fix(bridge): preserve rate-limit retry advice for Codex

[luvs01]

Summary

Typed Devin refusals currently reach the Responses client as resource_exhausted with retry after ~Ns. Codex treats that code as a generic retryable disconnect and does not parse its stated delay: an installed-runtime fixture advised 2 seconds but retried after 0.232 and 0.408 seconds. Changing only the code or only the wording did not fix the delay.

Normalize known typed HTTP 429 rate_limit_error codes (resource_exhausted, rate_limit_exceeded, slow_down) to the Codex rate-limit contract only when a valid delay exists. Typed errors without usable timing retain their original code. A shared formatter puts the longest valid provider delay first as Please try again in Ns. for both typed and message-only rate-limit failures. Competing original hints are retained under an explicit Provider detail: label. This fixes both the typed path losing the hint and the message-only path leaving a shorter hint first. Other explicit verdicts, including authentication, quota and local send-budget failures, are unchanged.

The existing default of no Devin proxy-owned wait lets Codex own its bounded native retry. Delivery of retry advice does not guarantee a reconnect notification, visible Desktop text, or a successful next provider response. This PR creates no synthetic reasoning/tool/history items, changes no retry counts or live settings, and preserves account/combo failover, Grok HTTP 429 handling and opted-in proxy waits. A positive proxy wait still delays the client-visible failure and may multiply attempts with client retries; this is documented rather than silently reconfigured.

This is an interoperability follow-up to #5041, #5152 and #5933 (integrated by #5987), not a replacement for their same-request controls. Each client retry is a new HTTP request and does not inherit a previous proxy request's send counter or cumulative wait allowance. Cross-request workflow limits depend on their existing configuration and identity. Selecting a different retry owner is an operational decision outside this patch.

The follow-up commit adds long-advice regressions and Codex retry diagnostics; it makes no additional runtime change. In the public Codex rust-v0.158.0-alpha.2.1 stream retry handler, a release build can suppress the first notification when the internal WebSocket-enabled predicate is true. The predicate does not test delay length, and waiting occurs outside the notification block. This is a concrete possible explanation for a silent long wait, not proof that the observed request took that branch. Subscription/renderer availability is not event-delivery evidence. Changing that engine-side notification policy belongs in Codex; this proxy must not shorten the delay, manufacture history, force another request or silently reconfigure transport to make a row appear.

Verification

Current follow-up: fb19e19704f3bf05c578cecf7e630e0c27103c1f

• Added 8 cases / 26 assertions to the existing tests/server/retry-delay-hardening.test.ts: preserve 120/900/1800/2460/3600-second advice, keep a longer hint before a competing 1-second hint, retain formatting idempotence, and keep an intervening untimed socket error and a later 120-second refusal independent of the earlier 2460-second hint. These are parser/formatter checks, not elapsed-time, notification-predicate, HTTP classification or Desktop tests.
• 8 pass, 0 fail, 26 assertions in an isolated Node 22.16.0 execution of the exact newly added describe block, transpiled with TypeScript and using Node strict assertions for the two Bun matchers it uses. The real, unchanged src/lib/retry-delay.ts was compiled with tsc src/lib/retry-delay.ts --target ES2022 --module commonjs --strict --outDir <scratch>. This is deliberately not represented as a Bun run or repository-wide typecheck.
• git diff --cached --check passed for the two follow-up files. Targeted checks of those files found no raw identifiers, private paths, credentials or observation timestamps; this is not the repository privacy:scan gate.
• All three runtime files remain identical to 26cb4f7681861668bf0a0eb8f1466ea67804e499; the follow-up only adds the diagnostic page and extends an existing test file. No new test-file layout registration is needed.
• This editing environment has no Bun binary and cannot resolve the package/GitHub hosts from its shell. The normal focused command bun test tests/server/retry-delay-hardening.test.ts, full suite, repository bun run typecheck, bun run structure:check, bun run privacy:scan, file-size gate, and cd docs-site && bun install --frozen-lockfile && bun run build were not run for this follow-up. The earlier results below do not validate the new documentation or test registration. Keep this PR in draft pending normal exact-head validation and review; do not mark these missing checks as passed.

