From c7df5f23eb86ce1eae51047feb07dbff0f5d4a6a Mon Sep 17 00:00:00 2001
From: shrijayan <81805145+shrijayan@users.noreply.github.com>
Date: Thu, 22 Oct 2026 17:02:01 +0530
Subject: [PATCH] Add Atheris fuzz target for the SSE decoder

---
 .github/workflows/ci.yml | 11 +++++++++++
 fuzz/fuzz_sse.py         | 25 +++++++++++++++++++++++++
 2 files changed, 36 insertions(+)
 create mode 100644 fuzz/fuzz_sse.py

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d6cfe0e..c8b3ebe 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -94,3 +94,14 @@ jobs:
         with:
           name: dist
           path: dist/
+
+  fuzz:
+    name: Fuzz SSE decoder
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
+        with:
+          python-version: "3.12"
+      - run: uv sync --locked
+      - run: uv run --with atheris python fuzz/fuzz_sse.py -max_total_time=60
diff --git a/fuzz/fuzz_sse.py b/fuzz/fuzz_sse.py
new file mode 100644
index 0000000..132250e
--- /dev/null
+++ b/fuzz/fuzz_sse.py
@@ -0,0 +1,25 @@
+"""Atheris fuzz target for the server-sent-events decoder.
+
+Run with: uv run --with atheris python fuzz/fuzz_sse.py
+"""
+
+import sys
+
+import atheris
+
+with atheris.instrument_imports():
+    from opencode._streaming import _Decoder, _LineSplitter
+
+
+def test_one_input(data: bytes) -> None:
+    """Feed arbitrary text through the line splitter and SSE decoder."""
+    text = atheris.FuzzedDataProvider(data).ConsumeUnicodeNoSurrogates(len(data))
+    splitter = _LineSplitter()
+    decoder = _Decoder()
+    for line in splitter.feed(text) + splitter.flush():
+        decoder.feed_line(line)
+
+
+if __name__ == "__main__":
+    atheris.Setup(sys.argv, test_one_input)
+    atheris.Fuzz()