isolate codex continuation state per Claude agent

Claude Code SubAgents share a session ID while carrying distinct Agent IDs.
Session-only continuation ownership allowed sibling Agents to consume or
replace one another’s continuation and reusable WebSocket state.

Carry validated conversation identity through HTTP ingress and key Codex
continuation and socket ownership by Main or direct Agent identity. Require
the exact live origin socket for response continuation, with one safe
full-context recovery when provenance cannot be established. Preserve
cancellation and retry cleanup, and keep malformed and auto-review requests
stateless.

Previous-response continuation remains disabled by default.

Author: ItsAlbertZhang

docs/src/content/docs/providers/codex.md

@@ -54,7 +54,11 @@ WebSocket is the default transport. Set `CCP_CODEX_TRANSPORT=http` for HTTP SSE,
 
 WebSocket setup honors `HTTP_PROXY` for `ws://`, `HTTPS_PROXY` for the default `wss://` endpoint, `ALL_PROXY` as a fallback, and `NO_PROXY` exclusions. A normal HTTP proxy can therefore carry the default WebSocket connection with CONNECT; TUN mode is not required. Set proxy variables before starting the process and restart after changing them. For example, setting `HTTPS_PROXY` to `http://127.0.0.1:7890` sends HTTPS/WSS destinations through the HTTP proxy at port 7890; it does not require an `https://` proxy URL.
 
-`CCP_CODEX_PREVIOUS_RESPONSE_ID=1` enables append-only WebSocket continuation. It reuses a session connection and sends `previous_response_id` only when the translated request shape and transcript extension are safe. State is in memory, keyed by Claude Code session ID.
+`CCP_CODEX_PREVIOUS_RESPONSE_ID=1` enables append-only WebSocket continuation. A valid identity containing only a Claude Code session ID owns the Main continuation for that session. Each valid direct Agent ID owns an independent continuation and reusable WebSocket within the same session. Nested Agents are keyed by their direct child ID; the parent ID is validated but does not become part of the owner key. The proxy sends `previous_response_id` only when the translated request shape and transcript extension are safe, and only on the exact live WebSocket that produced that response.
+
+An absent, malformed, or ambiguous identity does not reject the HTTP request; that request proceeds without continuation or WebSocket reuse. If the originating socket is missing, dead, or has been replaced, the proxy retries once with the full translated input and without the stale response ID. Continuation and connection state is held only in memory and is lost when the proxy restarts.
+
+Detected auto-review classifier subrequests are intentionally stateless even when valid session and Agent headers are present. They neither consume nor publish continuation or WebSocket ownership.
 
 ## Server compaction
 

src/lib.rs

@@ -9,6 +9,7 @@ pub mod project;
 pub mod provider;
 pub mod providers;
 pub mod registry;
+pub mod request_identity;
 pub mod retry;
 pub mod server;
 pub mod session;

src/provider.rs

@@ -1,5 +1,6 @@
 use crate::anthropic::schema::MessagesRequest;
 use crate::monitor::MonitorHandle;
+use crate::request_identity::ConversationIdentity;
 use crate::traffic::TrafficCapture;
 use anyhow::Result;
 use async_trait::async_trait;
@@ -26,6 +27,17 @@ pub trait Provider: Send + Sync {
     fn supported_models(&self) -> Vec<String>;
     fn cli(&self) -> &'static dyn CliHandlers;
     async fn handle_messages(&self, body: MessagesRequest, ctx: RequestContext) -> Response;
+
+    async fn handle_messages_with_conversation_identity(
+        &self,
+        body: MessagesRequest,
+        ctx: RequestContext,
+        conversation_identity: Option<ConversationIdentity>,
+    ) -> Response {
+        let _ = conversation_identity;
+        self.handle_messages(body, ctx).await
+    }
+
     async fn handle_count_tokens(&self, body: MessagesRequest, ctx: RequestContext) -> Response;
 
     async fn generate_anthropic_stream(

src/providers/codex/client.rs

@@ -83,7 +83,7 @@ pub async fn request_compaction(
     compaction_request.include = Some(vec!["reasoning.encrypted_content".to_string()]);
 
     let response = client
-        .post_codex(&compaction_request, ctx, None)
+        .post_codex_for_owner(&compaction_request, ctx, None)
         .await
         .map_err(CompactionError::Upstream)?;
     let compaction = parse_compaction_response(&response.body)?;