fix: enforce SSE terminal event boundaries

proxy/sse_event_test.go

@@ -0,0 +1,21 @@
+package proxy
+
+import "testing"
+
+func TestSSEEventTrackerRejectsEventAfterTerminalEvent(t *testing.T) {
+	var tracker sseEventTracker
+	tracker.Write([]byte("data: [DONE]\n\ndata: unexpected\n\n"))
+
+	if tracker.Complete() {
+		t.Fatal("SSE stream with an event after its terminal event must not be complete")
+	}
+}
+
+func TestSSEEventTrackerAcceptsCROnlyEventBoundary(t *testing.T) {
+	var tracker sseEventTracker
+	tracker.Write([]byte("data: [DONE]\r\r"))
+
+	if !tracker.Complete() {
+		t.Fatal("terminal SSE event with CR-only boundary should be complete")
+	}
+}