feat(oauth): pin generic pool conversations to request-local accounts

[lidge-jun]

Summary

• Refs [Feature]: complete the OAuth account-pool lifecycle — session affinity, 401/403 rotation, pool health, and stable reset-credit identity #3375. Add opt-in providers.<name>.oauthAccountFailover.sessionAffinity: "conversation" (requires proactive enabled: true; default remains "none"). Interleaved conversations keep their admitted OAuth account, bearer and account-specific routing metadata; existing bounded 429/classified-403 recovery rebinds the replacement for later turns.
• Keep automatic choices request-local in this mode. The saved active account remains the operator's selection; its revision and the serving credential generation fence queued sends, manual A→B→A, cross-process selection and concurrent refresh. Bound turns do not consume round-robin turns; fill-first retains a bounded runtime cursor. Pause, reauth, cooldown and model incompatibility release ownership. No new failure classes, dependencies, providers or GUI changes.
• Share the existing session-key precedence with Anthropic without changing its behavior. Scope hashed bindings by configuration home, provider and authenticated caller; exclude shared Desktop cache cohorts; expire after 24 idle hours with a total 2,000-entry limit. Update public and architecture docs.

Current-dev audit at 7640a942b35044c974e534b84d5a8049f4a8ae9a: strategy/threshold consumption already landed in #4289 (6d211927e3) and zero-threshold behavior in #5091 (5d0122ab4a); account usage attribution also already exists. This PR implements the remaining generic conversation-affinity slice, not the whole umbrella. Durable aggregate generic-pool health, durable one-shot scheduled warmup and provider/path-specific 403 gaps remain. Auto-pause #7101 is excluded. #5099 is background only; no commits are carried or replaced.

Security review: this changes OAuth account routing and requires explicit maintainer security review under MAINTAINERS.md before integration. Independent static review found and resolved Kiro lease, terminal-refresh, all-cooled and in-flight settings-boundary issues; that is not maintainer security approval.

Verification

All runtime checks used temporary OPENCODEX_HOME / CODEX_HOME; no real accounts or configuration were used. Initial regressions reproduced conversation drift and lost recovery binding; the added Kiro terminal-refresh regression also failed before its fix.

The repository-pinned Bun 1.4.3 executable was downloaded into ignored scratch .tmp/3375/toolchain/bun-darwin-aarch64/bun; no dependency or global toolchain changed. Exact final commands/results:

bun install
# PASS: 104 packages installed; no tracked lockfile change

.tmp/3375/toolchain/bun-darwin-aarch64/bun test tests/oauth/generic-session-affinity.test.ts tests/server/server-generic-oauth-affinity.test.ts tests/oauth/generic-oauth-failover.test.ts tests/oauth/generic-oauth-refusal-composition.test.ts tests/oauth/pool-kernel-generic-sweep.test.ts tests/oauth/oauth-account-quota-rank.test.ts tests/server/server-google-antigravity-oauth-401-replay.test.ts tests/server/server-google-antigravity-oauth-429-budget.test.ts tests/adapters/anthropic/anthropic-account-pool.test.ts tests/server/server-kiro-refusal-e2e.test.ts tests/lab/core-lab-boundary.test.ts
# PASS: 304 pass, 0 fail; 1,322 assertions across 11 files

.tmp/3375/toolchain/bun-darwin-aarch64/bun test tests/test-layout.test.ts tests/test-layout-tooling.test.ts tests/ci-workflows/file-size-ratchet.test.ts
# PASS: 36 pass, 0 fail; 653 assertions across 3 files

bun run typecheck
bun run structure:check
bun run privacy:scan
git diff --check
# PASS for each

(cd docs-site && bun install --frozen-lockfile)
(cd docs-site && bun run build)
# PASS: 577 pages; 81,200 internal links checked

A first layout-tooling run under the host's Bun 1.4.0 failed because this repository requires test-runner Bun 1.4.3. Running the actual pinned version fixed that environment prerequisite; no assertion, skip or runner policy was changed.

The maintainer expressly prohibited heavy/full local suites on this shared host, so bun run test, bun run prepush, and whole-directory suites were NOT RUN. Broad integration and platform validation are left to exact-head PR CI (fast Ubuntu subset), then manual ci.yml dispatch with lane=all after PR checks succeed. CI results are pending; local checks are not hosted-CI evidence.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Focused behavior and negative regressions, typecheck, architecture/privacy gates and test-layout/file-size guards pass; full local suite exclusion is documented above.
• Public and architecture docs are updated; no GUI screenshot is required.
• Explicit maintainer security review for OAuth account-routing changes is complete.
• Exact-head PR CI and the full cross-platform dispatch are successful.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[lidge-jun]

Maintainer integration into dev (MAINTAINERS.md dev maintainer-integration policy; batch integration authorized by @lidge-jun on 2026-10-15).

• Head: 0117030b38bdd84f655775b2f4ae6c5ad5d13495 (tree 7dc9158b0d18587b9201adc9417a29c2168c42ee) = this branch merged with origin/dev a738a5ee73. Integration note: auto-resolved union conflicts: docs-site/src/content/docs/reference/configuration/providers.md structure/INDEX.md.
• Exact-head evidence: GitHub-hosted Actions for this account have not been assigning runners since 2026-10-15 13:30 UTC, so by owner decision the evidence is a full bun run test (Bun 1.4.3 test runner, root and GUI dependencies installed, GUI built) of this exact tree on a maintainer host (macOS arm64): exit 1, 9 min, 2 failing test(s), each also failing in the same host's baseline run of dev 60bf4c7 (environment-only): connected Desktop uses hub IDs across a cold restart (stored profile=false), update stops the running proxy before replacing files > npm launcher restarts the stopped .
• Local gates on the same tree: bun run typecheck, file-size ratchet, test-layout and structure:check.
• Security review: independent agent security review PASS at 6a8556c (opt-in affinity, principal isolation, credential/metadata pairing).
• Hosted CI checks for this head may still be queued; they are not claimed as evidence.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-15T20:13:06.224706Z	0117030	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.