Earlier recorded local evidence: 26cb4f7681861668bf0a0eb8f1466ea67804e499

• Bun 1.4.0: adapter-error-inline, errors-adapter-failure, retry-delay-hardening, retry-after-429, and responses-grok-devin-preflight — 124 pass, 0 fail, 301 assertions. Covers typed/message-only parity, no-delay code preservation, invalid delays, longest-hint precedence, idempotent formatting, redaction, exclusions, SSE/buffered parity, Codex SSE, Grok HTTP 429, account/combo failover and cancellation.
• Earlier focused checks on b96a41560f: 34 Devin adapter/reset-retry/hardening tests, 97 direct encoder parity tests, and the 56-test bridge/server/file-size run passed. Retry scheduling and encoder implementations are unchanged by the review follow-up; these earlier runs are not represented as full-suite validation of the new revision.
• TypeScript tsc --noEmit, scripts/structure-ssot.ts, scripts/privacy-scan.ts, and git diff --check passed for the earlier revision.
• Earlier file-size ratchet: 9 pass, 0 fail, 83 assertions.
• Earlier docs: frozen-lockfile install and bun run build passed; 537 pages and 73,657 internal links checked. This build predates the new diagnostic page.
• Installed Codex app-server 0.158.0-alpha.2.1 on Windows, isolated CODEX_HOME and loopback mock provider: normalized 2-second hints retried after 2.064 / 2.027 seconds; a real-clock 900-second hint retried once after 900.095 seconds, then completed. The following turn completed without the status text in model input and without reasoning items. Separate probes verified cancellation during a wait and retry-count exhaustion. These are native-runtime protocol tests, not a visual Desktop test or real Devin call.
• Import-selected testing was attempted: --changed=dev picked an unrelated local comparison ref, so it was corrected to --changed=origin/dev. Bun then spent over five minutes selecting the import graph without emitting a test run; that exact owned child was stopped. Focused regressions were the local scope exception; full cross-platform coverage remains for CI. No passing or cancelled upstream CI was rerun.

Live observation supplied by the local reviewer, 2026-09-29

The observer tested a runtime-only backport of the three files from 26cb4f7681861668bf0a0eb8f1466ea67804e499 onto the existing 2.70.0-compat.6079 bundle, not a full build of the current PR head. The observer reports a correlated automatic request 2460.067 seconds after the initial normalized-429 response ended, against advice of 2460 seconds. That request later failed with a socket-close 502 / upstream_server_error after about 19.8 seconds; the next attempt received a normalized 429 with 120-second advice. The work turn remained in progress.

This confirms a real approximately 41-minute automatic retransmission, not final Devin recovery. A first reconnect row was not visible in the user's screenshot. The observer found an enabled error subscription and a willRetry to stream-error to Reconnecting rendering path, with detail text collapsed by default, but did not capture actual notification generation or delivery. The upstream first-notification condition above remains a hypothesis for that specific missing row. This editing session did not independently re-read the local logs, restart the app/service, change settings, or send input to the test turn.

Only validation scope and aggregate timing/outcomes are published here. Raw logs, account information, private paths, exact observation timestamps and conversation/thread/request/trace identifiers are intentionally omitted.

Still unverified: final successful live-provider completion, actual notification generation/delivery and Desktop display for the affected retry, a real 60-minute wait, and app-restart recovery. The native label remains Codex's Reconnecting..., not a custom cooldown countdown. The PR remains a draft pending exact-head CI and review.

A previously recorded read-only local retained-log audit found 96 failed Devin request records: 92 resource_exhausted failures (21 with parseable timing, 71 without), two client cancellations and two upstream failures. This supports the no-delay and unrelated-error exclusions. These are retained final-request records, not every provider attempt or an all-history sample; no raw prompts, account identifiers or error bodies are published.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[lidge-jun]

리뷰 · 우선순위 61 / 80

이 PR은 Devin 같은 쪽에서 온 타입이 있는 HTTP 429 거절을 Codex가 제대로 기다리게 고칩니다. 지금은 resource_exhausted 같은 코드가 그대로 나가서 Codex가 “잠깐 끊긴 정도”로만 보고, 메시지에 적힌 “몇 초 뒤에 다시”를 거의 무시합니다. 그래서 2초라고 적혀 있는데 0.2초 만에 다시 치는 일이 났다고 합니다. 고친 뒤에는 알려진 레이트 리밋 코드(resource_exhausted, rate_limit_exceeded, slow_down)를 rate_limit_exceeded로 맞추고, 메시지에서 읽은 가장 긴 대기 시간을 맨 앞에 Please try again in Ns.로 붙입니다. 인증·쿼터·로컬 전송 한도 같은 다른 거절은 그대로 둡니다. 프록시가 대신 기다리게 하는 설정은 기본이 꺼져 있고, 켠 경우에는 클라이언트 재시도와 겹칠 수 있다고 문서에도 적어 두었습니다. 테스트와 structure/docs 보강이 같이 들어 있습니다. base는 dev입니다.

