[WRONG BRANCH] fix(responses): bound retained tool-search item IDs

[luvs01]

Motivation

• The routed tool-search rewrite retained every classified function-call item ID until the terminal event, which prevents argument-frame leakage but created an unbounded memory-retention vector for attacker-controlled upstream streams.
• The change's intent was to preserve classification past output_item.done so trailing function_call_arguments.* frames remain suppressed for routed tool_search items instead of leaking to the client.

Description

• Add hard caps MAX_CLASSIFIED_ITEM_IDS and MAX_CLASSIFIED_ITEM_ID_BYTES, track classifiedItemIdBytes, and fail closed when those caps are exceeded via TranslatorBudgetExceededError.
• Charge retained classification state to the shared translator budget under the item_ids kind and release those charges from releaseAll, overflow cleanup, and the ordinary-id clear path.
• Introduce classifyItemId and clearOrdinaryItemIds helpers and replace ad-hoc Set mutations with budgeted, bounded classification logic while preserving the late-frame suppression behavior.
• Add a focused regression test that exercises budget accounting, the classification cap overflow, and disposal cleanup, and adjust an expectation to reflect the retained-budget state.

Testing

• Ran the focused suite with bun run test -- tests/responses-tool-search-repair.test.ts, which passed all tests in that file.
• Ran bun x tsc --noEmit / bun run typecheck and bun run privacy:scan, both of which completed successfully.
• Ran a full bun run test, which was exercised but encountered an unrelated preexisting failure in tests/server-auth.test.ts (received HTTP 403 where the test expected 401), so the full-suite run was not used as a blocker for this focused fix.

---

Codex Task

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: fad25f88-73f0-45e6-91d7-635661727630

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev.

What to do

• Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.