chore: merge train 260821 — land #2296 (Desktop reconnect pool affinity)

[lidge-jun]

Summary

Third leg of the merge train: lands #2296 — fix(codex): bind Desktop reconnects to one pool account plus an adversarial-review hardening commit.

Review chain:

• Adversarial security review (inherited model, Huygens) on live head e672b0f: GO-WITH-FIXES (blockers=0), one MAJOR — subagent-fallback preview read the legacy quota-scope slot while final auth binds under codexQuotaScopeForModel(modelId), so the preview could never find the Desktop affinity binding and diverged from the authenticating account
• Hardening commit 698228e: preview call site derives its scope from the route model; end-to-end postSpawn test pins the affinity account end to end, plus a legacy-slot divergence assertion
• Same reviewer re-verdict on 698228e: PASS
• Security gates clean: HMAC fallback key memory-only + restart-regenerated, raw session/thread ids never leave the HMAC digest, exact selectors excluded from affinity, all outcome sites carry the same key, no lab imports

Verification

• bun test tests/codex-auth-context.test.ts tests/subagent-fallback-handle-responses.test.ts — 87/87 pass at hardened head
• bun run typecheck / privacy:scan — pass
• Full suite on lidge at 698228e: 14219 pass / 16 skip / 0 fail across 893 files, exit 0

Checklist

• Local CI green (full suite executed remotely on lidge at exact head)
• Branch includes the latest dev commit (train tracks origin/dev)
• No open Codex/CodeRabbit findings against this head
• Ready for review

Summary by CodeRabbit

• Bug Fixes

  • Improved Codex Desktop reconnect handling by consistently binding sessions to the correct account.
  • Preserved account affinity across reconnects, fallback previews, and final authentication.
  • Corrected quota tracking to use the appropriate model-specific scope.
  • Prevented stale failure events from removing newer account bindings.

• Documentation

  • Documented reconnect affinity behavior, fallback rules, and related implementation decisions.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 0e2dcbd1-2859-473b-8591-e8c7937d4b9d

📥 Commits

Reviewing files that changed from the base of the PR and between 3a3f556 and c16d5ff.

📒 Files selected for processing (9)

• devlog/_plan/260821_bug_merge_train/000_triage_matrix.md
• devlog/_plan/260821_bug_merge_train/040_merge_2296.md
• src/codex/auth-context.ts
• src/providers/openai-sidecar.ts
• src/server/responses/compact.ts
• src/server/responses/core.ts
• structure/08_openai-provider-tiers.md
• tests/codex-auth-context.test.ts
• tests/subagent-fallback-handle-responses.test.ts

---

📝 Walkthrough

Walkthrough

Codex Desktop reconnects now use bounded pool affinity keys. Authentication contexts carry the key through account selection, subagent fallback, and upstream outcome recording. Tests cover derivation, account binding, failure rebinding, and model-specific fallback quota scope.

Changes

Codex pool affinity

Layer / File(s)	Summary
Affinity derivation and account resolution src/codex/auth-context.ts, structure/08_openai-provider-tiers.md, tests/codex-auth-context.test.ts	Parent-thread identifiers take precedence. Otherwise, bounded session/thread pairs produce process-local HMAC keys. Pool contexts carry the key, and fixed-account selection remains unbound.
Affinity propagation and outcome recording src/server/responses/core.ts, src/server/responses/compact.ts, src/providers/openai-sidecar.ts	Outcome recorders derive thread identity from authCtx.affinityKey. Request-header and caller-supplied thread IDs are removed.
Subagent fallback and merge validation tests/subagent-fallback-handle-responses.test.ts, devlog/_plan/260821_bug_merge_train/*	Subagent preview uses the pool affinity key and route-model quota scope. Tests and merge-train records cover account preservation and validation results.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Desktop
  participant CodexAuthContext
  participant SubagentPreview
  participant UpstreamOutcomeRecorder
  Desktop->>CodexAuthContext: send parent-thread or session/thread headers
  CodexAuthContext->>CodexAuthContext: derive bounded affinityKey
  CodexAuthContext->>SubagentPreview: resolve account with affinityKey and model quota scope
  SubagentPreview-->>Desktop: use bound pool account for fallback
  CodexAuthContext->>UpstreamOutcomeRecorder: provide affinityKey
  UpstreamOutcomeRecorder-->>CodexAuthContext: record pool outcome

Loading

Suggested reviewers: ingwannu

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/merge-train-260821

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}