v0.3.3 — sessions survive an upstream switch

A live Codex session now survives failover — account → account, pool → fallback provider, and back once a quota resets — instead of dying on Encrypted content could not be decrypted or parsed. (#6, #7).

Replay recovery

Codex resends reasoning (and compaction) items whose encrypted_content only the upstream that minted them can decrypt. When an upstream rejects such a replay with 400 invalid_encrypted_content (or thinking_signature_invalid), the proxy retries the request once, on the same account or provider, without the input items carrying encrypted_content. Messages, tool calls and tool outputs are kept. Requests are never modified up front, and a rejected replay is not an account failure: no cooldown, no failover.

What it costs

• Until the session is restarted, every turn after a switch pays one rejected round-trip (no tokens billed) and logs a could not decrypt replayed state warning — Codex keeps the foreign items in its own history. Expected, not a new failure.
• Hidden reasoning from earlier turns is gone for the new upstream (it couldn't read it anyway); a dropped compaction item takes the history it summarized with it.
• Pool → fallback was reproduced with OpenAI's exact error body. Account → account assumes the ChatGPT backend returns the same body; if a session still dies on rotation, please open an issue with the 400 body the proxy relayed.