[axelray-dev]

Problem

GitHubCopilotProvider._get_copilot_access_token() has a check-then-act race condition with no synchronization. When the Copilot access token expires (~30 min), concurrent chat() / chat_stream() calls both see the expired token and independently fetch new tokens from GitHub's token endpoint. The last writer wins, and the loser's in-flight request may use a stale or mismatched token.

Closes #4677.

Root cause

The provider is constructed once and shared across all agent turns. The check-and-refresh critical section in _get_copilot_access_token() reads self._copilot_access_token / self._copilot_expires_at, then fetches and writes them back without a lock. When two concurrent requests arrive after token expiry, both pass the freshness check, both issue HTTP calls to the token endpoint, and both overwrite self._copilot_access_token, self.api_key, and client.api_key.

Fix

Add an asyncio.Lock to GitHubCopilotProvider and use double-checked locking in _get_copilot_access_token():

1. Fast path: check token freshness without acquiring the lock (existing behavior preserved).
2. If expired, acquire the lock, then re-check freshness. Another task may have already refreshed the token while we were waiting.
3. Only if still expired, proceed with the HTTP fetch inside the lock.

This ensures only one token fetch happens per expiry window, even under concurrent load.

Tests

• test_concurrent_token_refresh_fetches_once: two concurrent calls with an expired token trigger exactly one HTTP fetch
• test_second_call_returns_cached_token_while_first_in_flight: if task A is mid-fetch, task B waits for the lock, finds the cached token, and skips the HTTP call
• test_copilot_token_lock_exists: provider has an asyncio.Lock instance

[Re-bin]

LGTM. This is a focused provider-local concurrency fix: Copilot token refresh now uses a lock with a second cache check after acquisition, so concurrent requests do not race into duplicate token exchanges.

Validated locally:

• python -m pytest tests/providers/test_github_copilot_concurrent_token.py -q
• python -m ruff check nanobot/providers/github_copilot_provider.py tests/providers/test_github_copilot_concurrent_token.py

GitHub Actions is green across the matrix.