라인 - src/bridge/internal.ts의 새 경로는 조언을 앞에 붙이는데, src/lib/errors.ts의 adapterFailureFromMessage는 여전히 뒤에 붙이고, 메시지에 이미 please try again in이 있으면 더 긴 지연을 넣지 않습니다. Codex가 “첫 번째 try again in”을 읽는다면 두 경로 결과가 어긋날 수 있습니다.
라인 - 지연을 못 읽어도 코드만 rate_limit_exceeded로 바뀝니다. delay 없는 resource_exhausted를 다른 클라이언트가 다르게 다루면 동작이 바뀔 수 있습니다(테스트는 “메시지 그대로”만 강하게 보고, 코드 변경 부작용은 약합니다).
라인 - 이미 짧은 Please try again in 1s.가 있어도 긴 힌트를 앞에 붙이면서 짧은 문장이 뒤에 남습니다. Codex에는 맞지만, 사람이 읽는 로그/UI는 힌트가 두 개로 보일 수 있습니다.
라인 - PR이 아직 draft이고, 본문도 exact-head CI·리뷰 대기라고 합니다. OPENCODEX_DEVIN_STATED_RESET_WAIT_MS를 양수로 쓰는 환경에서는 프록시 대기와 클라이언트 대기가 겹칠 수 있다고 문서만 있고, 기본 권장(0/unset)을 설정 쪽에서도 한 번 더 확인할 여지가 있습니다.

메인테이너의 판단이 필요한 지점

메시지-only 경로도 앞에 붙이도록 맞출지, 이번 PR 범위는 typed 경로만으로 둘지. 또 아주 긴 힌트(예: 900초)를 Codex 네이티브 재연결에 그대로 맡기는 운영이 팀 기본값으로 괜찮은지.

너의 추천

범위가 작고 원인·수정·테스트가 잘 맞습니다. draft 해제 전 CI 초록을 보고, 가능하면 adapterFailureFromMessage와의 앞/뒤 붙이기 불일치를 이어서 맞추거나 “이번엔 typed만”이라고 짧게 남겨 주세요. 그 전제면 merge 방향이 좋아 보입니다.

이 댓글은 grok-bot이 작성했습니다

[luvs01]

Addressed the actionable points in the review in 26cb4f7681:

• Typed and message-only rate-limit failures now share one longest-delay-first formatter. A regression checks identical output, a shorter pre-existing hint and idempotence.
• Typed errors without a valid positive delay retain their original code. A read-only audit of retained local Devin request records found 71 untimed resource_exhausted failures and 21 with usable timing, so this exclusion matters in practice. Cancellation and upstream-failure records were also observed and remain outside the mapping. This is a bounded final-request sample, not an all-history or per-attempt inventory.
• When a competing try again in hint is retained, it is labeled Provider detail:; the leading advice is authoritative without silently deleting diagnostic text.
• Docs and the description now distinguish this client interoperability repair from fix(devin): wait out a stated rate-limit reset and replay the turn #5041/feat(devin): admit every inference send through the shared budget #5152/fix(devin): honor opted-in reset waits and keep cooldown streams alive #5933's same-request replay and budget controls. No runtime default or operator setting is changed. A client retry is a new HTTP request, not continuation of one proxy send budget or cumulative wait allowance.

Current focused regressions: 124 pass / 0 fail; file-size guard: 9 pass / 0 fail. Typecheck, structure/privacy checks and the 537-page docs build passed. New-head CI is pending; the earlier 15-minute native-runtime protocol result remains evidence for the same canonical error contract, not a visual Desktop or restart-recovery test.

[luvs01]

Follow-up pushed in fb19e19.

• Added 8 parser/formatter regression cases (26 assertions) for long advice, longest-hint precedence, idempotence, and an untimed disconnect followed by a new shorter refusal. These are not clock, HTTP-classification, notification or Desktop tests.
• Added docs-site/src/content/docs/reference/codex-retry-diagnostics.md, separating advice delivery, automatic retransmission, provider recovery, event emission/delivery and visible UI. The version-pinned Codex source shows that the first release-build WebSocket retry notice may be suppressed even for a long delay; whether that exact branch explains the local screenshot remains unverified.
• Updated the PR description with the local observer's aggregate evidence: a correlated automatic retransmission after 2460.067 seconds, followed by a socket-close 502 and a subsequent 429 carrying 120-second advice. This supports live retransmission timing, not final Devin recovery. No raw logs, account data or private identifiers are included.
• No runtime changes after 26cb4f7. The running local trial was not restarted, reconfigured or sent new input by this editing session. No dummy history items, forced extra sends or transport toggles were introduced.

Validation scope is explicit in the PR body: the exact new pure-function cases passed in an isolated Node/TypeScript execution (8 pass / 26 assertions), and changed-file whitespace/targeted privacy checks passed. Bun, full repository typecheck, structure/privacy/file-size gates and the documentation build were not run locally for this follow-up. Earlier passing results remain attributed to their earlier revision. Post-push inspection found Cross-platform CI still in progress; the PR stays draft, with no claim that all exact-head checks or actual UI recovery have passed.

[lidge-jun]

Landed on dev via the credited carry #6248 (Co-authored-by trailer retained in the squash commit). Thank you, @luvs01.