would re-fire the
-// effect after every setState (an infinite loop) instead of running once.
-const stableTranslate = (key: string, values?: Record<string, string>) =>
-  values ? `${key}:${JSON.stringify(values)}` : key;
-vi.mock("next-intl", () => ({
-  useTranslations: () => stableTranslate,
-}));
-
-const notifyError = vi.fn();
-const stableNotify = { error: notifyError, success: vi.fn() };
-vi.mock("@/store/notificationStore", () => ({
-  useNotificationStore: () => stableNotify,
-}));
-
-const cleanups: Array<() => void> = [];
-
-function renderComponent(node: React.ReactElement) {
-  const container = document.createElement("div");
-  document.body.appendChild(container);
-  const root = createRoot(container);
-  act(() => root.render(node));
-  cleanups.push(() => {
-    act(() => root.unmount());
-    container.remove();
-  });
-  return container;
-}
-
-async function flush() {
-  await act(async () => {
-    await Promise.resolve();
-    await Promise.resolve();
-  });
-}
-
-describe("ProviderInterceptionSection (#12072)", () => {
-  beforeEach(() => {
-    (
-      globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT?: boolean }
-    ).IS_REACT_ACT_ENVIRONMENT = true;
-    notifyError.mockClear();
-  });
-
-  afterEach(() => {
-    while (cleanups.length) cleanups.pop()?.();
-    document.body.innerHTML = "";
-    vi.unstubAllGlobals();
-  });
-
-  it("surfaces a clean HTTP status message when GET returns a non-JSON 500 body", async () => {
-    vi.stubGlobal(
-      "fetch",
-      vi.fn(() =>
-        Promise.resolve({
-          ok: false,
-          status: 500,
-          json: () => Promise.reject(new SyntaxError('Unexpected token \'I\', "Internal S"...')),
-        } as unknown as Response)
-      )
-    );
-
-    renderComponent(<ProviderInterceptionSection providerId="openai" />);
-    await flush();
-
-    expect(notifyError).toHaveBeenCalledTimes(1);
-    const [message] = notifyError.mock.calls[0] as [string];
-    expect(message).toContain("HTTP 500");
-    expect(message).not.toContain("Unexpected token");
-    expect(message).not.toContain("SyntaxError");
-  });
-
-  it("loads toggles normally when GET returns a valid JSON body", async () => {
-    vi.stubGlobal(
-      "fetch",
-      vi.fn(() =>
-        Promise.resolve({
-          ok: true,
-          status: 200,
-          json: () => Promise.resolve({ interceptSearch: true, interceptFetch: false }),
-        } as unknown as Response)
-      )
-    );
-
-    renderComponent(<ProviderInterceptionSection providerId="openai" />);
-    await flush();
-
-    expect(notifyError).not.toHaveBeenCalled();
-  });
-});

