fix(proxy): isolate wreq TLS sessions by account

.env.example

@@ -644,6 +644,9 @@ NEXT_PUBLIC_ENABLE_SOCKS5_PROXY=true
 # Reduces risk of JA3/JA4 fingerprint-based blocking by providers (e.g., Google).
 # Used by: open-sse/executors — replaces Node.js default TLS fingerprint.
 # ENABLE_TLS_FINGERPRINT=true
+# New proxied TLS routing requires an explicit, comma-separated provider allowlist.
+# Direct TLS keeps its legacy behavior when this is unset.
+# TLS_FINGERPRINT_PROVIDERS=codex,openai
 
 # Allow the Claude Turnstile Playwright browser context to ignore HTTPS certificate errors.
 # Only enable for local debugging or trusted MITM/corporate proxy environments.

open-sse/services/browserBackedChat.ts

@@ -517,6 +517,7 @@ export async function httpBackedChat(
       headers,
       body,
       signal: signal ?? undefined,
+      sessionScope: req.poolKey,
     });
 
     const fetchMs = Date.now() - fetchStart;