fix(github-copilot): strip encrypted_content from reasoning replay items

openperf · openperf · commit b517c2b6994b · 2026-06-21T13:24:12.000+08:00
diff --git a/extensions/github-copilot/connection-bound-ids.test.ts b/extensions/github-copilot/connection-bound-ids.test.ts
@@ -37,7 +37,7 @@ describe("github-copilot connection-bound response IDs", () => {
     expect(input[4]?.id).toMatch(/^msg_[a-f0-9]{16}$/);
   });
 
-  it("preserves valid reasoning IDs regardless of encrypted_content", () => {
+  it("preserves valid reasoning IDs but strips encrypted_content", () => {
     const withEncrypted = Buffer.from(`reasoning-${"e".repeat(24)}`).toString("base64");
     const withNull = Buffer.from(`reasoning-${"n".repeat(24)}`).toString("base64");
     const withoutField = Buffer.from(`reasoning-${"a".repeat(24)}`).toString("base64");
@@ -47,25 +47,26 @@ describe("github-copilot connection-bound response IDs", () => {
       { id: withoutField, type: "reasoning" },
     ];
 
-    expect(rewriteCopilotConnectionBoundResponseIds(input)).toBe(false);
-    expect(input[0]?.id).toBe(withEncrypted);
-    expect(input[1]?.id).toBe(withNull);
-    expect(input[2]?.id).toBe(withoutField);
+    expect(rewriteCopilotConnectionBoundResponseIds(input)).toBe(true);
+    expect(input[0]).toEqual({ id: withEncrypted, type: "reasoning" });
+    expect(input[1]).toEqual({ id: withNull, type: "reasoning" });
+    expect(input[2]).toEqual({ id: withoutField, type: "reasoning" });
   });
 
-  it("preserves valid base64-ish reasoning IDs with and without encrypted content", () => {
+  it("strips encrypted_content from valid reasoning IDs at payload send time", () => {
     const withEncrypted = "abcDEF0123+/=";
     const withoutEncrypted = "reasoning/abc+123=";
     const input = [
       { id: withEncrypted, type: "reasoning", encrypted_content: "opaque-encrypted-payload" },
       { id: withoutEncrypted, type: "reasoning" },
     ];
 
-    expect(sanitizeCopilotReplayResponseIds(input)).toBe(false);
-    expect(input.map((item) => item.id)).toEqual([withEncrypted, withoutEncrypted]);
+    expect(sanitizeCopilotReplayResponseIds(input)).toBe(true);
+    expect(input[0]).toEqual({ id: withEncrypted, type: "reasoning" });
+    expect(input[1]).toEqual({ id: withoutEncrypted, type: "reasoning" });
   });
 
-  it("drops unsafe reasoning replay item IDs while keeping idless reasoning replay", () => {
+  it("drops unsafe reasoning IDs and strips encrypted_content from kept items", () => {
     const overlongId = `5PX6gLHXT5wE+Y2tPmUV4gn+${"B".repeat(384)}`;
     const input = [
       {
@@ -81,8 +82,8 @@ describe("github-copilot connection-bound response IDs", () => {
 
     expect(sanitizeCopilotReplayResponseIds(input)).toBe(true);
     expect(input).toEqual([
-      { type: "reasoning", encrypted_content: "missing-id", summary: [] },
-      { id: "rs_valid", type: "reasoning", encrypted_content: "valid", summary: [] },
+      { type: "reasoning", summary: [] },
+      { id: "rs_valid", type: "reasoning", summary: [] },
     ]);
   });
 
diff --git a/extensions/github-copilot/connection-bound-ids.ts b/extensions/github-copilot/connection-bound-ids.ts
@@ -45,13 +45,16 @@ export function sanitizeCopilotReplayResponseIds(input: unknown): boolean {
       continue;
     }
     const id = item.id;
-    // Reasoning items with replay IDs reference server-side encrypted state
-    // bound to that ID. Drop unsafe IDs, but keep the store-disabled idless
-    // replay form produced by core Responses conversion.
+    // Reasoning encrypted_content is tied to the Copilot connection token,
+    // which rotates per request. Drop items with unsafe IDs; strip
+    // encrypted_content from kept items so summary-only replay is sent.
     if (item.type === "reasoning") {
       if (id !== undefined && !isValidReasoningReplayId(id)) {
         input.splice(index, 1);
         rewrote = true;
+      } else if ("encrypted_content" in item) {
+        delete (item as Record<string, unknown>)["encrypted_content"];
+        rewrote = true;
       }
       continue;
     }
