@codemieai/code 0.12.0 → 0.13.0

package/dist/providers/plugins/sso/proxy/plugins/codex-encrypted-content-sanitizer.plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-encrypted-content-sanitizer.plugin.d.ts","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/codex-encrypted-content-sanitizer.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAkB1E,qBAAa,oCAAqC,YAAW,WAAW;IACtE,EAAE,SAAsD;IACxD,IAAI,SAAuC;IAC3C,OAAO,SAAW;IAClB,QAAQ,SAAM;IAER,iBAAiB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAQ3E"}
+{"version":3,"file":"codex-encrypted-content-sanitizer.plugin.d.ts","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/codex-encrypted-content-sanitizer.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAgC1E,qBAAa,oCAAqC,YAAW,WAAW;IACtE,EAAE,SAAsD;IACxD,IAAI,SAAuC;IAC3C,OAAO,SAAW;IAClB,QAAQ,SAAM;IAER,iBAAiB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAQ3E"}

package/dist/providers/plugins/sso/proxy/plugins/codex-encrypted-content-sanitizer.plugin.js

@@ -2,29 +2,52 @@
  * Encrypted Content Sanitizer
  * Priority: 16 (after generic request sanitizer, before header injection)
  *
- * LiteLLM/Azure can reject Responses API follow-up requests when encrypted
- * reasoning content is load-balanced to a different deployment/API key than
- * the one that created it. Server-side encrypted_content_affinity is the
- * correct fix. This client-side sanitizer is a defensive fallback:
- * it removes encrypted reasoning state so the session can continue instead of
- * failing with invalid_encrypted_content.
+ * Responses API reasoning items are bound to the deployment that produced them:
+ * `encrypted_content` is decryptable only by the API key that created it, and a
+ * bare `rs_...` id is unresolvable under `store: false`. Replaying either one
+ * against the wrong deployment fails the turn.
  *
- * Scope: codemie-codex, codemie-code, codemie-opencode, and vscode-byok. This
- * cross-client fallback covers Responses-API sessions when load balancing can
- * send encrypted state to a different deployment/API key. Tradeoff: drops
- * cross-turn hidden-reasoning continuity to avoid hard invalid_encrypted_content
- * failures while preserving effort, visible messages, and tool history. If
- * server-side encrypted_content_affinity becomes available, this client strip
- * becomes redundant.
+ * The gateway now runs LiteLLM `encrypted_content_affinity`, which routes a
+ * follow-up carrying encrypted content back to its originating deployment. So
+ * the default path is pass-through: reasoning state is forwarded untouched and
+ * agents keep full cross-turn reasoning continuity.
+ *
+ * Affinity pins expire (`deployment_affinity_ttl_seconds`), and a session
+ * resumed after expiry replays state no deployment can resolve. Because clients
+ * replay their whole history every turn, that first failure would otherwise
+ * repeat forever. This interceptor therefore watches upstream responses for the
+ * two failure signatures and, once either is seen, strips reasoning state from
+ * every subsequent request for the life of the proxy. The failing turn surfaces
+ * its error; the session then self-heals with degraded continuity instead of
+ * staying stuck.
+ *
+ * Stripping is the same trade as before: reasoning effort, visible messages,
+ * tool calls, and tool outputs survive; prior hidden reasoning does not.
+ *
+ * Scope: codemie-codex, codemie-code, codemie-opencode, codemie-pi, and
+ * vscode-byok.
  */
 import { logger } from '../../../../../utils/logger.js';
 const ALLOWED_AGENTS = [
     'codemie-codex',
     'codemie-code',
     'codemie-opencode',
+    'codemie-pi',
     'vscode-byok',
 ];
 const ENCRYPTED_CONTENT_INCLUDE = 'reasoning.encrypted_content';
+const RESPONSES_PATH_SUFFIX = '/responses';
+/**
+ * Upstream signatures that mean replayed reasoning state was rejected:
+ * affinity miss or expired pin, and a bare reasoning id under `store: false`.
+ * Kept short so LiteLLM's nested JSON escaping cannot break the match.
+ */
+const UNUSABLE_REASONING_STATE_MARKERS = [
+    'invalid_encrypted_content',
+    'Items are not persisted when',
+];
+const MARKER_OVERLAP_BYTES = Math.max(...UNUSABLE_REASONING_STATE_MARKERS.map(m => m.length)) - 1;
+const MARKER_CARRY_KEY = 'encryptedContentSanitizerMarkerCarry';
 export class CodexEncryptedContentSanitizerPlugin {
     id = '@codemie/proxy-codex-encrypted-content-sanitizer';
     name = 'Codex Encrypted Content Sanitizer';
@@ -41,10 +64,15 @@ export class CodexEncryptedContentSanitizerPlugin {
 class CodexEncryptedContentSanitizerInterceptor {
     clientType;
     name = 'codex-encrypted-content-sanitizer';
+    /** Set once upstream rejects replayed reasoning state; never cleared for this proxy. */
+    reasoningStateUnusable = false;
     constructor(clientType) {
         this.clientType = clientType;
     }
     async onRequest(context) {
+        if (!this.reasoningStateUnusable) {
+            return;
+        }
         if (!context.requestBody || !context.headers['content-type']?.includes('application/json')) {
             return;
         }
@@ -63,6 +91,30 @@ class CodexEncryptedContentSanitizerInterceptor {
             // Not valid JSON or unexpected structure — pass through unchanged.
         }
     }
+    /**
+     * Read-only scan of the upstream stream. Returns the chunk untouched; the only
+     * effect is latching `reasoningStateUnusable` so later requests get stripped.
+     */
+    async onResponseChunk(context, chunk) {
+        if (this.reasoningStateUnusable || !context.url.includes(RESPONSES_PATH_SUFFIX)) {
+            return chunk;
+        }
+        // Carry lives on the per-request context: concurrent streams must not share it.
+        const carry = context.metadata[MARKER_CARRY_KEY];
+        const searchable = Buffer.isBuffer(carry) ? Buffer.concat([carry, chunk]) : chunk;
+        const marker = UNUSABLE_REASONING_STATE_MARKERS.find(m => searchable.includes(m));
+        if (marker) {
+            this.reasoningStateUnusable = true;
+            delete context.metadata[MARKER_CARRY_KEY];
+            logger.warn(`[${this.name}] Upstream rejected replayed reasoning state for ${this.clientType} ("${marker}"). ` +
+                'Stripping reasoning state from subsequent requests — cross-turn reasoning continuity is degraded ' +
+                'for the rest of this session. Expected after an encrypted_content_affinity pin expires; ' +
+                'a rising rate means deployment_affinity_ttl_seconds is too short.');
+            return chunk;
+        }
+        context.metadata[MARKER_CARRY_KEY] = searchable.subarray(Math.max(0, searchable.length - MARKER_OVERLAP_BYTES));
+        return chunk;
+    }
 }
 function sanitizeValue(value) {
     if (Array.isArray(value)) {
@@ -70,7 +122,7 @@ function sanitizeValue(value) {
         let removedCount = 0;
         const sanitizedItems = [];
         for (const item of value) {
-            if (isEncryptedReasoningItem(item)) {
+            if (isReasoningInputItem(item)) {
                 modified = true;
                 removedCount++;
                 continue;
@@ -110,10 +162,15 @@ function sanitizeValue(value) {
     }
     return { value: result, modified, removedCount };
 }
-function isEncryptedReasoningItem(value) {
-    return isPlainObject(value) &&
-        value.type === 'reasoning' &&
-        typeof value.encrypted_content === 'string';
+/**
+ * Any replayed reasoning item is deployment-bound state, not just the encrypted ones.
+ * Once `include: ["reasoning.encrypted_content"]` is stripped the upstream response
+ * carries reasoning items without `encrypted_content`; clients that persist and replay
+ * them (pi) then send a bare `rs_...` id, which `store: false` requests cannot resolve
+ * ("Item with id 'rs_...' not found"). Drop the whole item in both shapes.
+ */
+function isReasoningInputItem(value) {
+    return isPlainObject(value) && value.type === 'reasoning';
 }
 function isPlainObject(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);

