fix(auth): stop old selectors when replacing manager selector and harden cache stop concurrency

- Add `isSameSelector` using type-aware comparable checks to avoid unnecessary selector replacement.
- Update `Manager.SetSelector` to:
  - serialize swaps with a dedicated selector mutex,
  - no-op when replacing with the same selector instance/type,
  - stop the previous selector when it implements `StoppableSelector`.
- Protect `SessionCache.Stop()` with `sync.Once` and nil-check to make repeated/concurrent stops safe and idempotent.

Closes: router-for-me#5018

Author: luispater

sdk/cliproxy/auth/conductor.go

@@ -113,6 +113,7 @@ type Manager struct {
 	selector                  Selector
 	hook                      Hook
 	mu                        sync.RWMutex
+	selectorMu                sync.Mutex
 	configCooldownMu          sync.Mutex
 	auths                     map[string]*Auth
 	scheduler                 *authScheduler

sdk/cliproxy/auth/conductor_selection.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"math/rand/v2"
 	"net/http"
+	"reflect"
 	"sort"
 	"strings"
 	"time"
@@ -234,16 +235,44 @@ func (m *Manager) ReconcileRegistryModelStates(ctx context.Context, authID strin
 	}
 }
 
+func isSameSelector(a, b Selector) bool {
+	if a == nil || b == nil {
+		return a == nil && b == nil
+	}
+	ta, tb := reflect.TypeOf(a), reflect.TypeOf(b)
+	if ta != tb {
+		return false
+	}
+	if ta.Comparable() {
+		return a == b
+	}
+	return false
+}
+
 func (m *Manager) SetSelector(selector Selector) {
 	if m == nil {
 		return
 	}
 	if selector == nil {
 		selector = &RoundRobinSelector{}
 	}
+	m.selectorMu.Lock()
+	defer m.selectorMu.Unlock()
+
 	m.mu.Lock()
+	oldSelector := m.selector
+	if isSameSelector(oldSelector, selector) {
+		m.mu.Unlock()
+		return
+	}
 	m.selector = selector
 	m.mu.Unlock()
+
+	if oldSelector != nil {
+		if stoppable, ok := oldSelector.(StoppableSelector); ok {
+			stoppable.Stop()
+		}
+	}
 	if m.scheduler != nil {
 		m.scheduler.setSelector(selector)
 		m.syncScheduler()

sdk/cliproxy/auth/selector_test.go

@@ -2200,3 +2200,130 @@ func TestSessionAffinitySelectorUsesRequestPayloadWhenOriginalRequestMissing(t *
 		t.Fatalf("request-only conversation changed auth from %q to %q", first.ID, second.ID)
 	}
 }
+
+func TestSessionCache_StopConcurrent(t *testing.T) {
+	t.Parallel()
+	for iter := 0; iter < 100; iter++ {
+		cache := NewSessionCache(time.Minute)
+		var wg sync.WaitGroup
+		for i := 0; i < 20; i++ {
+			wg.Add(1)
+			go func() {
+				defer wg.Done()
+				cache.Stop()
+			}()
+		}
+		wg.Wait()
+	}
+}
+
+type mockStoppableSelector struct {
+	stopped bool
+}
+
+func (m *mockStoppableSelector) Pick(ctx context.Context, provider, model string, opts cliproxyexecutor.Options, auths []*Auth) (*Auth, error) {
+	return nil, nil
+}
+
+func (m *mockStoppableSelector) Stop() {
+	m.stopped = true
+}
+
+func TestManagerSetSelectorStopsReplacedStoppableSelector(t *testing.T) {
+	t.Parallel()
+	mockSelector := &mockStoppableSelector{}
+	manager := NewManager(nil, mockSelector, nil)
+
+	manager.SetSelector(&RoundRobinSelector{})
+
+	if !mockSelector.stopped {
+		t.Fatal("expected previous StoppableSelector to be stopped when replaced via SetSelector")
+	}
+}
+
+type zeroSizeSelectorA struct {
+	stopped *bool
+}
+
+func (z zeroSizeSelectorA) Pick(ctx context.Context, provider, model string, opts cliproxyexecutor.Options, auths []*Auth) (*Auth, error) {
+	return nil, nil
+}
+
+func (z zeroSizeSelectorA) Stop() {
+	if z.stopped != nil {
+		*z.stopped = true
+	}
+}
+
+type zeroSizeSelectorB struct{}
+
+func (z zeroSizeSelectorB) Pick(ctx context.Context, provider, model string, opts cliproxyexecutor.Options, auths []*Auth) (*Auth, error) {
+	return nil, nil
+}
+
+func TestManagerSetSelectorDifferentZeroSizedSelectors(t *testing.T) {
+	t.Parallel()
+	stoppedA := false
+	selA := zeroSizeSelectorA{stopped: &stoppedA}
+	selB := zeroSizeSelectorB{}
+
+	manager := NewManager(nil, selA, nil)
+	manager.SetSelector(selB)
+
+	if !stoppedA {
+		t.Fatal("expected zeroSizeSelectorA to be stopped when replaced by zeroSizeSelectorB")
+	}
+	if manager.Selector() != selB {
+		t.Fatalf("expected manager selector to be selB, got %#v", manager.Selector())
+	}
+}
+
+type uncomparableSelector struct {
+	fn func()
+}
+
+func (u uncomparableSelector) Pick(ctx context.Context, provider, model string, opts cliproxyexecutor.Options, auths []*Auth) (*Auth, error) {
+	return nil, nil
+}
+
+func TestManagerSetSelectorUncomparableTypes(t *testing.T) {
+	t.Parallel()
+	manager := NewManager(nil, nil, nil)
+
+	sel1 := uncomparableSelector{fn: func() {}}
+	sel2 := uncomparableSelector{fn: func() {}}
+
+	// Setting uncomparable types must not panic
+	manager.SetSelector(sel1)
+	manager.SetSelector(sel2)
+	manager.SetSelector(nil)
+}
+
+func TestManagerSetSelectorSameInstanceDoesNotStop(t *testing.T) {
+	t.Parallel()
+	mockSelector := &mockStoppableSelector{}
+	manager := NewManager(nil, mockSelector, nil)
+
+	// Setting the same instance should be a no-op and not call Stop
+	manager.SetSelector(mockSelector)
+	if mockSelector.stopped {
+		t.Fatal("setting the same selector instance unexpectedly called Stop")
+	}
+}
+
+func TestManagerSetSelectorConcurrent(t *testing.T) {
+	t.Parallel()
+	manager := NewManager(nil, nil, nil)
+	var wg sync.WaitGroup
+	for i := 0; i < 20; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for j := 0; j < 10; j++ {
+				sel := &mockStoppableSelector{}
+				manager.SetSelector(sel)
+			}
+		}()
+	}
+	wg.Wait()
+}

