fix(providers): normalize GitHub Copilot Responses streams (#1110)

[lidge-jun]

Summary

Codex clients talking to GitHub Copilot now receive a valid Responses stream.

The github-copilot provider entry declares adapter: "openai-chat" but pins every model to Responses through modelWireDefaults, because those models reject /chat/completions for real Codex-agent traffic. Those responses reach the Responses relay, which composed only the generic image/id/snapshot repairs — nothing Copilot-specific. Clients therefore saw non-canonical ids, provider-only encrypted/obfuscation fields, and tool-call frames that never formed a valid Responses lifecycle.

A provider-scoped, client-facing normalizer now stabilizes response/item ids, strips Copilot-only fields, and reconstructs tool calls from the authoritative .done payloads.

Raw upstream frames stay untouched. Eager inspection runs before the block rewrite, and on the tee path the raw branch is consumed separately while only the client branch is rewritten — so diagnostics, request logs, and continuation still see exactly what Copilot sent.

Closes #1110.

Attribution

This is @Simon-Opopeee's work from #1111, cherry-picked with their authorship intact on both commits. The design decision that made it adoptable is keeping the repair strictly client-facing rather than mutating the upstream stream — that is what lets it coexist with inspection and continuation.

Dropped: commit 6247d3932, which edited an unrelated CI permission assertion in tests/ci-workflows.test.ts and was the sole merge conflict. That file has zero diff in this PR, verified.

Reconciled with earlier stack phases: stack 1's bounded createSseInspector work is preserved (the +37 lines of id-pinning coverage were added on top, not reverted), and stack 6's response-model rewrite is composed with the Copilot and snapshot rewrites rather than replaced.

#1111 is left open for the author. Planning unit: devlog/_plan/260806_stacked_bug_campaign/060_phase7_copilot_responses_normalization.md.

Stack 8 of the 260806 attribution campaign, stacked on #1139.

Verification

• bun test tests/github-copilot-sse-rewrite.test.ts tests/github-copilot-stream-contract.test.ts tests/sse-inspector-bounds.test.ts tests/sse-payload-rewrite.test.ts tests/passthrough-abort.test.ts — 50 pass, 0 fail
• Full suite — 9,512 pass, 8 skip, 0 fail across 593 files
• bun run typecheck — exit 0
• bun run privacy:scan — passed
• git diff --stat -- tests/ci-workflows.test.ts — empty

Live Copilot traffic is not available here, so the coverage is fixture-driven rather than a live provider run.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (2)

• ^dev$
• ^preview$

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: be27c79e-33c2-4d38-b001-87cc0a9d7129

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.