package/dist/providers/plugins/sso/proxy/plugins/codex-encrypted-content-sanitizer.plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-encrypted-content-sanitizer.plugin.js","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/codex-encrypted-content-sanitizer.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AAExD,MAAM,cAAc,GAAG;IACrB,eAAe;IACf,cAAc;IACd,kBAAkB;IAClB,aAAa;CACd,CAAC;AACF,MAAM,yBAAyB,GAAG,6BAA6B,CAAC;AAQhE,MAAM,OAAO,oCAAoC;IAC/C,EAAE,GAAG,kDAAkD,CAAC;IACxD,IAAI,GAAG,mCAAmC,CAAC;IAC3C,OAAO,GAAG,OAAO,CAAC;IAClB,QAAQ,GAAG,EAAE,CAAC;IAEd,KAAK,CAAC,iBAAiB,CAAC,OAAsB;QAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,8BAA8B,UAAU,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO,IAAI,yCAAyC,CAAC,UAAU,CAAC,CAAC;IACnE,CAAC;CACF;AAED,MAAM,yCAAyC;IAGhB;IAF7B,IAAI,GAAG,mCAAmC,CAAC;IAE3C,YAA6B,UAAkB;QAAlB,eAAU,GAAV,UAAU,CAAQ;IAAG,CAAC;IAEnD,KAAK,CAAC,SAAS,CAAC,OAAqB;QACnC,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC3F,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAY,CAAC;YAC1E,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YAEtC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;gBACxB,OAAO;YACT,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACnD,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACvD,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAEvE,MAAM,CAAC,KAAK,CACV,IAAI,IAAI,CAAC,IAAI,8CAA8C,IAAI,CAAC,UAAU,aAAa,SAAS,CAAC,YAAY,UAAU,CACxH,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;QACrE,CAAC;IACH,CAAC;CACF;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,MAAM,cAAc,GAAc,EAAE,CAAC;QAErC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,QAAQ,GAAG,IAAI,CAAC;gBAChB,YAAY,EAAE,CAAC;gBACf,SAAS;YACX,CAAC;YAED,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YACtC,QAAQ,GAAG,QAAQ,IAAI,SAAS,CAAC,QAAQ,CAAC;YAC1C,YAAY,IAAI,SAAS,CAAC,YAAY,CAAC;YACvC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAC3D,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,MAAM,MAAM,GAA4B,EAAE,CAAC;IAE3C,KAAK,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,IAAI,GAAG,KAAK,mBAAmB,EAAE,CAAC;YAChC,QAAQ,GAAG,IAAI,CAAC;YAChB,YAAY,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QAED,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACnD,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,yBAAyB,CAAC,CAAC;YACtF,IAAI,eAAe,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;gBACjD,QAAQ,GAAG,IAAI,CAAC;gBAChB,YAAY,IAAI,UAAU,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC;YAC7D,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC;YAC9B,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;QAC5C,QAAQ,GAAG,QAAQ,IAAI,SAAS,CAAC,QAAQ,CAAC;QAC1C,YAAY,IAAI,SAAS,CAAC,YAAY,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC;IAChC,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,OAAO,aAAa,CAAC,KAAK,CAAC;QACzB,KAAK,CAAC,IAAI,KAAK,WAAW;QAC1B,OAAO,KAAK,CAAC,iBAAiB,KAAK,QAAQ,CAAC;AAChD,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}
+{"version":3,"file":"codex-encrypted-content-sanitizer.plugin.js","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/codex-encrypted-content-sanitizer.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AAExD,MAAM,cAAc,GAAG;IACrB,eAAe;IACf,cAAc;IACd,kBAAkB;IAClB,YAAY;IACZ,aAAa;CACd,CAAC;AACF,MAAM,yBAAyB,GAAG,6BAA6B,CAAC;AAChE,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAE3C;;;;GAIG;AACH,MAAM,gCAAgC,GAAG;IACvC,2BAA2B;IAC3B,8BAA8B;CAC/B,CAAC;AACF,MAAM,oBAAoB,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,gCAAgC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC;AAClG,MAAM,gBAAgB,GAAG,sCAAsC,CAAC;AAQhE,MAAM,OAAO,oCAAoC;IAC/C,EAAE,GAAG,kDAAkD,CAAC;IACxD,IAAI,GAAG,mCAAmC,CAAC;IAC3C,OAAO,GAAG,OAAO,CAAC;IAClB,QAAQ,GAAG,EAAE,CAAC;IAEd,KAAK,CAAC,iBAAiB,CAAC,OAAsB;QAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,8BAA8B,UAAU,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO,IAAI,yCAAyC,CAAC,UAAU,CAAC,CAAC;IACnE,CAAC;CACF;AAED,MAAM,yCAAyC;IAMhB;IAL7B,IAAI,GAAG,mCAAmC,CAAC;IAE3C,wFAAwF;IAChF,sBAAsB,GAAG,KAAK,CAAC;IAEvC,YAA6B,UAAkB;QAAlB,eAAU,GAAV,UAAU,CAAQ;IAAG,CAAC;IAEnD,KAAK,CAAC,SAAS,CAAC,OAAqB;QACnC,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACjC,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC3F,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAY,CAAC;YAC1E,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YAEtC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;gBACxB,OAAO;YACT,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACnD,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACvD,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAEvE,MAAM,CAAC,KAAK,CACV,IAAI,IAAI,CAAC,IAAI,8CAA8C,IAAI,CAAC,UAAU,aAAa,SAAS,CAAC,YAAY,UAAU,CACxH,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;QACrE,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CAAC,OAAqB,EAAE,KAAa;QACxD,IAAI,IAAI,CAAC,sBAAsB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAChF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,gFAAgF;QAChF,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAClF,MAAM,MAAM,GAAG,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAElF,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC;YACnC,OAAO,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;YAC1C,MAAM,CAAC,IAAI,CACT,IAAI,IAAI,CAAC,IAAI,oDAAoD,IAAI,CAAC,UAAU,MAAM,MAAM,MAAM;gBAClG,mGAAmG;gBACnG,0FAA0F;gBAC1F,mEAAmE,CACpE,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,UAAU,CAAC,QAAQ,CACtD,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,MAAM,GAAG,oBAAoB,CAAC,CACtD,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,MAAM,cAAc,GAAc,EAAE,CAAC;QAErC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/B,QAAQ,GAAG,IAAI,CAAC;gBAChB,YAAY,EAAE,CAAC;gBACf,SAAS;YACX,CAAC;YAED,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YACtC,QAAQ,GAAG,QAAQ,IAAI,SAAS,CAAC,QAAQ,CAAC;YAC1C,YAAY,IAAI,SAAS,CAAC,YAAY,CAAC;YACvC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAC3D,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,MAAM,MAAM,GAA4B,EAAE,CAAC;IAE3C,KAAK,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,IAAI,GAAG,KAAK,mBAAmB,EAAE,CAAC;YAChC,QAAQ,GAAG,IAAI,CAAC;YAChB,YAAY,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QAED,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACnD,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,yBAAyB,CAAC,CAAC;YACtF,IAAI,eAAe,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;gBACjD,QAAQ,GAAG,IAAI,CAAC;gBAChB,YAAY,IAAI,UAAU,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC;YAC7D,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC;YAC9B,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;QAC5C,QAAQ,GAAG,QAAQ,IAAI,SAAS,CAAC,QAAQ,CAAC;QAC1C,YAAY,IAAI,SAAS,CAAC,YAAY,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC;IAChC,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC;AAC5D,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/providers/plugins/sso/proxy/plugins/copilot-encrypted-content-sanitizer.plugin.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Copilot Encrypted Content Sanitizer
+ * Priority: 16 (after generic request sanitizer, before header injection)
+ *
+ * GitHub Copilot CLI can replay Responses API reasoning items whose
+ * `encrypted_content` is deployment-bound. If LiteLLM/Azure rejects a replayed
+ * item before the response is streamed downstream, retry the same request once
+ * after stripping replayed reasoning state so the Copilot session can continue.
+ *
+ * Scope: codemie-copilot only. The Codex sanitizer intentionally keeps its
+ * original latch-only behavior in codex-encrypted-content-sanitizer.plugin.ts.
+ */
+import { ProxyPlugin, PluginContext, ProxyInterceptor } from './types.js';
+export declare class CopilotEncryptedContentSanitizerPlugin implements ProxyPlugin {
+    id: string;
+    name: string;
+    version: string;
+    priority: number;
+    createInterceptor(context: PluginContext): Promise<ProxyInterceptor>;
+}
+//# sourceMappingURL=copilot-encrypted-content-sanitizer.plugin.d.ts.map

