fix(deepseek-web): fix SSE parser, prompt format, and error handling

[ovehbe]

Summary

• Handle all 3 DeepSeek SSE stream formats: initial fragments, APPEND operations, and bare string tokens (fixes truncated responses on expert/pro models)
• Simplify prompt builder to send system + last user message only (DeepSeek web API is single-turn, full history caused chat marker leakage in responses)
• Check json.code before token extraction (fixes "did not return access token: Authorization" on code 40003 with HTTP 200)
• Clear session cache alongside token cache on auth errors

Related Issues

• Follow-up to fix(deepseek-web): rewrite auth to userToken Bearer + WASM PoW solver #2452

Validation

• npm run lint
• npm run typecheck:core
• npm run check:cycles
• npm run check:any-budget:t11
• Unit tests: 24/24 pass

Tests Added Or Updated

• tests/unit/deepseek-web.test.ts — Updated prompt assertion for new single-turn prompt builder.

Coverage Notes

• open-sse/executors/deepseek-web.ts — SSE parser changes covered by existing streaming test (mocked flow test verifies content extraction). Error code handling covered by 40003 INVALID_TOKEN test.

Reviewer Notes

• SSE parser: DeepSeek sends 3 different stream event formats depending on model type. The original parser only handled format 1 (initial fragments), causing expert/pro models to return truncated single-word responses. Now handles all 3: initial fragments, APPEND operations ({"p":"response/fragments/-1/content","o":"APPEND","v":"word"}), and bare string tokens ({"v":"word"}).
• Prompt format: DeepSeek's web API is single-turn — sending full conversation history with <｜User｜> / <｜Assistant｜> markers caused the model to echo markers as literal text. Now sends only system prompt + last user message.
• next.config.mjs: Added 192.168.0.111 to allowedDevOrigins for remote dev testing — can be removed before release if not needed.

Made with Cursor

[gemini-code-assist]

Code Review

This pull request enhances the DeepSeek-Web executor by adding support for incremental content updates and bare string tokens in SSE streams. It also introduces a native prompt builder and improves error handling by validating response codes and clearing caches upon token expiration. Feedback focuses on correcting a greedy regular expression in the prompt builder and ensuring consistent cache key usage when evicting session entries.

[kilo-code-bot]

WARNING: Potential double-processing of SSE fragments. The condition at line 198 checks for data?.v?.response?.fragments (nested format), while line 216 checks for data?.p === "response/fragments" with Array.isArray(data?.v). If a response has both structures, the same fragments would be processed and emitted twice, causing duplicate content in the stream. Consider adding an else if or a guard to prevent double-processing.

[kilo-code-bot]

WARNING: The iteration at line 221 assumes data.v is Frag[] when p === "response/fragments". However, the preceding condition at line 198 checks for Array.isArray(data?.v?.response?.fragments) — meaning data.v could be an object with a nested response property rather than a direct array. If both conditions match the same payload, iterating data.v directly could fail or produce unexpected results.

[kilo-code-bot]

SUGGESTION: This HTTP 401/403 check before !resp.ok is redundant — these status codes will always satisfy !resp.ok. The early throw is useful to surface a specific error message, but the subsequent !resp.ok block (lines 403-404) would also be reached. Consider whether the specific message here adds value over the generic users/current HTTP ${resp.status} error below, or consolidate into a single error-handling path.

[kilo-code-bot]

WARNING: If both json.msg and json?.data?.biz_msg are undefined/null, the fallback template literal produces error code undefined instead of a meaningful message. Add a final fallback: json.msg || json?.data?.biz_msg || json?.code || "Unknown error".

[kilo-code-bot]

SUGGESTION: getTimezoneOffset() is deprecated in modern JavaScript. Consider using Intl.DateTimeFormat().resolvedOptions().timeZone or a timezone offset calculation that doesn't rely on the deprecated method. While it still works, it may be removed in future Node.js versions.

[kilo-code-bot]

SUGGESTION: Re-exporting tokenCache and sessionCache (module-level mutable state) as public exports exposes internal implementation details that could be mutated by consumers. Consider keeping these private and exposing only controlled operations (e.g., clearCaches() function) if external cache invalidation is needed. Re-exporting acquireAccessToken for testing is acceptable via @ts-expect-error or test-specific patterns.

[kilo-code-bot]

WARNING: Test assertion changed from assert.equal(capturedBody.model_type, "deepseek_r1") to assert.equal(capturedBody.model_type, "default") for the R1 model test. Under the new resolveModelOptions() logic, m.includes("r1") no longer sets modelType = "deepseek_r1" — it only sets thinkingEnabled = true. The model_type is now always "expert" or "default". This changes the API behavior sent to DeepSeek. Verify that DeepSeek's /chat/completion endpoint accepts model_type: "default" for R1 models with thinking_enabled: true.

[kilo-code-bot]

WARNING: Test assertion changed from assert.equal(capturedBody.thinking_enabled, true) to assert.equal(capturedBody.thinking_enabled, false) for the expert model test. The model name "expert" contains neither "r1" nor "think" nor "reason", so thinkingEnabled is false under the new logic. This is a behavioral change — verify that expert models should default to thinking disabled, or that users must explicitly enable thinking via thinking_enabled: true in the body.

[kilo-code-bot]

Code Review Summary

Status: 8 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	5
SUGGESTION	3

Issue Details (click to expand)

WARNING

File	Line	Issue
open-sse/executors/deepseek-web.ts	198	Potential double-processing of SSE fragments — conditions at line 198 and 216 could both match the same payload
open-sse/executors/deepseek-web.ts	221	Iterating data.v assumes it's Frag[], but line 198's check implies data.v could be an object with nested response property
open-sse/executors/deepseek-web.ts	409	Error message fallback could produce error code undefined if both json.msg and json?.data?.biz_msg are missing
tests/unit/deepseek-web.test.ts	475	R1 model test assertion changed from model_type: "deepseek_r1" to "default" — verify DeepSeek accepts this
tests/unit/deepseek-web.test.ts	574	Expert model test assertion changed from thinking_enabled: true to false — verify this is intended behavior

SUGGESTION

File	Line	Issue
open-sse/executors/deepseek-web.ts	400	HTTP 401/403 check before !resp.ok is redundant; consider consolidating error handling
open-sse/executors/deepseek-web.ts	571	getTimezoneOffset() is deprecated in modern JavaScript
open-sse/executors/deepseek-web.ts	727	Re-exporting module-level mutable state (tokenCache, sessionCache) exposes internals to consumers

Files Reviewed (2 files)

• open-sse/executors/deepseek-web.ts — 7 issues (SSE parser changes, error handling, cache management, header format, re-exports)
• tests/unit/deepseek-web.test.ts — 2 issues (behavioral changes in test assertions for R1 and expert models)

---

_{Reviewed by qwen3.6-plus · 553,216 tokens}