Contain Codex child stdin release races

[ymichael]

Human comments

What was wrong

The recurring packages failure was amplified by package-shard CPU oversubscription but rooted in two lifecycle races. First, the topology test started a 200 ms real-time request deadline before the app-server subprocess had executed, then required the fake to have logged both spawn: and exit:; under contention the runtime correctly released the construction before the fake ran its first line, so spawned() === 1 && exited() === 1 was impossible forever. Instrumentation reproduced that state in all 40/40 stressed failures (spawned=0, no live PID, no failed-release warning). Second, once the test made the construction boundary deterministic, release could kill the app-server while the Codex bridge was making its next initialization write; the resulting child-stdin EPIPE was unhandled and crashed the shared bridge.

Review of the initial containment found two distinctions inside that fix. An unwritable stdin after the child had already emitted exit is part of the existing bounded stdout-drain window, not a new transport failure. Treating it as broken stdin cleared pending requests before final protocol output arrived and replaced the real exit code/stderr diagnostic with stdin failed. An asynchronous EPIPE can also arrive immediately before Node emits the child's real exit; finalizing synchronously at EPIPE preserved stderr but replaced a real code 7 with synthetic { code: null, signal: null }. Conversely, a genuine closed stdin before child exit is irrecoverable and must make the connection terminal immediately so the bridge can rebuild it.

This is distinct from #2352: its predicate-before-deadline polling fix remains intact, and these failures were real lifecycle states that never satisfied the predicate. The independently verified merge base is 524b2fe4b0df74185bdd29a274fb77cd6765b2b3.

What changed

• Make the topology scenario deterministic without increasing any timeout: stall the fake thread/start, freeze only the runtime request clock until the real child has started, advance the existing 200 ms deadline, and assert both that its SIGTERM handler recorded a graceful exit and that the recorded PID is gone. The fake installs that handler before publishing spawn, and its obsolete startDelayMs option was removed.
• Preserve the existing post-exit stdout-drain boundary: writes attempted after the child has emitted exit are ignored while final output continues to settle pending requests, and normal finalization retains the real exit status and stderr tail.
• Treat only closed-stream stdin errors (EPIPE and ERR_STREAM_DESTROYED) as terminal connection failures. The connection reports exited and rejects new work immediately, records the transport detail, and force-stops the unusable child. The already-pending request and onExit finalize through the child's observable exit/close boundary, preserving a natural exit code or the SIGKILL signal plus any final stdout. Unexpected stdin errors are not silently reclassified.
• Cover the lifecycle paths with real child-process regressions: final responses and stderr-bearing exit errors during the drain window, EPIPE immediately preceding a natural code-7 exit, and a child that closes fd 0, ignores SIGTERM, remains alive, and is observably reaped by SIGKILL. Every fixture has a bounded self-destruct and awaited teardown.

There is no server/daemon wire-contract change, so HOST_DAEMON_PROTOCOL_VERSION is unchanged. There are no CLI, guide, or configuration-surface changes.

How you verified

• Original red-capable exact stress harness, 64 parallel focused runs on 16 logical CPUs:
  • Before: 62/64 passed; 2/64 failed with the exact Timed out after 10000ms waiting for the late-constructed child was released signature. Test-body p50/p95/max were 2.59 s / 3.01 s / 12.62 s.
  • Initial fix under the same 4× oversubscription: 64/64 passed, 0 exact signatures. Test-body p50/p95/max were 1.94 s / 2.47 s / 2.70 s.
  • After review corrections and the restored graceful-exit assertion: 64/64 passed repeatedly. The final run also passed 64/64 while another worktree held 32 CPU-burning loops (test-body p50/p95/max 5.72 s / 6.40 s / 6.50 s).
• First review regressions before their production change: 3/3 failed deterministically — the late response was discarded, the stderr-rich exit error became stdin failed, and connection.exited remained false after EPIPE. After: all passed.
• Second review regression before its production change: a child exiting 7 with a write in flight was reported as stdin failed (EPIPE) with null status. After: the request and onExit retain code 7 and stderr. The four-test connection suite passed 32/32 parallel stress runs on 16 CPUs.
• pnpm exec turbo run test --filter=@bb/agent-runtime -- --run src/runtime.codex-topology.test.ts — 1 file / 4 tests passed.
• pnpm exec turbo run test --filter=bb-plugin-provider-codex -- --run src/bridge/app-server-connection.test.ts — 1 file / 4 tests passed.
• pnpm exec turbo run test --filter=@bb/agent-runtime --filter=bb-plugin-provider-codex --force — agent-runtime 22 files / 318 tests and Codex provider 25 files / 242 tests passed.
• pnpm exec turbo run typecheck --filter=@bb/agent-runtime --filter=bb-plugin-provider-codex --force — passed under the same unrelated CPU contention.
• pnpm exec turbo run build --filter=@bb/agent-runtime --filter=bb-plugin-provider-codex --force — applicable Turbo build graph passed (the two scoped packages have no direct build scripts).
• pnpm exec prettier --check packages/agent-runtime/src/runtime.codex-topology.test.ts plugins/provider-codex/src/bridge/app-server-connection.ts plugins/provider-codex/src/bridge/app-server-connection.test.ts plugins/provider-codex/src/bridge/fake-codex-app-server.mjs — passed.

Fixes: no issue — exact and fuzzy open issue/PR searches found no active recurrence fix.

AGENT GENERATED: by GPT-5.6-Sol