package/dist/providers/plugins/sso/proxy/plugins/copilot-encrypted-content-sanitizer.plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"copilot-encrypted-content-sanitizer.plugin.d.ts","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/copilot-encrypted-content-sanitizer.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAyB,MAAM,YAAY,CAAC;AAkBjG,qBAAa,sCAAuC,YAAW,WAAW;IACxE,EAAE,SAAwD;IAC1D,IAAI,SAAyC;IAC7C,OAAO,SAAW;IAClB,QAAQ,SAAM;IAER,iBAAiB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAQ3E"}

package/dist/providers/plugins/sso/proxy/plugins/copilot-encrypted-content-sanitizer.plugin.js

@@ -0,0 +1,133 @@
+/**
+ * Copilot Encrypted Content Sanitizer
+ * Priority: 16 (after generic request sanitizer, before header injection)
+ *
+ * GitHub Copilot CLI can replay Responses API reasoning items whose
+ * `encrypted_content` is deployment-bound. If LiteLLM/Azure rejects a replayed
+ * item before the response is streamed downstream, retry the same request once
+ * after stripping replayed reasoning state so the Copilot session can continue.
+ *
+ * Scope: codemie-copilot only. The Codex sanitizer intentionally keeps its
+ * original latch-only behavior in codex-encrypted-content-sanitizer.plugin.ts.
+ */
+import { logger } from '../../../../../utils/logger.js';
+const ALLOWED_AGENTS = ['codemie-copilot'];
+const ENCRYPTED_CONTENT_INCLUDE = 'reasoning.encrypted_content';
+const RESPONSES_PATH_SUFFIX = '/responses';
+const UNUSABLE_REASONING_STATE_MARKERS = [
+    'invalid_encrypted_content',
+    'Items are not persisted when',
+];
+export class CopilotEncryptedContentSanitizerPlugin {
+    id = '@codemie/proxy-copilot-encrypted-content-sanitizer';
+    name = 'Copilot Encrypted Content Sanitizer';
+    version = '1.0.0';
+    priority = 16;
+    async createInterceptor(context) {
+        const clientType = context.config.clientType;
+        if (!clientType || !ALLOWED_AGENTS.includes(clientType)) {
+            throw new Error(`Plugin disabled for agent: ${clientType}`);
+        }
+        return new CopilotEncryptedContentSanitizerInterceptor(clientType);
+    }
+}
+class CopilotEncryptedContentSanitizerInterceptor {
+    clientType;
+    name = 'copilot-encrypted-content-sanitizer';
+    constructor(clientType) {
+        this.clientType = clientType;
+    }
+    async onUpstreamResponse(context, response, tools) {
+        if (!this.isResponsesRequest(context) || (response.statusCode ?? 200) < 400) {
+            return response;
+        }
+        const responseBody = await tools.readBody(response);
+        const marker = UNUSABLE_REASONING_STATE_MARKERS.find(m => responseBody.includes(m));
+        if (!marker) {
+            return tools.fromBuffer(response, responseBody);
+        }
+        const sanitizedRequest = this.sanitizeRequestBody(context);
+        if (!sanitizedRequest) {
+            return tools.fromBuffer(response, responseBody);
+        }
+        logger.warn(`[${this.name}] Upstream rejected replayed reasoning state for ${this.clientType} ("${marker}"). ` +
+            `Retrying once without reasoning state: ${sanitizedRequest.removedCount} item(s) removed.`);
+        return tools.retry(sanitizedRequest.body);
+    }
+    isResponsesRequest(context) {
+        const path = context.url.split('?')[0].replace(/\/+$/, '');
+        return path.endsWith(RESPONSES_PATH_SUFFIX);
+    }
+    sanitizeRequestBody(context) {
+        if (!context.requestBody || !context.headers['content-type']?.includes('application/json')) {
+            return null;
+        }
+        try {
+            const body = JSON.parse(context.requestBody.toString('utf-8'));
+            const sanitized = sanitizeValue(body);
+            if (!sanitized.modified) {
+                return null;
+            }
+            const newBody = Buffer.from(JSON.stringify(sanitized.value), 'utf-8');
+            context.requestBody = newBody;
+            context.headers['content-length'] = String(newBody.length);
+            return { body: newBody, removedCount: sanitized.removedCount };
+        }
+        catch {
+            return null;
+        }
+    }
+}
+function sanitizeValue(value) {
+    if (Array.isArray(value)) {
+        let modified = false;
+        let removedCount = 0;
+        const sanitizedItems = [];
+        for (const item of value) {
+            if (isReasoningInputItem(item)) {
+                modified = true;
+                removedCount++;
+                continue;
+            }
+            const sanitized = sanitizeValue(item);
+            modified = modified || sanitized.modified;
