mirror of
https://github.com/openai/codex.git
synced 2026-11-13 06:45:07 +00:00
## Why Guardian sampling WebSockets authenticate when the connection is opened. Reusing a pooled connection after credentials change can therefore keep using the old authorization. ## What changed - Track authentication changes on each pooled sampling connection. - Discard stale connections after an auth change and reject connections whose authentication changes while the handshake is in progress. ## Testing - Verify the sampler reconnects with the refreshed bearer token instead of reusing its existing connection. - Verify the installed Guardian extension reconnects after an external auth refresh. GitOrigin-RevId: 6d2e7df776fd21c78be0928f71162f5419a8b8f0