bug(transport): bound OpenCode ingress and diagnostic accumulation #13

Expected behavior

Bound pending wire/frame bytes and diagnostic tails before parsing/retention; report explicit overflow/gaps. Audit HTTP success and error body reads under separate operation budgets.

Source finding and impact

SSE readBody accumulates text until a delimiter without a frame/pending-byte bound. SpawnedServer retains stderr in an uncapped string. Downstream semantic caps do not constrain these earlier allocations.

Evidence and environment

Inspected source at 4f2ef5de7c80ad7a6199dc09869ea3b728752f0e on 2026-09-12 in the local macOS workspace. This finding has not yet been reproduced through a running application or the package integration suite.

• src/transport/SseClient.ts
• src/transport/SpawnedServer.ts

Regression and acceptance

Feed an unterminated SSE frame, many complete frames in one chunk and sustained stderr. Assert configured byte/processing budgets and deterministic overflow behavior. This is a source allocation-path finding, not a measured production leak.

The resolving PR must protect the observable contract and document any remaining uncertainty. This planning pass makes no runtime changes.

Refs Juliusolsson05/agent-code#918; planning finding F07.