test(server-auth): stop three tests from racing the runner instead of the clock

Three separate causes behind the windows-latest failures in this file,
each of which reads as the same flake from the summary line.

Two tests still built a fresh startPoolRetryHarness per case inside a
loop — five and six of them. Each one wipes and recreates TEST_DIR,
binds a server, and redirects global fetch, which does not fit Bun's 5s
default on a Windows runner. Worse, the request still in flight when the
budget expired raced the next test through that same global fetch, which
is how an unrelated test failed at 412ms in an earlier run. Both now use
one harness with a body cursor, the shape already applied to their
sibling, and each case still proves its own original 400 and exactly one
acct-pool-a dispatch.

WS-REBIND-01 was not a budget overrun at all. It failed at 748ms because
it carries its own 1s deadline for a two-hop WebSocket retry that stops
and restarts a real server. An internal deadline dying faster than the
test budget is exactly what made this look random. That 1s becomes 15s
and the test gets an explicit 30s budget.

The harness also never reset the WebSocket registry, which is
process-global and survives teardown, while WS-REBIND-01 asserts exact
per-account socket counts. Five kinds of state were cleared and this one
was not. Reset it with the rest — defensive here rather than a
reproduced failure, and labelled as such.

Ablated: no-oping updateCodexWebSocketAuthContext fails WS-REBIND-01, so
the added headroom did not hollow out the migration proof.

Author: lidge-jun

tests/server-auth.test.ts

@@ -5,7 +5,7 @@ import { request as httpRequest } from "node:http";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { saveCodexAccountCredential } from "../src/codex/account-store";
-import { getTrackedCodexWebSocketCountForAccount } from "../src/codex/websocket-registry";
+import { clearCodexWebSocketRegistry, getTrackedCodexWebSocketCountForAccount } from "../src/codex/websocket-registry";
 import { clearAccountNeedsReauth, clearAccountQuota, getAccountQuota, isAccountNeedsReauth, markAccountNeedsReauth, updateAccountQuota } from "../src/codex/auth-api";
 import {
   CODEX_THREAD_AFFINITY_IDLE_TTL_MS,
@@ -162,6 +162,12 @@ async function startPoolRetryHarness(
   clearAccountQuota();
   clearAccountNeedsReauth("pool-a");
   clearAccountNeedsReauth("pool-b");
+  // The registry is process-global and survives a harness teardown. WS-REBIND-01
+  // asserts exact per-account socket counts, so a socket leaked by any earlier test
+  // in this file shifts its snapshots and fails it in milliseconds — which reads as
+  // a flake next to the timeouts, but is ordinary shared state. Reset it with the
+  // rest rather than leaving one of six kinds of state uncleaned.
+  clearCodexWebSocketRegistry();
 
   const dispatches: string[] = [];
   const upstream = Bun.serve({
@@ -1984,15 +1990,18 @@ describe("server local API auth", () => {
       `${exact} suffix`,
       exact.replace("ChatGPT account.", "ChatGPT account"),
     ];
-    for (const detail of cases) {
-      const body = JSON.stringify({ detail });
-      const harness = await startPoolRetryHarness(() => rejectionResponse(body));
-      try {
-        await expectOriginal400(await harness.request(), body);
-        expect(harness.dispatches).toEqual(["acct-pool-a"]);
-      } finally {
-        await stopPoolRetryHarness(harness);
+    const negativeBodies = cases.map(detail => JSON.stringify({ detail }));
+    let nextNegative = 0;
+    const negative = await startPoolRetryHarness(() => rejectionResponse(negativeBodies[nextNegative++]!));
+    try {
+      for (const body of negativeBodies) {
+        const priorDispatches = negative.dispatches.length;
+        await expectOriginal400(await negative.request(), body);
+        expect(negative.dispatches.slice(priorDispatches)).toEqual(["acct-pool-a"]);
       }
+      expect(nextNegative).toBe(negativeBodies.length);
+    } finally {
+      await stopPoolRetryHarness(negative);
     }
     const positive = await startPoolRetryHarness(accountId => accountId === "acct-pool-a"
       ? rejectionResponse(JSON.stringify({ detail: `  THE   '${POOL_RETRY_MODEL}' MODEL IS NOT SUPPORTED\nWHEN USING CODEX WITH A CHATGPT ACCOUNT.  ` }))
@@ -2006,14 +2015,23 @@ describe("server local API auth", () => {
   }, 12_000);
 
   test("valid JSON wrong top-level shape never authorizes a pool retry", async () => {
-    for (const body of ['"string"', "42", "true", "null", '["detail"]']) {
-      const harness = await startPoolRetryHarness(() => rejectionResponse(body));
-      try {
+    // One harness, five bodies — same reason as the sibling above. Each
+    // startPoolRetryHarness() wipes and recreates TEST_DIR, binds a server, and
+    // redirects global fetch; five of those did not fit Bun's 5s default on a
+    // Windows runner, and the request still in flight when the budget expired
+    // raced the next test through that same global fetch.
+    const bodies = ['"string"', "42", "true", "null", '["detail"]'];
+    let nextBody = 0;
+    const harness = await startPoolRetryHarness(() => rejectionResponse(bodies[nextBody++]!));
+    try {
+      for (const body of bodies) {
+        const priorDispatches = harness.dispatches.length;
         await expectOriginal400(await harness.request(), body);
-        expect(harness.dispatches).toEqual(["acct-pool-a"]);
-      } finally {
-        await stopPoolRetryHarness(harness);
+        expect(harness.dispatches.slice(priorDispatches)).toEqual(["acct-pool-a"]);
       }
+      expect(nextBody).toBe(bodies.length);
+    } finally {
+      await stopPoolRetryHarness(harness);
     }
   });
 
@@ -2085,7 +2103,13 @@ describe("server local API auth", () => {
           if (String(event.data).includes("response.completed")) resolve();
         });
         ws.addEventListener("error", () => reject(new Error("websocket retry failed")), { once: true });
-        setTimeout(() => reject(new Error("websocket retry timed out")), 1_000);
+        // This 1s was the real cause of WS-REBIND-01 failing at 748ms on windows-latest:
+        // an internal deadline, not Bun's test budget, which is why it died far too fast
+        // to look like a timeout. The test stops and restarts a real server, opens a real
+        // WebSocket, and waits for a two-hop retry across accounts — a second of that on a
+        // contended runner is optimistic. The assertions below are unchanged; only the
+        // room to reach them grew.
+        setTimeout(() => reject(new Error("websocket retry timed out")), 15_000);
       });
       expect(harness.dispatches).toEqual(["acct-pool-a", "acct-pool-b"]);
       expect(registrySnapshots).toEqual([[1, 0], [0, 1]]);
@@ -2095,7 +2119,7 @@ describe("server local API auth", () => {
       ws.close();
       await stopPoolRetryHarness(harness);
     }
-  });
+  }, { timeout: 30_000 });
 
   test("passthrough connect failure records selected pool account health", async () => {
     if (existsSync(TEST_DIR)) rmSync(TEST_DIR, { recursive: true });