+            removedCount += sanitized.removedCount;
+            sanitizedItems.push(sanitized.value);
+        }
+        return { value: sanitizedItems, modified, removedCount };
+    }
+    if (!isPlainObject(value)) {
+        return { value, modified: false, removedCount: 0 };
+    }
+    let modified = false;
+    let removedCount = 0;
+    const result = {};
+    for (const [key, childValue] of Object.entries(value)) {
+        if (key === 'encrypted_content') {
+            modified = true;
+            removedCount++;
+            continue;
+        }
+        if (key === 'include' && Array.isArray(childValue)) {
+            const filteredInclude = childValue.filter(item => item !== ENCRYPTED_CONTENT_INCLUDE);
+            if (filteredInclude.length !== childValue.length) {
+                modified = true;
+                removedCount += childValue.length - filteredInclude.length;
+            }
+            result[key] = filteredInclude;
+            continue;
+        }
+        const sanitized = sanitizeValue(childValue);
+        modified = modified || sanitized.modified;
+        removedCount += sanitized.removedCount;
+        result[key] = sanitized.value;
+    }
+    return { value: result, modified, removedCount };
+}
+function isReasoningInputItem(value) {
+    return isPlainObject(value) && value.type === 'reasoning';
+}
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=copilot-encrypted-content-sanitizer.plugin.js.map

package/dist/providers/plugins/sso/proxy/plugins/copilot-encrypted-content-sanitizer.plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"copilot-encrypted-content-sanitizer.plugin.js","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/copilot-encrypted-content-sanitizer.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AAExD,MAAM,cAAc,GAAG,CAAC,iBAAiB,CAAC,CAAC;AAC3C,MAAM,yBAAyB,GAAG,6BAA6B,CAAC;AAChE,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAC3C,MAAM,gCAAgC,GAAG;IACvC,2BAA2B;IAC3B,8BAA8B;CAC/B,CAAC;AAQF,MAAM,OAAO,sCAAsC;IACjD,EAAE,GAAG,oDAAoD,CAAC;IAC1D,IAAI,GAAG,qCAAqC,CAAC;IAC7C,OAAO,GAAG,OAAO,CAAC;IAClB,QAAQ,GAAG,EAAE,CAAC;IAEd,KAAK,CAAC,iBAAiB,CAAC,OAAsB;QAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,8BAA8B,UAAU,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO,IAAI,2CAA2C,CAAC,UAAU,CAAC,CAAC;IACrE,CAAC;CACF;AAED,MAAM,2CAA2C;IAGlB;IAF7B,IAAI,GAAG,qCAAqC,CAAC;IAE7C,YAA6B,UAAkB;QAAlB,eAAU,GAAV,UAAU,CAAQ;IAAG,CAAC;IAEnD,KAAK,CAAC,kBAAkB,CACtB,OAAqB,EACrB,QAAyB,EACzB,KAA4B;QAE5B,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC;YAC5E,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,CAAC,IAAI,CACT,IAAI,IAAI,CAAC,IAAI,oDAAoD,IAAI,CAAC,UAAU,MAAM,MAAM,MAAM;YAClG,0CAA0C,gBAAgB,CAAC,YAAY,mBAAmB,CAC3F,CAAC;QAEF,OAAO,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IAEO,kBAAkB,CAAC,OAAqB;QAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;IAC9C,CAAC;IAEO,mBAAmB,CAAC,OAAqB;QAC/C,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC3F,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAY,CAAC;YAC1E,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;YACtE,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC;YAC9B,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAE3D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,MAAM,cAAc,GAAc,EAAE,CAAC;QAErC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/B,QAAQ,GAAG,IAAI,CAAC;gBAChB,YAAY,EAAE,CAAC;gBACf,SAAS;YACX,CAAC;YAED,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YACtC,QAAQ,GAAG,QAAQ,IAAI,SAAS,CAAC,QAAQ,CAAC;YAC1C,YAAY,IAAI,SAAS,CAAC,YAAY,CAAC;YACvC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAC3D,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,MAAM,MAAM,GAA4B,EAAE,CAAC;IAE3C,KAAK,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,IAAI,GAAG,KAAK,mBAAmB,EAAE,CAAC;YAChC,QAAQ,GAAG,IAAI,CAAC;YAChB,YAAY,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QAED,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACnD,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,yBAAyB,CAAC,CAAC;YACtF,IAAI,eAAe,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;gBACjD,QAAQ,GAAG,IAAI,CAAC;gBAChB,YAAY,IAAI,UAAU,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC;YAC7D,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC;YAC9B,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;QAC5C,QAAQ,GAAG,QAAQ,IAAI,SAAS,CAAC,QAAQ,CAAC;QAC1C,YAAY,IAAI,SAAS,CAAC,YAAY,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC;IAChC,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC;AAC5D,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/providers/plugins/sso/proxy/plugins/header-injection.plugin.js

