GitHub Copilot /responses wire incompatible with Responses clients (obfuscated deltas, encrypted reasoning, re-encrypted ids) #995

Client or integration

Codex App

Provider or upstream service

github-copilot

OpenCodex version

2.10.0 (reproduced on main and dev)

Endpoint or capability

/v1/responses streaming — tool calls, reasoning metadata, item ids

Description

GitHub Copilot's /responses wire is incompatible with Responses clients for the vscode-chat integration:

1. Streamed response.function_call_arguments.delta events carry ciphertext delta plus an obfuscation field; the .done event carries the plaintext arguments.
2. Reasoning items ship as GitHub-encrypted encrypted_content with no plaintext summary; clients cannot decrypt them and stay stuck on "thinking".
3. The response id and every item id are re-encrypted per event, so the terminal response.completed payload disagrees with the streamed events (call_id is the only stable field).

Expected behavior

Agentic turns on Responses-only Copilot models (gpt-5.6-luna, gpt-5.6-sol, gpt-5.6-terra, gpt-5.4, gpt-5.4-mini, gpt-5.5, gpt-5.3-codex — see #748) complete normally: reasoning finishes, tool calls are readable and execute, and the turn finalizes.

Actual behavior

Plain text works, but any turn that reasons or calls a tool stalls: the Codex app stays on "thinking" and never finalizes the turn (request returns 200 with tokens, but the client cannot consume the stream).

Reproduction

Stream a /v1/responses request to github-copilot/gpt-5.6-luna with stream: true, reasoning.effort: max, and a function tool; inspect the SSE events (obfuscated deltas, encrypted reasoning items, mismatched ids between created/output_item/completed).

Fix

Provider-scoped SSE rewrite for github-copilot: drop ciphertext deltas and re-emit plaintext arguments before done, neutralize encrypted reasoning items with an empty plaintext summary, pin response/item ids to first-seen values, strip obfuscation metadata. See the linked PR.