fix: drop underscored id headers (#22193)

## Why
Stop sending duplicate `session_id`/`thread_id` headers. We only want
the hyphenated forms as `_` is rejected by some proxies

Related discussion here:
https://openai.slack.com/archives/C095U48JNL9/p1778508316923179

## What
- Keep `session-id` and `thread-id`
- Remove the underscore aliases

codex-rs/codex-api/src/requests/headers.rs

@@ -5,11 +5,9 @@ use http::HeaderValue;
 pub fn build_session_headers(session_id: Option<String>, thread_id: Option<String>) -> HeaderMap {
     let mut headers = HeaderMap::new();
     if let Some(id) = session_id {
-        insert_header(&mut headers, "session_id", &id);
         insert_header(&mut headers, "session-id", &id);
     }
     if let Some(id) = thread_id {
-        insert_header(&mut headers, "thread_id", &id);
         insert_header(&mut headers, "thread-id", &id);
     }
     headers

codex-rs/codex-api/tests/clients.rs

@@ -458,18 +458,10 @@ async fn azure_default_store_attaches_ids_and_headers() -> Result<()> {
     assert_eq!(requests.len(), 1);
     let req = &requests[0];
 
-    assert_eq!(
-        req.headers.get("session_id").and_then(|v| v.to_str().ok()),
-        Some("sess_123")
-    );
     assert_eq!(
         req.headers.get("session-id").and_then(|v| v.to_str().ok()),
         Some("sess_123")
     );
-    assert_eq!(
-        req.headers.get("thread_id").and_then(|v| v.to_str().ok()),
-        Some("thread_123")
-    );
     assert_eq!(
         req.headers.get("thread-id").and_then(|v| v.to_str().ok()),
         Some("thread_123")

codex-rs/core/tests/suite/client.rs

@@ -764,10 +764,8 @@ async fn includes_session_id_thread_id_and_model_headers_in_request() {
 
     let request = resp_mock.single_request();
     assert_eq!(request.path(), "/v1/responses");
-    let request_session_id = request.header("session_id").expect("session_id header");
-    let request_session_id_hyphenated = request.header("session-id").expect("session-id header");
-    let request_thread_id = request.header("thread_id").expect("thread_id header");
-    let request_thread_id_hyphenated = request.header("thread-id").expect("thread-id header");
+    let request_session_id = request.header("session-id").expect("session-id header");
+    let request_thread_id = request.header("thread-id").expect("thread-id header");
     let request_authorization = request
         .header("authorization")
         .expect("authorization header");
@@ -779,12 +777,7 @@ async fn includes_session_id_thread_id_and_model_headers_in_request() {
     let thread_id_string = expected_thread_id.to_string();
 
     assert_eq!(request_session_id, expected_session_id.to_string());
-    assert_eq!(
-        request_session_id_hyphenated,
-        expected_session_id.to_string()
-    );
     assert_eq!(request_thread_id, thread_id_string.as_str());
-    assert_eq!(request_thread_id_hyphenated, thread_id_string.as_str());
     assert_eq!(request_originator, originator().value);
     assert_eq!(request_authorization, "Bearer Test API Key");
     assert_eq!(
@@ -1046,20 +1039,13 @@ async fn chatgpt_auth_sends_correct_request() {
         .expect("chatgpt-account-id header");
     let request_body = request.body_json();
 
-    let request_session_id = request.header("session_id").expect("session_id header");
-    let request_session_id_hyphenated = request.header("session-id").expect("session-id header");
-    let request_thread_id = request.header("thread_id").expect("thread_id header");
-    let request_thread_id_hyphenated = request.header("thread-id").expect("thread-id header");
+    let request_session_id = request.header("session-id").expect("session-id header");
+    let request_thread_id = request.header("thread-id").expect("thread-id header");
     let installation_id =
         std::fs::read_to_string(test.codex_home_path().join(INSTALLATION_ID_FILENAME))
             .expect("read installation id");
     assert_eq!(request_session_id, expected_session_id.to_string());
-    assert_eq!(
-        request_session_id_hyphenated,
-        expected_session_id.to_string()
-    );
     assert_eq!(request_thread_id, expected_thread_id.to_string());
-    assert_eq!(request_thread_id_hyphenated, expected_thread_id.to_string());
 
     assert_eq!(request_originator, originator().value);
     assert_eq!(request_authorization, "Bearer Access Token");

codex-rs/core/tests/suite/client_websockets.rs

@@ -132,11 +132,11 @@ async fn responses_websocket_streams_request() {
         Some(harness.thread_id.to_string())
     );
     assert_eq!(
-        handshake.header("session_id"),
+        handshake.header("session-id"),
         Some(harness.session_id.to_string())
     );
     assert_eq!(
-        handshake.header("thread_id"),
+        handshake.header("thread-id"),
         Some(harness.thread_id.to_string())
     );
     assert_eq!(

codex-rs/core/tests/suite/compact_remote.rs

@@ -357,11 +357,11 @@ async fn remote_compact_replaces_history_for_followups() -> Result<()> {
         Some("Bearer Access Token")
     );
     assert_eq!(
-        compact_request.header("session_id").as_deref(),
+        compact_request.header("session-id").as_deref(),
         Some(session_id.as_str())
     );
     assert_eq!(
-        compact_request.header("thread_id").as_deref(),
+        compact_request.header("thread-id").as_deref(),
         Some(thread_id.as_str())
     );
     let compact_body = compact_request.body_json();
@@ -1046,12 +1046,12 @@ async fn remote_compact_runs_automatically() -> Result<()> {
     assert_eq!(
         compact_mock
             .single_request()
-            .header("session_id")
+            .header("session-id")
             .as_deref(),
         Some(session_id.as_str())
     );
     assert_eq!(
-        compact_mock.single_request().header("thread_id").as_deref(),
+        compact_mock.single_request().header("thread-id").as_deref(),
         Some(thread_id.as_str())
     );
     let follow_up_request = responses_mock.single_request();