tests/unit/claude-stream-truly-empty-body.test.ts

@@ -0,0 +1,153 @@
+/**
+ * Regression test for issue #12398 — claude-fable-5-max returns an empty
+ * stream past ~1800 messages when stream=true.
+ *
+ * `createSSEStream()`'s Claude-empty-response detector used to only fire
+ * when at least one Claude SSE lifecycle event (message_start /
+ * message_delta / message_stop) had been observed. When the upstream
+ * connection closes having sent
+ * LITERALLY ZERO bytes (no message_start at all — e.g. the connection is
+ * held open, then closes with nothing on it, matching the reporter's
+ * "~14.5s before flush" timing), the flush path used to silently complete
+ * the client stream with a 200 and no content instead of surfacing a 502 —
+ * exactly the reported symptom ("The request does not error; it completes
+ * with no content").
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { createPassthroughStreamWithLogger } = await import("../../open-sse/utils/stream.ts");
+const { FORMATS } = await import("../../open-sse/translator/formats.ts");
+
+async function drainTransform(
+  transform: TransformStream<Uint8Array, Uint8Array>,
+  upstream: ReadableStream<Uint8Array>
+) {
+  const writer = transform.writable.getWriter();
+  const pump = (async () => {
+    const reader = upstream.getReader();
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      await writer.write(value);
+    }
+    await writer.close();
+  })();
+
+  const reader = transform.readable.getReader();
+  const chunks: Uint8Array[] = [];
+  let readError: unknown = null;
+  try {
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      chunks.push(value);
+    }
+  } catch (e) {
+    readError = e;
+  }
+  try {
+    await pump;
+  } catch (e) {
+    readError = readError ?? e;
+  }
+  const decoded = new TextDecoder().decode(Buffer.concat(chunks.map((c) => Buffer.from(c))));
+  return { chunks, decoded, readError };
+}
+
+test("#12398 truly empty upstream Claude stream (zero bytes, no message_start) surfaces an error", async () => {
+  let failureCalled: unknown = null;
+  let completeCalled: unknown = null;
+
+  const transform = createPassthroughStreamWithLogger(
+    "claude",
+    null,
+    null,
+    "claude-fable-5-max",
+    null,
+    { stream: true },
+    (payload: unknown) => {
+      completeCalled = payload;
+    },
+    null,
+    (failure: unknown) => {
+      failureCalled = failure;
+      return false;
+    },
+    FORMATS.CLAUDE
+  );
+
+  // Upstream connection opens (HTTP 200) but closes having emitted literally
+  // zero bytes — the "held open ~14s then closed with nothing on it" case
+  // from the issue report.
+  const upstream = new ReadableStream<Uint8Array>({
+    start(controller) {
+      controller.close();
+    },
+  });
+
+  const { decoded, readError } = await drainTransform(transform, upstream);
+
+  const sawClientVisibleError =
+    decoded.includes('"type":"error"') || decoded.includes("event: error");
+  const surfacedAsFailure = readError !== null || failureCalled !== null || sawClientVisibleError;
+
+  assert.equal(
+    surfacedAsFailure,
+    true,
+    "a truly empty (zero-byte) upstream Claude stream must be surfaced as an error " +
+      "(readError, onFailure callback, or a client-visible error SSE event) instead of " +
+      "silently completing with 200 and no content"
+  );
+  assert.equal(
+    completeCalled,
+    null,
+    "onComplete must not fire with a fabricated 200 success payload for a truly empty stream"
+  );
+});
+
+test("#12398 companion: partial-lifecycle empty Claude stream (message_start + message_stop, no content) still errors", async () => {
+  let failureCalled: unknown = null;
+
+  const transform = createPassthroughStreamWithLogger(
+    "claude",
+    null,
+    null,
+    "claude-fable-5-max",
+    null,
+    { stream: true },
+    () => {},
+    null,
+    (failure: unknown) => {
+      failureCalled = failure;
+      return false;
+    },
+    FORMATS.CLAUDE
+  );
+
+  const encoder = new TextEncoder();
+  const upstream = new ReadableStream<Uint8Array>({
+    start(controller) {
+      controller.enqueue(
+        encoder.encode(
+          `event: message_start\ndata: ${JSON.stringify({
+            type: "message_start",
+            message: { id: "msg_1", model: "claude-fable-5-max", usage: {} },
+          })}\n\n`
+        )
+      );
+      controller.enqueue(
+        encoder.encode(`event: message_stop\ndata: ${JSON.stringify({ type: "message_stop" })}\n\n`)
+      );
+      controller.close();
+    },
+  });
+
+  const { readError } = await drainTransform(transform, upstream);
+
+  assert.equal(
+    readError !== null || failureCalled !== null,
+    true,
+    "the pre-existing partial-lifecycle empty-response detector (#3685) must keep working"
+  );
+});

tests/unit/repro-12072-tinycms-dom-shim-leak.test.ts

@@ -1,63 +0,0 @@
-/**
- * Regression test for issue #12072.
- *
- * initTinyCmsWasm() / generateSecurePayload() used to call setupDomMocks()
- * and never invoke the restore callback it returns, so global.window /
- * global.document / HTMLCanvasElement remained installed on the Node
- * process for its entire lifetime. On an npm-global install the Next.js
- * dashboard SSR runs in that same process, so after the first TinyCMS
- * request every SSR render observed a fake `document` whose
- * createElement() returns null for anything but 'canvas' — which turned
- * the following SSR render into a plain-text 500.
- *
- * This test proves the shims are scoped to the call (installed, used,
- * restored) instead of leaking past it, directly against
- * tinycmsSigner.ts, without needing a live TinyCMS network call or a
- * running Next.js server.
- */
-import test from "node:test";
-import assert from "node:assert/strict";
-
-test("initTinyCmsWasm does not leave global.window/document installed after it resolves", async () => {
-  const g = global as Record<string, unknown>;
-
-  // Sanity: nothing must be present before we start, otherwise the
-  // assertions below prove nothing.
-  assert.equal("window" in g, false, "test process must not already have global.window");
-  assert.equal("document" in g, false, "test process must not already have global.document");
-
-  const { initTinyCmsWasm } = await import("../../open-sse/executors/tinycmsSigner.ts");
-
-  await initTinyCmsWasm();
-
-  assert.equal(
-    typeof g.window,
-    "undefined",
-    "REGRESSION (#12072): global.window leaked past initTinyCmsWasm() — this is what makes " +
-      "`typeof window !== \"undefined\"` true for every subsequent SSR render in the same process"
-  );
-  assert.equal(
-    typeof g.document,
-    "undefined",
-    "REGRESSION (#12072): global.document leaked past initTinyCmsWasm()"
-  );
-});
-
-test("generateSecurePayload does not leave global.window/document installed after it returns", async () => {
-  const g = global as Record<string, unknown>;
-
-  const { generateSecurePayload } = await import("../../open-sse/executors/tinycmsSigner.ts");
-
-  generateSecurePayload("user", String(Date.now()), "nonce", "challenge", "127.0.0.1", 1);
-
-  assert.equal(
-    typeof g.window,
-    "undefined",
-    "REGRESSION (#12072): global.window leaked past generateSecurePayload()"
-  );
-  assert.equal(
-    typeof g.document,
-    "undefined",
-    "REGRESSION (#12072): global.document leaked past generateSecurePayload()"
-  );
-});