@@ -28,7 +28,7 @@ class HeaderInjectionInterceptor {
         context.headers['X-CodeMie-Session-ID'] = context.sessionId;
         // LiteLLM can use these headers for Responses API session affinity when
         // its router is configured with session-aware pre-call checks.
-        if (this.context.config.clientType === 'codemie-codex') {
+        if (this.context.config.clientType === 'codemie-codex' || this.context.config.clientType === 'codemie-copilot') {
             context.headers['x-litellm-session-id'] = context.sessionId;
         }
         // Add CLI version header

package/dist/providers/plugins/sso/proxy/plugins/header-injection.plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"header-injection.plugin.js","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/header-injection.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AAExD,MAAM,OAAO,qBAAqB;IAChC,EAAE,GAAG,wBAAwB,CAAC;IAC9B,IAAI,GAAG,kBAAkB,CAAC;IAC1B,OAAO,GAAG,OAAO,CAAC;IAClB,QAAQ,GAAG,EAAE,CAAC;IAEd,KAAK,CAAC,iBAAiB,CAAC,OAAsB;QAC5C,OAAO,IAAI,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;CACF;AAED,MAAM,0BAA0B;IAGV;IAFpB,IAAI,GAAG,kBAAkB,CAAC;IAE1B,YAAoB,OAAsB;QAAtB,YAAO,GAAP,OAAO,CAAe;IAAG,CAAC;IAE9C,KAAK,CAAC,SAAS,CAAC,OAAqB;QACnC,iCAAiC;QACjC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QAC5D,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QAE5D,wEAAwE;QACxE,+DAA+D;QAC/D,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;YACvD,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QAC9D,CAAC;QAED,yBAAyB;QACzB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC;QAC1D,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,UAAU,EAAE,CAAC;QAE/D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAEnC,gDAAgD;QAChD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QACrE,MAAM,mBAAmB,GAAG,QAAQ,EAAE,gBAAgB,EAAE,mBAAmB,KAAK,IAAI,CAAC;QAErF,uDAAuD;QACvD,IAAI,mBAAmB,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YAChD,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC;QAClE,CAAC;QAED,qDAAqD;QACrD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;QACxD,CAAC;QAED,uDAAuD;QACvD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC;QAED,yBAAyB;QACzB,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC;QAC1D,CAAC;QAED,6CAA6C;QAC7C,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC;QAC9D,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;QACtD,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;QACxD,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,4BAA4B,CAAC,CAAC;IAC1D,CAAC;CACF"}
+{"version":3,"file":"header-injection.plugin.js","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/header-injection.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AAExD,MAAM,OAAO,qBAAqB;IAChC,EAAE,GAAG,wBAAwB,CAAC;IAC9B,IAAI,GAAG,kBAAkB,CAAC;IAC1B,OAAO,GAAG,OAAO,CAAC;IAClB,QAAQ,GAAG,EAAE,CAAC;IAEd,KAAK,CAAC,iBAAiB,CAAC,OAAsB;QAC5C,OAAO,IAAI,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;CACF;AAED,MAAM,0BAA0B;IAGV;IAFpB,IAAI,GAAG,kBAAkB,CAAC;IAE1B,YAAoB,OAAsB;QAAtB,YAAO,GAAP,OAAO,CAAe;IAAG,CAAC;IAE9C,KAAK,CAAC,SAAS,CAAC,OAAqB;QACnC,iCAAiC;QACjC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QAC5D,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QAE5D,wEAAwE;QACxE,+DAA+D;QAC/D,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,KAAK,eAAe,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,KAAK,iBAAiB,EAAE,CAAC;YAC/G,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QAC9D,CAAC;QAED,yBAAyB;QACzB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC;QAC1D,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,UAAU,EAAE,CAAC;QAE/D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAEnC,gDAAgD;QAChD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QACrE,MAAM,mBAAmB,GAAG,QAAQ,EAAE,gBAAgB,EAAE,mBAAmB,KAAK,IAAI,CAAC;QAErF,uDAAuD;QACvD,IAAI,mBAAmB,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YAChD,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC;QAClE,CAAC;QAED,qDAAqD;QACrD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;QACxD,CAAC;QAED,uDAAuD;QACvD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC;QAED,yBAAyB;QACzB,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC;QAC1D,CAAC;QAED,6CAA6C;QAC7C,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC;QAC9D,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;QACtD,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;QACxD,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,4BAA4B,CAAC,CAAC;IAC1D,CAAC;CACF"}

