feat(trace): cover Responses WebSocket turns

[OnlineChef (ChefGroep)]

Summary

Adds opt-in trace-store coverage for Responses WebSocket turns on /v1/responses.

This PR is intentionally stacked on feat/trace-store / #298 and is a sibling of the local trace reader (#300) and compact/cache-hit tracing (#301).

It does not trace voice/realtime live-sideband WebSockets. Those are long-lived bidirectional sessions with different lifecycle and resource-bound semantics.

Design

Every response.create turn already has its own request id, request-log context, cancellation scope, provider routing, and terminal finalizer. This change reuses that existing logical-request boundary:

1. capture the bounded client WebSocket response.create frame as the inbound trace
2. install that trace around the existing handleResponses turn via runWithTrace
3. capture the final provider wire body through the existing shared outbound-fetch hook
4. reuse the existing SSE/JSON response inspection hooks for response hashing/body capture
5. finalize through the existing addFinalRequestLog path

The inbound trace intentionally hashes the client WS frame rather than the internally reconstructed HTTP request. This keeps client-shape drift distinct from adapter/provider-wire drift.

generate:false warmup frames remain local and are not turned into synthetic request-log rows.

Verification

Exact head 491758501a4258b0dd1a0fad837645796a9034b3:

• Responses WebSocket + provider-option e2e: 27 pass, 0 fail
• the real WebSocket provider-option spine verifies trace metadata on a completed turn:
  • request hash present
  • outbound provider-wire hash present
  • response hash present
  • response bytes observed
• bun x tsc --noEmit ✅
• bun run privacy:scan ✅
• git diff --check ✅

A clean-tree full repository suite is the final local gate.

Boundary

Live/realtime sideband WebSockets remain deliberately out of scope. Their trace model needs bounded per-session/per-frame accounting, binary-frame handling, disconnect finalization, and explicit prevention of unbounded long-lived accumulation.

Dependency

Stacked on #298. Merge/rebase only after the trace-store parent lands.

---

PR-stack (mergen van onder naar boven; elke PR bouwt op de vorige):

1. feat: make prompt cache behavior measurable #296 feat: make prompt cache behavior measurable
2. feat: expand providers and make native model discovery account-aware #297 feat: expand providers and make native model discovery account-aware
3. feat(gui): start auth-inspired OpenCodex redesign #299 feat(gui): start auth-inspired OpenCodex redesign
4. feat(trace): opt-in trace store linked to usage.jsonl #298 feat(trace): opt-in trace store linked to usage.jsonl
5. feat(trace): add safe local trace reader #300 feat(trace): add safe local trace reader
6. feat(trace): cover compact and response-cache hits #301 feat(trace): cover compact and response-cache hits
7. 👉 feat(trace): cover Responses WebSocket turns #302 feat(trace): cover Responses WebSocket turns
8. feat(trace): cover live call-create HTTP #303 feat(trace): cover live call-create HTTP

Base van deze PR = de branch van de PR erboven in de lijst (#296 = main).

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[OnlineChef (ChefGroep)]

CodeRabbit (@coderabbitai) review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.