@bitkyc08/opencodex 2.83.0 → 2.84.0

package/src/server/responses/code-mode-collab-surface.ts

@@ -0,0 +1,205 @@
+/**
+ * V1 collaboration evidence nested inside Codex's code-mode `exec` tool (#6844).
+ *
+ * In code-mode-only turns codex-rs does not put the collaboration tools on the wire. When they are
+ * ENABLED it renders each one into the custom `exec` description instead
+ * (code-mode-protocol/src/description.rs, build_exec_tool_description): a top-level heading line,
+ * the tool's own description, then an "exec tool declaration:" ts fence holding
+ * "declare const tools: { <name>(args: ...): Promise<...>; };". A namespaced tool is flattened to
+ * <namespace>__<name> (tools/src/code_mode.rs, code_mode_name_for_tool_name), and V1 always
+ * registers under the fixed namespace multi_agent_v1, so a rendered V1 surface reads
+ * multi_agent_v1__spawn_agent.
+ *
+ * That rendering is the only proof of V1 inside exec itself. When the model supports tool search,
+ * codex-rs registers V1 as DEFERRED and leaves it out of the description entirely, and every
+ * OpenCodex catalog row advertises tool search. Such a turn carries no V1 evidence here; a bare
+ * exec, the ALL_TOOLS mention, and the saved OpenCodex mode prove nothing about the conversation
+ * (codex-rs pins the version per session). The deferred case has its own, separate evidence source
+ * in deferred-collab-surface.ts, which uses this file's genuine-exec check as a host guard.
+ *
+ * A tool description is copied into exec verbatim, so one that reproduces a complete top-level V1
+ * section is indistinguishable from the host's own rendering. This parser cannot authenticate the
+ * host; it only refuses everything short of that exact shape.
+ */
+import { CODE_MODE_EXEC_TOOL_NAME, declaresCodeModeExec, type OcxTool } from "../../types";
+
+export type CodeModeV1Evidence = "v1" | "ambiguous" | null;
+
+/** What a request's code-mode exec proves about collaboration, before any combination policy. */
+export interface CodeModeExecAnalysis {
+  /** A codex-rs code-mode exec is declared: bare, freeform, template-led, no bare shell bridge. */
+  genuineExec: boolean;
+  /** That exec renders a complete multi_agent_v1__spawn_agent section. */
+  renderedV1: boolean;
+  /** That exec mentions a spawn_agent or V2 companion that is not V1's, quoted or not. */
+  foreignCollabClaim: boolean;
+}
+
+/** First line of codex-rs EXEC_DESCRIPTION_TEMPLATE; an overridden or foreign exec fails closed. */
+const CODE_MODE_EXEC_TEMPLATE_HEADER = "Run JavaScript code to orchestrate/compose tool calls";
+const MULTI_AGENT_V1_SPAWN = "multi_agent_v1__spawn_agent";
+const SPAWN = "spawn_agent";
+const V2_COMPANIONS = ["send_message", "followup_task", "interrupt_agent", "list_agents"] as const;
+const DECLARATION_LEAD = "exec tool declaration:";
+
+const TOOL_HEADING = /^### `([A-Za-z_$][\w$]*)`(?: \(`([^`]+)`\))?$/;
+const DECLARATION_FENCE = "```ts";
+// CommonMark fences: up to three spaces of indentation, three or more backticks or tildes. A fence
+// closes only on the same character, at least as long, with nothing but whitespace after it.
+const FENCE_OPEN = /^ {0,3}(`{3,}|~{3,})(.*)$/;
+const FENCE_CLOSE = /^ {0,3}(`{3,}|~{3,})[ \t]*$/;
+
+interface Fence { char: string; length: number }
+
+function openedFence(line: string): Fence | undefined {
+  const match = FENCE_OPEN.exec(line);
+  if (!match) return undefined;
+  const run = match[1]!;
+  // A backtick fence's info string may not contain a backtick (that line is inline code).
+  if (run[0] === "`" && match[2]!.includes("`")) return undefined;
+  return { char: run[0]!, length: run.length };
+}
+
+function closesFence(line: string, fence: Fence): boolean {
+  const match = FENCE_CLOSE.exec(line);
+  return match !== null && match[1]![0] === fence.char && match[1]!.length >= fence.length;
+}
+
+function isCodeModeExec(tool: OcxTool): boolean {
+  return tool.name === CODE_MODE_EXEC_TOOL_NAME && !tool.namespace && tool.freeform === true
+    && typeof tool.description === "string"
+    && tool.description.startsWith(CODE_MODE_EXEC_TEMPLATE_HEADER);
+}
+
+/** A nested tool rendered as a heading plus its own declaration; `raw` is the pre-normalization name. */
+interface RenderedTool { name: string; raw: string }
+
+/** The declaration fence codex-rs opens: three backticks and "ts". */
+const DECLARATION_FENCE_SHAPE: Fence = { char: "`", length: 3 };
+
+/** A complete declaration as render_code_mode_sample emits it, single- or multi-line. */
+function isCompleteDeclaration(body: readonly string[], name: string): boolean {
+  const text = body.join("\n");
+  const prefix = "declare const tools: { " + name + "(";
+  if (!text.startsWith(prefix)) return false;
+  // A named, typed parameter (`args` for functions, `input` for freeform) and a non-empty return type.
