[stack 7/8] feat(trace): cover Responses WebSocket turns

[OnlineChef (ChefGroep)]

Stacked re-landing of #302 (feat/trace-responses-websocket). Position 7/8; base: stack/20261005-06-trace-compact-cache. Merge bottom-up; each layer is a real merge of the original PR head, so the diff shows only that PR plus any conflict resolution (noted in the merge commit message).

Stack

#	Layer	Original
1/8	#304 feat: make prompt cache behavior measurable	#296
2/8	#305 feat: expand providers and make native model discovery account-aware	#297
3/8	#306 feat(gui): start auth-inspired OpenCodex redesign	#299
4/8	#307 feat(trace): opt-in trace store linked to usage.jsonl	#298
5/8	#308 feat(trace): add safe local trace reader	#300
6/8	#309 feat(trace): cover compact and response-cache hits	#301
7/8	#310 feat(trace): cover Responses WebSocket turns	#302
8/8	#311 feat(trace): cover live call-create HTTP	#303

---

Original description:

Summary

Adds opt-in trace-store coverage for Responses WebSocket turns on /v1/responses.

This PR is intentionally stacked on feat/trace-store / #298 and is a sibling of the local trace reader (#300) and compact/cache-hit tracing (#301).

It does not trace voice/realtime live-sideband WebSockets. Those are long-lived bidirectional sessions with different lifecycle and resource-bound semantics.

Design

Every response.create turn already has its own request id, request-log context, cancellation scope, provider routing, and terminal finalizer. This change reuses that existing logical-request boundary:

1. capture the bounded client WebSocket response.create frame as the inbound trace
2. install that trace around the existing handleResponses turn via runWithTrace
3. capture the final provider wire body through the existing shared outbound-fetch hook
4. reuse the existing SSE/JSON response inspection hooks for response hashing/body capture
5. finalize through the existing addFinalRequestLog path

The inbound trace intentionally hashes the client WS frame rather than the internally reconstructed HTTP request. This keeps client-shape drift distinct from adapter/provider-wire drift.

generate:false warmup frames remain local and are not turned into synthetic request-log rows.

Verification

Exact head 491758501a4258b0dd1a0fad837645796a9034b3:

• Responses WebSocket + provider-option e2e: 27 pass, 0 fail
• the real WebSocket provider-option spine verifies trace metadata on a completed turn:
  • request hash present
  • outbound provider-wire hash present
  • response hash present
  • response bytes observed
• bun x tsc --noEmit ✅
• bun run privacy:scan ✅
• git diff --check ✅

A clean-tree full repository suite is the final local gate.

Boundary

Live/realtime sideband WebSockets remain deliberately out of scope. Their trace model needs bounded per-session/per-frame accounting, binary-frame handling, disconnect finalization, and explicit prevention of unbounded long-lived accumulation.

Dependency

Stacked on #298. Merge/rebase only after the trace-store parent lands.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}