feat(openai): send incremental Responses WebSocket input

[danielkov]

Summary

Send previous_response_id with only new input on compatible Responses WebSocket turns instead of resending the full transcript. Add an optional environment-credential live continuation suite and bump agentkit-provider-openai from 0.10.10 to 0.10.11.

Impact

Existing WebSocket sessions automatically use incremental requests for compatible tool-result and subsequent-user turns. The application still supplies its complete transcript; edited history, changed settings, and fresh connections use full input without a predecessor ID.

Technical details

Connection-local continuation

Retain a bounded, memory-only checkpoint of the completed response, encoded request, and raw and canonical replay output. Prefix checks use the existing credential-bound encoder, including tool arguments, encrypted reasoning, and generated images. Streamed response.output_item.done items remain authoritative when terminal completion contains an empty output array. Protected checkpoint buffers are zeroized on drop.

Recovery and cancellation

Invalidate checkpoints on cancellation, failures, reconnects, and authentication changes. A narrowly correlated missing-predecessor rejection can reconnect once with full input within the existing retry budget. Accepted responses, visible output, ambiguous failures, and uncorrelated errors cannot authorize replay.

Optional live suite

The ignored public-API integration suite accepts credentials only through environment variables and uses a loopback forwarding proxy to assert actual outbound predecessor IDs and exact input suffixes while requiring real server completion. It covers a tool round, a later user turn, and optional full replay on a fresh session. Strict mode rejects missing credentials, request counts are bounded, and credentials and payloads are not logged.