sdk/cliproxy/auth/session_cache.go

@@ -17,10 +17,11 @@ type sessionEntry struct {
 
 // SessionCache provides TTL-based session to auth mapping with automatic cleanup.
 type SessionCache struct {
-	mu      sync.RWMutex
-	entries map[string]sessionEntry
-	ttl     time.Duration
-	stopCh  chan struct{}
+	mu       sync.RWMutex
+	entries  map[string]sessionEntry
+	ttl      time.Duration
+	stopCh   chan struct{}
+	stopOnce sync.Once
 }
 
 // NewSessionCache creates a cache with the specified TTL.
@@ -319,11 +320,12 @@ func (c *SessionCache) InvalidateAuth(authID string) {
 
 // Stop terminates the background cleanup goroutine.
 func (c *SessionCache) Stop() {
-	select {
-	case <-c.stopCh:
-	default:
-		close(c.stopCh)
+	if c == nil {
+		return
 	}
+	c.stopOnce.Do(func() {
+		close(c.stopCh)
+	})
 }
 
 func (c *SessionCache) cleanupLoop() {

sdk/cliproxy/service_config_weight_test.go

@@ -1,10 +1,12 @@
 package cliproxy
 
 import (
+	"context"
 	"testing"
 
 	internalconfig "github.com/router-for-me/CLIProxyAPI/v7/internal/config"
 	coreauth "github.com/router-for-me/CLIProxyAPI/v7/sdk/cliproxy/auth"
+	cliproxyexecutor "github.com/router-for-me/CLIProxyAPI/v7/sdk/cliproxy/executor"
 )
 
 func TestWeightedRoundRobinRoutingSelector(t *testing.T) {
@@ -40,3 +42,36 @@ func TestServiceRejectsInvalidCredentialWeightConfigCommit(t *testing.T) {
 		t.Fatalf("config sequence = %d, want 0", service.configSequence)
 	}
 }
+
+type trackingStoppableSelector struct {
+	stopped bool
+}
+
+func (s *trackingStoppableSelector) Pick(ctx context.Context, provider, model string, opts cliproxyexecutor.Options, auths []*coreauth.Auth) (*coreauth.Auth, error) {
+	return nil, nil
+}
+
+func (s *trackingStoppableSelector) Stop() {
+	s.stopped = true
+}
+
+func TestApplyManagerConfigStopsReplacedServiceAffinitySelector(t *testing.T) {
+	tracking := &trackingStoppableSelector{}
+	service := &Service{
+		coreManager: coreauth.NewManager(nil, tracking, nil),
+	}
+
+	newCfg := &internalconfig.Config{
+		Routing: internalconfig.RoutingConfig{
+			Strategy: "round-robin",
+		},
+	}
+	commit := configCommit{cfg: newCfg, sequence: 1}
+	if !service.applyManagerConfig(context.Background(), commit) {
+		t.Fatal("applyManagerConfig failed")
+	}
+
+	if !tracking.stopped {
+		t.Fatal("expected replaced selector to be stopped during routing config apply")
+	}
+}