package/dist/providers/plugins/sso/proxy/plugins/index.d.ts

@@ -14,6 +14,7 @@ import { RequestSanitizerPlugin } from './request-sanitizer.plugin.js';
 import { ClaudeRequestNormalizerPlugin } from './claude-request-normalizer.plugin.js';
 import { KimiRequestNormalizerPlugin } from './kimi-request-normalizer.plugin.js';
 import { CodexEncryptedContentSanitizerPlugin } from './codex-encrypted-content-sanitizer.plugin.js';
+import { CopilotEncryptedContentSanitizerPlugin } from './copilot-encrypted-content-sanitizer.plugin.js';
 import { VsCodeRequestNormalizerPlugin } from './vscode-request-normalizer.plugin.js';
 import { LoggingPlugin } from './logging.plugin.js';
 /**
@@ -21,7 +22,7 @@ import { LoggingPlugin } from './logging.plugin.js';
  * Called at app startup
  */
 export declare function registerCorePlugins(): void;
-export { MCPAuthPlugin, EndpointBlockerPlugin, GatewayKeyPlugin, SSOAuthPlugin, JWTAuthPlugin, HeaderInjectionPlugin, RequestSanitizerPlugin, ClaudeRequestNormalizerPlugin, KimiRequestNormalizerPlugin, CodexEncryptedContentSanitizerPlugin, VsCodeRequestNormalizerPlugin, LoggingPlugin, };
+export { MCPAuthPlugin, EndpointBlockerPlugin, GatewayKeyPlugin, SSOAuthPlugin, JWTAuthPlugin, HeaderInjectionPlugin, RequestSanitizerPlugin, ClaudeRequestNormalizerPlugin, KimiRequestNormalizerPlugin, CodexEncryptedContentSanitizerPlugin, CopilotEncryptedContentSanitizerPlugin, VsCodeRequestNormalizerPlugin, LoggingPlugin, };
 export { SSOSessionSyncPlugin } from './sso.session-sync.plugin.js';
 export { getPluginRegistry, resetPluginRegistry } from './registry.js';
 export * from './types.js';

package/dist/providers/plugins/sso/proxy/plugins/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,oCAAoC,EAAE,MAAM,+CAA+C,CAAC;AACrG,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAiB1C;AAMD,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,6BAA6B,EAC7B,2BAA2B,EAC3B,oCAAoC,EACpC,6BAA6B,EAC7B,aAAa,GACd,CAAC;AACF,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACvE,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,oCAAoC,EAAE,MAAM,+CAA+C,CAAC;AACrG,OAAO,EAAE,sCAAsC,EAAE,MAAM,iDAAiD,CAAC;AACzG,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAkB1C;AAMD,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,6BAA6B,EAC7B,2BAA2B,EAC3B,oCAAoC,EACpC,sCAAsC,EACtC,6BAA6B,EAC7B,aAAa,GACd,CAAC;AACF,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACvE,cAAc,YAAY,CAAC"}

package/dist/providers/plugins/sso/proxy/plugins/index.js

@@ -15,6 +15,7 @@ import { RequestSanitizerPlugin } from './request-sanitizer.plugin.js';
 import { ClaudeRequestNormalizerPlugin } from './claude-request-normalizer.plugin.js';
 import { KimiRequestNormalizerPlugin } from './kimi-request-normalizer.plugin.js';
 import { CodexEncryptedContentSanitizerPlugin } from './codex-encrypted-content-sanitizer.plugin.js';
+import { CopilotEncryptedContentSanitizerPlugin } from './copilot-encrypted-content-sanitizer.plugin.js';
 import { VsCodeRequestNormalizerPlugin } from './vscode-request-normalizer.plugin.js';
 import { LoggingPlugin } from './logging.plugin.js';
 import { SSOSessionSyncPlugin } from './sso.session-sync.plugin.js';
@@ -33,7 +34,8 @@ export function registerCorePlugins() {
     registry.register(new ClaudeRequestNormalizerPlugin()); // Priority 14 - normalizes thinking params for claude models
     registry.register(new KimiRequestNormalizerPlugin()); // Priority 14 - caps Kimi output token requests for upstream limits
     registry.register(new RequestSanitizerPlugin()); // Priority 15 - strips unsupported reasoning params
-    registry.register(new CodexEncryptedContentSanitizerPlugin()); // Priority 16 - strips deployment-bound encrypted Responses reasoning state
+    registry.register(new CodexEncryptedContentSanitizerPlugin()); // Priority 16 - forwards Responses reasoning state; strips it only after upstream rejects a replay
+    registry.register(new CopilotEncryptedContentSanitizerPlugin()); // Priority 16 - retries Copilot once after encrypted reasoning replay rejection
     registry.register(new VsCodeRequestNormalizerPlugin()); // Priority 17 - constrains VS Code user identifiers
     registry.register(new HeaderInjectionPlugin());
     registry.register(new LoggingPlugin()); // Always enabled - logs to log files at INFO level
@@ -42,7 +44,7 @@ export function registerCorePlugins() {
 // Auto-register on import
 registerCorePlugins();
 // Re-export for convenience
-export { MCPAuthPlugin, EndpointBlockerPlugin, GatewayKeyPlugin, SSOAuthPlugin, JWTAuthPlugin, HeaderInjectionPlugin, RequestSanitizerPlugin, ClaudeRequestNormalizerPlugin, KimiRequestNormalizerPlugin, CodexEncryptedContentSanitizerPlugin, VsCodeRequestNormalizerPlugin, LoggingPlugin, };
+export { MCPAuthPlugin, EndpointBlockerPlugin, GatewayKeyPlugin, SSOAuthPlugin, JWTAuthPlugin, HeaderInjectionPlugin, RequestSanitizerPlugin, ClaudeRequestNormalizerPlugin, KimiRequestNormalizerPlugin, CodexEncryptedContentSanitizerPlugin, CopilotEncryptedContentSanitizerPlugin, VsCodeRequestNormalizerPlugin, LoggingPlugin, };
 export { SSOSessionSyncPlugin } from './sso.session-sync.plugin.js';
 export { getPluginRegistry, resetPluginRegistry } from './registry.js';
 export * from './types.js';

