feat: ✨ Session budget with HITL pause mode

authbridge/authlib/go.mod

@@ -13,6 +13,7 @@ require (
 	github.com/rossoctl/context-guru v0.0.0-20260720181432-8fc7c7b36563
 	github.com/spiffe/go-spiffe/v2 v2.8.1
 	golang.org/x/net v0.57.0
+	golang.org/x/sync v0.22.0
 	golang.org/x/sys v0.47.0
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa
 	google.golang.org/grpc v1.82.0
@@ -117,7 +118,6 @@ require (
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/arch v0.23.0 // indirect
 	golang.org/x/crypto v0.54.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
 	golang.org/x/text v0.40.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect

authbridge/authlib/listener/forwardproxy/server.go

@@ -609,7 +609,7 @@ func (s *Server) handleStreamingResponse(w http.ResponseWriter, r *http.Request,
 	defer func() {
 		// Use a detached context for finalization: the client may have
 		// cancelled the request context after reading the full stream,
-		// but aggregating plugins (inference-parser, token-budget) still
+		// but aggregating plugins (inference-parser, session-budget) still
 		// need their last=true dispatch to finalize state.
 		finalCtx := context.WithoutCancel(r.Context())
 		finalAction := s.OutboundPipeline.RunResponseFrame(finalCtx, pctx, nil, true)