[Provider] Normalize GitHub Copilot Responses SSE for Codex clients

[Simon-Opopeee]

Client or integration

Codex CLI and Codex App

Provider or upstream service

GitHub Copilot

OpenCodex version

2.10.2 (local validation branch agent/github-copilot-responses-compat)

Endpoint or capability

POST /v1/responses streaming, reasoning output, function-tool calls, and custom-tool calls.

Current behaviour

Authenticated GitHub Copilot Responses streams can contain Copilot-specific encrypted reasoning fields, obfuscation payloads, and provider-generated item ids. Tool argument input can arrive as obfuscated or padded deltas instead of the plaintext OpenAI Responses event contract. When these frames are passed through unchanged, Codex clients can remain in “reasoning in progress”, fail to decode a tool call, or never observe a usable terminal item.

Expected behaviour

The proxy should expose a valid OpenAI Responses SSE stream to Codex clients: stable response and item ids, canonical event names, readable tool input deltas/completions, no provider-only encrypted or obfuscation fields, and a terminal response.completed followed by [DONE].

Minimal redacted request or reproduction

curl -N http://127.0.0.1:10101/v1/responses \
  -H 'content-type: application/json' \
  --data '{
    "model": "github-copilot/gpt-5.6-luna",
    "input": "Call diagnostic_echo once with the marker copilot-stream-ok.",
    "tools": [{"type":"function","name":"diagnostic_echo","parameters":{"type":"object"}}],
    "tool_choice": "required",
    "stream": true,
    "store": false
  }'

The request is redacted and contains no access token or account identifier.

Actual response or error

Before normalization, observed streams included encrypted_content and obfuscation fields and provider-specific ids. A Codex-facing probe could receive a non-canonical tool stream such as:

event: response.output_item.added
data: {"item":{"type":"function_call","id":"provider-item-id"}}

event: response.function_call_arguments.delta
data: {"delta":"<obfuscated or padded provider payload>"}

The HTTP status was 200, but the client-visible stream was not consumable as an OpenAI Responses stream.

Upstream documentation

The public OpenAI Responses event contract is documented at https://platform.openai.com/docs/api-reference/responses. GitHub Copilot's authenticated Responses wire format does not currently have a complete public SSE specification; the incompatibility is observed from the provider endpoint and compared with the OpenAI Responses contract required by Codex clients.

Suggested mapping or implementation notes

Apply a provider-specific client-facing repair after the Copilot upstream stream is decoded: pin the first response/item ids, remove encrypted_content and obfuscation, defer function/custom input deltas until their .done payload is available, and emit the canonical Responses event sequence. Keep raw provider frames available to diagnostics and continuation logic.

Additional context and attachments

Checks

• I searched existing provider and compatibility issues.
• The request and response were redacted.
• The expected behaviour is based on an upstream specification or a concrete client requirement.

[github-actions]

_{Automated translation bookkeeping — detected language: unknown.}

[Ingwannu]

Maintainer status: this is a real GitHub Copilot Responses compatibility gap on current dev; the proxy has no Copilot-specific client-facing stream normalization today.

Draft PR #1111 is the active fix. The maintainer review found the Copilot repair path sound: it keeps raw upstream frames for inspection/continuation while normalizing only the Codex-facing relay, including stable ids, removal of provider-only encrypted/obfuscation fields, and reconstruction from authoritative tool .done payloads. The unrelated native-history bound has now been split to #1115 as requested.

#1111 remains draft because required exact-head repository CI has not run yet. This issue stays open until that focused PR is current, green, reviewed, and merged into dev; a successful local/full-suite claim alone is not the merge gate.

[Simon-Opopeee]

Thanks for the maintainer status. One clarification from our side: we have not tested this fix against Claude Code clients, so we cannot confirm the Copilot stream behavior there.

The #1111 repair targets the Codex-facing relay path (handleResponses), and the raw Copilot wire frames are preserved for inspection. If the same encrypted_content/obfuscation fields and tool-delta stream appear for Claude Code sessions routed through GitHub Copilot, the gap could be similar — but that is an unverified hypothesis on our end, not a claim. We have not made any changes to the Claude-side relay as part of this work.

Happy to investigate that path separately if the maintainers consider it in scope.

[Wibias]

Closing as fixed on dev.

#1141 added the missing GitHub Copilot Responses-stream normalization. Client-facing streams now receive canonical response/item IDs, provider-only fields are removed, and tool calls are reconstructed into a valid Responses lifecycle.

The raw upstream stream remains unchanged for diagnostics and continuation handling.