package/dist/providers/plugins/sso/proxy/plugins/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,oCAAoC,EAAE,MAAM,+CAA+C,CAAC;AACrG,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEpE;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IAErC,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,sCAAsC;IAC9E,QAAQ,CAAC,QAAQ,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC,CAAC,+CAA+C;IAC/F,QAAQ,CAAC,QAAQ,CAAC,IAAI,gBAAgB,EAAE,CAAC,CAAC,CAAC,2EAA2E;IACtH,QAAQ,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,IAAI,6BAA6B,EAAE,CAAC,CAAC,CAAC,6DAA6D;IACrH,QAAQ,CAAC,QAAQ,CAAC,IAAI,2BAA2B,EAAE,CAAC,CAAC,CAAC,oEAAoE;IAC1H,QAAQ,CAAC,QAAQ,CAAC,IAAI,sBAAsB,EAAE,CAAC,CAAC,CAAC,oDAAoD;IACrG,QAAQ,CAAC,QAAQ,CAAC,IAAI,oCAAoC,EAAE,CAAC,CAAC,CAAC,4EAA4E;IAC3I,QAAQ,CAAC,QAAQ,CAAC,IAAI,6BAA6B,EAAE,CAAC,CAAC,CAAC,oDAAoD;IAC5G,QAAQ,CAAC,QAAQ,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC;IAC/C,QAAQ,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,mDAAmD;IAC3F,QAAQ,CAAC,QAAQ,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC,CAAC,wDAAwD;AACzG,CAAC;AAED,0BAA0B;AAC1B,mBAAmB,EAAE,CAAC;AAEtB,4BAA4B;AAC5B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,6BAA6B,EAC7B,2BAA2B,EAC3B,oCAAoC,EACpC,6BAA6B,EAC7B,aAAa,GACd,CAAC;AACF,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACvE,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,oCAAoC,EAAE,MAAM,+CAA+C,CAAC;AACrG,OAAO,EAAE,sCAAsC,EAAE,MAAM,iDAAiD,CAAC;AACzG,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEpE;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IAErC,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,sCAAsC;IAC9E,QAAQ,CAAC,QAAQ,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC,CAAC,+CAA+C;IAC/F,QAAQ,CAAC,QAAQ,CAAC,IAAI,gBAAgB,EAAE,CAAC,CAAC,CAAC,2EAA2E;IACtH,QAAQ,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,IAAI,6BAA6B,EAAE,CAAC,CAAC,CAAC,6DAA6D;IACrH,QAAQ,CAAC,QAAQ,CAAC,IAAI,2BAA2B,EAAE,CAAC,CAAC,CAAC,oEAAoE;IAC1H,QAAQ,CAAC,QAAQ,CAAC,IAAI,sBAAsB,EAAE,CAAC,CAAC,CAAC,oDAAoD;IACrG,QAAQ,CAAC,QAAQ,CAAC,IAAI,oCAAoC,EAAE,CAAC,CAAC,CAAC,mGAAmG;IAClK,QAAQ,CAAC,QAAQ,CAAC,IAAI,sCAAsC,EAAE,CAAC,CAAC,CAAC,gFAAgF;IACjJ,QAAQ,CAAC,QAAQ,CAAC,IAAI,6BAA6B,EAAE,CAAC,CAAC,CAAC,oDAAoD;IAC5G,QAAQ,CAAC,QAAQ,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC;IAC/C,QAAQ,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,mDAAmD;IAC3F,QAAQ,CAAC,QAAQ,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC,CAAC,wDAAwD;AACzG,CAAC;AAED,0BAA0B;AAC1B,mBAAmB,EAAE,CAAC;AAEtB,4BAA4B;AAC5B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,6BAA6B,EAC7B,2BAA2B,EAC3B,oCAAoC,EACpC,sCAAsC,EACtC,6BAA6B,EAC7B,aAAa,GACd,CAAC;AACF,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACvE,cAAc,YAAY,CAAC"}

package/dist/providers/plugins/sso/proxy/plugins/types.d.ts

@@ -65,6 +65,12 @@ export interface ProxyInterceptor {
     onRequest?(context: ProxyContext): Promise<void>;
     /** Called after response headers received (BEFORE body streaming) */
     onResponseHeaders?(context: ProxyContext, headers: IncomingHttpHeaders): Promise<void>;
+    /**
+     * Called after the upstream response is received but before headers/body are
+     * streamed downstream. Interceptors may return the original response or a
+     * replacement response (for example, after a sanitized one-shot retry).
+     */
+    onUpstreamResponse?(context: ProxyContext, response: IncomingMessage, tools: UpstreamResponseTools): Promise<IncomingMessage>;
     /** Called during streaming (optional, for transform/inspection) */
     onResponseChunk?(context: ProxyContext, chunk: Buffer): Promise<Buffer | null>;
     /** Called after response fully streamed */
@@ -88,6 +94,11 @@ export interface ProxyInterceptor {
      */
     handleRequest?(context: ProxyContext, req: IncomingMessage, res: ServerResponse, httpClient: ProxyHTTPClient): Promise<boolean>;
 }
+export interface UpstreamResponseTools {
+    readBody(response: IncomingMessage): Promise<Buffer>;
+    retry(requestBody: Buffer): Promise<IncomingMessage>;
+    fromBuffer(response: IncomingMessage, body: Buffer): IncomingMessage;
+}
 /**
  * Response metadata (after streaming)
  */

package/dist/providers/plugins/sso/proxy/plugins/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,MAAM,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE/D;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,kEAAkE;IAClE,EAAE,EAAE,MAAM,CAAC;IAEX,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IAEb,qBAAqB;IACrB,OAAO,EAAE,MAAM,CAAC;IAEhB,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;IAEjB,6CAA6C;IAC7C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAExB,kCAAkC;IAClC,iBAAiB,CAAC,OAAO,EAAE,aAAa,GAAG,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAExF,sBAAsB;IACtB,SAAS,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,WAAW,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,SAAS,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,OAAO,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,cAAc,GAAG,cAAc,CAAC;IAC9C,eAAe,CAAC,EAAE,cAAc,GAAG,cAAc,CAAC;IAClD,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IAEb,oDAAoD;IACpD,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/B,4CAA4C;IAC5C,WAAW,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9B,uCAAuC;IACvC,SAAS,CAAC,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjD,qEAAqE;IACrE,iBAAiB,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvF,mEAAmE;IACnE,eAAe,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE/E,2CAA2C;IAC3C,kBAAkB,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtF,0BAA0B;IAC1B,OAAO,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7D;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,CACZ,OAAO,EAAE,YAAY,EACrB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,UAAU,EAAE,eAAe,GAC1B,OAAO,CAAC,OAAO,CAAC,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,mBAAmB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,MAAM,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE/D;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,kEAAkE;IAClE,EAAE,EAAE,MAAM,CAAC;IAEX,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IAEb,qBAAqB;IACrB,OAAO,EAAE,MAAM,CAAC;IAEhB,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;IAEjB,6CAA6C;IAC7C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAExB,kCAAkC;IAClC,iBAAiB,CAAC,OAAO,EAAE,aAAa,GAAG,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAExF,sBAAsB;IACtB,SAAS,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,WAAW,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,SAAS,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,OAAO,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,cAAc,GAAG,cAAc,CAAC;IAC9C,eAAe,CAAC,EAAE,cAAc,GAAG,cAAc,CAAC;IAClD,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IAEb,oDAAoD;IACpD,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/B,4CAA4C;IAC5C,WAAW,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9B,uCAAuC;IACvC,SAAS,CAAC,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjD,qEAAqE;IACrE,iBAAiB,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvF;;;;OAIG;IACH,kBAAkB,CAAC,CACjB,OAAO,EAAE,YAAY,EACrB,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,eAAe,CAAC,CAAC;IAE5B,mEAAmE;IACnE,eAAe,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE/E,2CAA2C;IAC3C,kBAAkB,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtF,0BAA0B;IAC1B,OAAO,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7D;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,CACZ,OAAO,EAAE,YAAY,EACrB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,UAAU,EAAE,eAAe,GAC1B,OAAO,CAAC,OAAO,CAAC,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,KAAK,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACrD,UAAU,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC;CACtE;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,mBAAmB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB"}

