fix: enable Copilot HTTP transport fallback - #28494
Conversation
ssncferreira
changed the title
75ee752 to
13f882f
Compare
13f882f to
473dbb0
Compare
ssncferreira
changed the title
| case agplaibridge.HostCopilotEnterprise: | ||
| return agplaibridge.ProviderCopilotEnterprise | ||
| return testProvider{name: agplaibridge.ProviderCopilotEnterprise, providerType: aibridge.ProviderCopilot} | ||
| case agplaibridge.HostChatGPT: |
There was a problem hiding this comment.
nit: Host consts are scattered between aibridgeproxyd and agplaibridge packages.
There was a problem hiding this comment.
This is already pre-existing to this PR. We should consolidate them into a single package, but not in the context of this PR.
|
|
||
| // setCopilotAuth sets the Coder auth header and removes the Coder token from | ||
| // provider auth headers. | ||
| func setCopilotAuth(headers http.Header, coderToken string) { |
There was a problem hiding this comment.
nit: I think setCopilotAuth should be inlined in injectBYOKHeaderIfNeeded since it is a subset of setting up BYOK. Also would look better in Server.handleRequest
There was a problem hiding this comment.
What is a difference between unknown route and known route? It seems test doesn't care about route at all since it doesn't run Gateway that mounts passthough / bridged routes only.
Number of cases could be reduced to only what headers are forwarded.
There was a problem hiding this comment.
This was just to test that unknonw routes (routes that are not in copilot's bridge or passthrough routes) are sent to AI Gateway with the coder token. But this is more of an AI Gateway concern, not the Proxy. I can remove this test 👍
There was a problem hiding this comment.
I don't mean remove whole test, just limit test cases to unique scenarios. Right now most test cases seem to cover the same scenario. From what I understand test should check if headers are preserved or not, id doesn't care about paths.
There was a problem hiding this comment.
I meant removing the unknonw route test case. I'm adjusting the test cases to not consider the path, since that is a AI Gateway concern, not proxy
2 participants
Description
Copilot provider model metadata returned by
/modelscan advertise WebSocket support (for example,ws:/responses), so clients attempt WebSocket inference even though AI Gateway supports HTTP transport only. The Copilot CLI and Copilot in VS Code use different retry mechanisms, and only the CLI fallback worked previously. See the investigation details below for more information.Authenticate every configured Copilot provider request with the Coder token validated during CONNECT while preserving Copilot provider credentials and preventing Coder credentials from being forwarded upstream. Reject unsupported WebSocket upgrades on bridged inference routes with
501 Not Implementedso clients can fall back to HTTP.Changes
/_pingconnectivity checks and/automodel-selection requests.501 Not Implementedfor WebSocket upgrades on bridged inference routes.Investigation details
These logs show the behavior before this change using
GPT-5.3-Codex, whose model metadata advertisesws:/responses.Copilot CLI
GET /responsesbody as an inference request and returns 500.POST /responses, which succeeds.Copilot in VS Code
GET /responsesbody as an inference request and returns 500.GET /_pingbefore retrying inference over HTTP. AI Gateway rejects the check because the proxy did not forward the Coder token from the authenticated CONNECT session.Closes https://linear.app/codercom/issue/AIGOV-629/ai-gateway-lacks-support-for-new-copilot-endpoints-behind-mitm
Note
Generated by Coder Agents on behalf of @ssncferreira.