[WRONG BRANCH] fix(openai): bound Unicode pattern schema traversal allocations

[luvs01]

Motivation

• Prevent an availability DoS introduced by eager cloning in the Unicode-property pattern sanitizer that could amplify attacker-controlled schema sizes into large transient allocations.
• Keep the original compatibility goal: drop unsupported \p{…}/\P{…} scalar pattern constraints for Python-re backends while leaving other schema semantics intact.

Description

• Replace the previous eager traversal with an iterative copy-on-write traversal in stripUnicodePropertyPatterns so containers and sibling entries are not cloned unless an incompatible pattern is removed.
• Avoid Object.entries() materialization and per-child closure allocations by streaming object entries and cloning only the ancestor path(s) that must change; array and name-bag semantics are preserved.
• Preserve PRESERVED_PATTERN_SUBTREES, literal-value keys, and the encrypted-marker semantics so behavior for protected subtrees and literal payloads is unchanged.
• Add a regression test in tests/adapters/openai/openai-chat-hardening.test.ts that verifies broad schemas only clone affected paths while unchanged siblings retain identity.

Testing

• Ran the focused adapter hardening suite: ./node_modules/bun/bin/bun.exe test tests/adapters/openai/openai-chat-hardening.test.ts and it passed (focused tests covering the sanitizer passed).
• Ran the Responses passthrough suite: ./node_modules/bun/bin/bun.exe test tests/responses/openai-responses-passthrough.test.ts and it passed (sanitization integration checks passed).
• Ran typecheck ./node_modules/bun/bin/bun.exe x tsc --noEmit and ./node_modules/bun/bin/bun.exe run privacy:scan which both succeeded.
• A full ./node_modules/bun/bin/bun.exe run test run encountered a Bun parallel-worker panic and unrelated test failures in other suites during the repository-wide run; the focused and relevant test suites for this change succeeded.

---

Codex Task

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-10T02:38:00.470055Z	c13769a	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: ddbeb7bb-0a38-4dfd-a4da-3ce805feca6f

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev.

What to do

• Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request is being kept as a draft automatically. Once every issue above is resolved, it will be marked ready for review again.