refactor(open-sse): #11 — dedupe client-facing SSE_HEADERS_CORS

Gom block SSE headers + CORS lặp ở streamingHandler + responsesHandler
vào sseConstants.SSE_HEADERS_CORS. Codex format-routing giữ nguyên
(logic-driven theo kim chỉ nam DATA/LOGIC docs 07).

Co-authored-by: Cursor <cursoragent@cursor.com>

open-sse/handlers/chatCore/streamingHandler.js

@@ -7,13 +7,7 @@ import { STREAM_STALL_TIMEOUT_MS } from "../../config/runtimeConfig.js";
 import { buildAbortedResponsesTerminalBytes } from "../../utils/responsesStreamHelpers.js";
 import { buildRequestDetail, extractRequestConfig, saveUsageStats } from "./requestDetail.js";
 import { saveRequestDetail } from "@/lib/usageDb.js";
-
-const SSE_HEADERS = {
-  "Content-Type": "text/event-stream",
-  "Cache-Control": "no-cache",
-  "Connection": "keep-alive",
-  "Access-Control-Allow-Origin": "*"
-};
+import { SSE_HEADERS_CORS as SSE_HEADERS } from "../../utils/sseConstants.js";
 
 /**
  * Determine which SSE transform stream to use based on provider/format.

open-sse/handlers/responsesHandler.js

@@ -7,6 +7,7 @@ import { handleChatCore } from "./chatCore.js";
 import { convertResponsesApiFormat } from "../translator/helpers/responsesApiHelper.js";
 import { createResponsesApiTransformStream } from "../transformer/responsesTransformer.js";
 import { convertResponsesStreamToJson } from "../transformer/streamToJsonConverter.js";
+import { SSE_HEADERS_CORS } from "../utils/sseConstants.js";
 
 /**
  * Handle /v1/responses request
@@ -87,12 +88,7 @@ export async function handleResponsesCore({ body, modelInfo, credentials, log, o
       success: true,
       response: new Response(transformedBody, {
         status: 200,
-        headers: {
-          "Content-Type": "text/event-stream",
-          "Cache-Control": "no-cache",
-          "Connection": "keep-alive",
-          "Access-Control-Allow-Origin": "*"
-        }
+        headers: { ...SSE_HEADERS_CORS }
       })
     };
   }

open-sse/utils/sseConstants.js

@@ -13,3 +13,11 @@ export const SSE_HEADERS_NO_BUFFER = {
   "Cache-Control": "no-cache",
   "X-Accel-Buffering": "no"
 };
+
+// Variant for client-facing SSE responses (adds permissive CORS)
+export const SSE_HEADERS_CORS = {
+  "Content-Type": "text/event-stream",
+  "Cache-Control": "no-cache",
+  "Connection": "keep-alive",
+  "Access-Control-Allow-Origin": "*"
+};