[exec-server] serve websocket listener via HTTP upgrade (#21963)

## Why

`codex exec-server` should keep the existing public `ws://IP:PORT` URL
shape while serving that websocket connection through an HTTP upgrade
path internally. That keeps the client-facing configuration simple and
allows the listener to work through intermediate HTTP-aware
infrastructure.

## What changed

- keep the emitted and configured exec-server URL as `ws://IP:PORT`
- serve that websocket endpoint through Axum HTTP upgrade handling on
`/`
- expose `GET /readyz` from the same listener for readiness checks
- route upgraded Axum websocket streams through the shared JSON-RPC
connection machinery
- initialize the rustls crypto provider before websocket client
connections
- preserve inbound binary websocket JSON-RPC parsing for compatibility
with the prior transport behavior

## Verification

- `cargo test -p codex-exec-server --test health --test process --test
websocket --test initialize --test exec_process`

codex-rs/exec-server/tests/common/exec_server.rs

@@ -142,6 +142,11 @@ impl ExecServerHarness {
         Ok(())
     }
 
+    pub(crate) async fn send_raw_binary(&mut self, bytes: Vec<u8>) -> anyhow::Result<()> {
+        self.websocket.send(Message::Binary(bytes.into())).await?;
+        Ok(())
+    }
+
     pub(crate) async fn next_event(&mut self) -> anyhow::Result<JSONRPCMessage> {
         self.next_event_with_timeout(EVENT_TIMEOUT).await
     }

codex-rs/exec-server/tests/health.rs

@@ -0,0 +1,21 @@
+#![cfg(unix)]
+
+mod common;
+
+use common::exec_server::exec_server;
+use pretty_assertions::assert_eq;
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn exec_server_serves_readyz_alongside_websocket_endpoint() -> anyhow::Result<()> {
+    let mut server = exec_server().await?;
+    let http_base_url = server
+        .websocket_url()
+        .strip_prefix("ws://")
+        .expect("websocket URL should use ws://");
+
+    let response = reqwest::get(format!("http://{http_base_url}/readyz")).await?;
+    assert_eq!(response.status(), reqwest::StatusCode::OK);
+
+    server.shutdown().await?;
+    Ok(())
+}

codex-rs/exec-server/tests/websocket.rs

@@ -60,3 +60,39 @@ async fn exec_server_reports_malformed_websocket_json_and_keeps_running() -> any
     server.shutdown().await?;
     Ok(())
 }
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn exec_server_accepts_binary_websocket_json() -> anyhow::Result<()> {
+    let mut server = exec_server().await?;
+    let initialize_id = codex_app_server_protocol::RequestId::Integer(1);
+    let initialize = JSONRPCMessage::Request(codex_app_server_protocol::JSONRPCRequest {
+        id: initialize_id.clone(),
+        method: "initialize".to_string(),
+        params: Some(serde_json::to_value(InitializeParams {
+            client_name: "exec-server-binary-test".to_string(),
+            resume_session_id: None,
+        })?),
+        trace: None,
+    });
+    server
+        .send_raw_binary(serde_json::to_vec(&initialize)?)
+        .await?;
+
+    let response = server
+        .wait_for_event(|event| {
+            matches!(
+                event,
+                JSONRPCMessage::Response(JSONRPCResponse { id, .. }) if id == &initialize_id
+            )
+        })
+        .await?;
+    let JSONRPCMessage::Response(JSONRPCResponse { id, result }) = response else {
+        panic!("expected initialize response for binary input");
+    };
+    assert_eq!(id, initialize_id);
+    let initialize_response: InitializeResponse = serde_json::from_value(result)?;
+    Uuid::parse_str(&initialize_response.session_id)?;
+
+    server.shutdown().await?;
+    Ok(())
+}