fix(codex): preserve websocket continuity across executor refresh

[yinkev]

Summary

• preserve Codex WebSocket sessions across compatible executor refreshes
• reconnect when the effective proxy, headers, identity mode, account, or selected credential changes
• ignore unrelated configured API keys when evaluating an OAuth session
• keep explicit session close, auth removal, and true close-all cleanup unchanged

Root cause

Starting with v7.2.96, replacing a Codex executor closed every session in the shared WebSocket store. A follow-up request carrying previous_response_id then opened a different upstream socket, where the response ID did not exist.

turn 1 uses socket A
executor refresh closes A
turn 2 opens socket B with previous_response_id from A
previous_response_not_found

The old and replacement CodexAutoExecutor instances intentionally share the global session store. This patch hands sessions across replacement only when their connection identity is compatible.

Connection compatibility

The per-session connection key includes:

• global and per-auth proxy route
• Codex User-Agent and beta headers
• effective identity-confuse mode
• account ID
• custom auth headers
• selected API-key revision, when the session uses an API key
• auth ID and upstream WebSocket URL

Provider-level handoff compares only settings that affect every Codex socket. Rotating an unrelated configured API key no longer closes OAuth sessions. Rotating the API key actually used by a session still changes its per-session connection key and reconnects.

Ordinary OAuth access-token rotation preserves an established socket.

Validation

• real WebSocket regression tests with a physical close counter
• compatible replacement: zero closes and shared session retained
• proxy/header/identity or selected API-key change: old socket closes
• unrelated configured API-key change: OAuth socket remains reusable
• explicit session close and true close-all: one physical close
• go test ./internal/runtime/executor ./sdk/cliproxy/auth -count=1
• focused race tests
• go vet ./internal/runtime/executor ./sdk/cliproxy/auth
• go build -o /tmp/pr4569-server ./cmd/server
• git diff --check upstream/dev...HEAD

Fixes #4524

[yinkev]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 87336d0b96

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[yinkev]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 95ef3909f3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[yinkev]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: b554eb92ed

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".