Audit of Six Streaming SDKs Uncovers Truncation and SSE Parsing Flaws

A developer systematically tested six streaming SDKs by replaying truncated event streams and checking whether clients could detect incomplete data. The method surfaced defects in four SDKs — Vercel AI SDK, LangGraph JS, Mastra, and OpenAI Node — though both findings had already been reported by others. A separate test varied only the line terminator used in Server-Sent Events, revealing that the ag-ui client fails entirely under CRLF and bare CR terminators due to a single hardcoded regex that only matches LF. Rather than degrading gracefully, the client delivers one event correctly but drops all subsequent ones, exposing a cliff-edge failure. The author notes that the method's value lies not in cleverness but in its mechanical consistency — it checks every prefix without assumptions about where bugs might hide.