package/dist/providers/plugins/sso/proxy/sso.proxy.d.ts

@@ -82,6 +82,8 @@ export declare class CodeMieProxy {
      * For onRequest hooks: stop execution if any plugin blocks the request
      */
     private runHook;
+    private runUpstreamResponseHooks;
+    private createBufferedResponse;
     /**
      * Handle errors with proper status codes and structure
      */

package/dist/providers/plugins/sso/proxy/sso.proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sso.proxy.d.ts","sourceRoot":"","sources":["../../../../../src/providers/plugins/sso/proxy/sso.proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAUH,OAAO,EAAE,WAAW,EAAgB,MAAM,kBAAkB,CAAC;AAI7D,OAAO,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,qBAAa,YAAY;IAOX,OAAO,CAAC,MAAM;IAN1B,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,UAAU,CAAkB;IACpC,OAAO,CAAC,YAAY,CAA0B;IAC9C,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,SAAS,CAAc;gBAEX,MAAM,EAAE,WAAW;IAQvC;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAuIrD;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAyB3B;;;;;;;;;;;;OAYG;YACW,aAAa;IAsI3B;;OAEG;YACW,YAAY;IA0B1B;;OAEG;IACH,OAAO,CAAC,cAAc;IAatB;;;OAGG;YACW,QAAQ;IAiBtB;;OAEG;YACW,cAAc;IAkG5B;;;OAGG;YACW,OAAO;IAqBrB;;OAEG;YACW,WAAW;IAsDzB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IA6BzB;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;IAoB/B;;OAEG;YACW,iBAAiB;IAuB/B;;OAEG;YACW,gBAAgB;CAU/B"}
+{"version":3,"file":"sso.proxy.d.ts","sourceRoot":"","sources":["../../../../../src/providers/plugins/sso/proxy/sso.proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAWH,OAAO,EAAE,WAAW,EAAgB,MAAM,kBAAkB,CAAC;AAI7D,OAAO,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,qBAAa,YAAY;IAOX,OAAO,CAAC,MAAM;IAN1B,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,UAAU,CAAkB;IACpC,OAAO,CAAC,YAAY,CAA0B;IAC9C,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,SAAS,CAAc;gBAEX,MAAM,EAAE,WAAW;IAQvC;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAuIrD;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAyB3B;;;;;;;;;;;;OAYG;YACW,aAAa;IAwI3B;;OAEG;YACW,YAAY;IA0B1B;;OAEG;IACH,OAAO,CAAC,cAAc;IAatB;;;OAGG;YACW,QAAQ;IAiBtB;;OAEG;YACW,cAAc;IAkG5B;;;OAGG;YACW,OAAO;YAqBP,wBAAwB;IAiCtC,OAAO,CAAC,sBAAsB;IAa9B;;OAEG;YACW,WAAW;IAsDzB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IA6BzB;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;IAoB/B;;OAEG;YACW,iBAAiB;IAuB/B;;OAEG;YACW,gBAAgB;CAU/B"}

package/dist/providers/plugins/sso/proxy/sso.proxy.js

@@ -24,6 +24,7 @@
 import { createServer } from 'http';
 import { randomUUID } from 'crypto';
 import { URL } from 'url';
+import { Readable } from 'stream';
 import { ProviderRegistry } from '../../../core/registry.js';
 import { AuthMethod } from '../../../core/types.js';
 import { logger } from '../../../../utils/logger.js';
@@ -267,12 +268,13 @@ export class CodeMieProxy {
                 gatewayKeyValidated: Boolean(context.metadata.gatewayKeyValidated),
             });
             logger.debug(`[proxy] Forwarding request to upstream for ${context.requestId}`);
-            const upstreamResponse = await this.httpClient.forward(targetUrl, {
+            let upstreamResponse = await this.httpClient.forward(targetUrl, {
                 method: req.method,
                 headers: context.headers,
                 body: context.requestBody || undefined
             });
             logger.debug(`[proxy] Received upstream response object for ${context.requestId}`);
+            upstreamResponse = await this.runUpstreamResponseHooks(context, upstreamResponse, targetUrl, req.method);
             // 4. Run onResponseHeaders hooks (BEFORE streaming)
             await this.runHook('onResponseHeaders', interceptor => interceptor.onResponseHeaders?.(context, upstreamResponse.headers));
             // 5. Stream response to client
@@ -460,6 +462,40 @@ export class CodeMieProxy {
             }
         }
     }
+    async runUpstreamResponseHooks(context, upstreamResponse, targetUrl, method) {
+        let response = upstreamResponse;
+        const tools = {
+            readBody: (incoming) => this.httpClient.readResponseBody(incoming),
+            retry: (requestBody) => this.httpClient.forward(targetUrl, {
+                method,
+                headers: context.headers,
+                body: requestBody,
+            }),
+            fromBuffer: (incoming, body) => this.createBufferedResponse(incoming, body),
+        };
+        for (const interceptor of this.interceptors) {
+            if (!interceptor.onUpstreamResponse) {
+                continue;
+            }
+            try {
+                response = await interceptor.onUpstreamResponse(context, response, tools);
+            }
+            catch (error) {
+                logger.error(`[CodeMieProxy] Upstream response hook error in ${interceptor.name}:`, error);
+            }
+        }
+        return response;
+    }
+    createBufferedResponse(source, body) {
+        const readable = Readable.from(body);
+        readable.statusCode = source.statusCode;
+        readable.statusMessage = source.statusMessage;
+        readable.headers = {
+            ...source.headers,
+            'content-length': String(body.length),
+        };
+        return readable;
+    }
     /**
      * Handle errors with proper status codes and structure
      */