+  return /^(?:args|input): \S[\s\S]*\): Promise<[^>\s][\s\S]*>; \};$/.test(text.slice(prefix.length));
+}
+
+/** codex-rs normalize_code_mode_identifier: invalid identifier characters become `_`. */
+function normalizeCodeModeIdentifier(raw: string): string {
+  let identifier = "";
+  for (const [index, ch] of [...raw].entries()) {
+    const valid = index === 0 ? /[A-Za-z_$]/.test(ch) : /[A-Za-z0-9_$]/.test(ch);
+    identifier += valid ? ch : "_";
+  }
+  return identifier === "" ? "_" : identifier;
+}
+
+/** A heading as render_tool_heading emits it: a raw suffix only when normalization changed the name. */
+function renderedHeading(match: RegExpExecArray): RenderedTool | undefined {
+  const name = match[1]!;
+  const raw = match[2];
+  if (raw === undefined) return { name, raw: name };
+  return raw !== name && normalizeCodeModeIdentifier(raw) === name ? { name, raw } : undefined;
+}
+
+/**
+ * Nested tools whose top-level heading is followed by the complete declaration codex-rs renders for
+ * the same name. A section ends at its own declaration, not at the next heading, because tool and
+ * namespace descriptions (V1 spawn's guidance, a configured usage hint) carry their own Markdown,
+ * including example headings and example declarations. Pending headings form a stack: a
+ * declaration is owned by the outermost pending heading with its name, which is removed together
+ * with anything opened after it; a declaration nobody owns is an example and leaves the stack
+ * alone. Lines inside a quoted fence can neither open a section nor declare a tool.
+ */
+function renderedNestedTools(description: string): RenderedTool[] {
+  const lines = description.split("\n");
+  const rendered: RenderedTool[] = [];
+  const pending: RenderedTool[] = [];
+  let fence: Fence | undefined;
+  for (let i = 0; i < lines.length; i += 1) {
+    const line = lines[i]!;
+    if (fence) {
+      if (closesFence(line, fence)) fence = undefined;
+      continue;
+    }
+    const match = TOOL_HEADING.exec(line);
+    if (match) {
+      const heading = renderedHeading(match);
+      if (heading) pending.push(heading);
+      continue;
+    }
+    if (line === DECLARATION_LEAD && lines[i + 1] === DECLARATION_FENCE) {
+      let close = i + 2;
+      while (close < lines.length && !closesFence(lines[close]!, DECLARATION_FENCE_SHAPE)) close += 1;
+      if (close >= lines.length) return rendered; // unterminated: nothing after it is structure
+      const body = lines.slice(i + 2, close);
+      // The outermost pending heading with the declared name owns it, so a same-name heading quoted
+      // inside the tool's own description cannot take over the genuine section.
+      const owner = pending.findIndex(tool => isCompleteDeclaration(body, tool.name));
+      if (owner >= 0) {
+        rendered.push(pending[owner]!);
+        pending.length = owner;
+      }
+      i = close;
+      continue;
+    }
+    fence = openedFence(line);
+  }
+  return rendered;
+}
+
+/** A nested name that claims a collaboration surface other than V1's. */
+function isForeignCollabName(name: string): boolean {
+  if (name.startsWith("mcp__")) return false; // MCP server tools are never native collaboration
+  if (name === MULTI_AGENT_V1_SPAWN) return false;
+  if (name === SPAWN || name.endsWith("__" + SPAWN)) return true;
+  return V2_COMPANIONS.some(companion => name === companion || name.endsWith("__" + companion));
+}
+
+/** Every name a heading or declaration line mentions, quoted or not. */
+function mentionedToolNames(description: string): string[] {
+  const names: string[] = [];
+  for (const line of description.split("\n")) {
+    const heading = TOOL_HEADING.exec(line);
+    if (heading) {
+      names.push(heading[1]!);
+      if (heading[2] !== undefined) names.push(heading[2]);
+    }
+    for (const match of line.matchAll(/declare const tools: \{ ([A-Za-z_$][\w$]*)\(/g)) names.push(match[1]!);
+  }
+  return names;
+}
+
+/**
+ * Reads every genuine code-mode exec once. The two collaboration halves are deliberately
+ * asymmetric. V1 evidence needs a rendered section (a heading followed by its complete
+ * declaration). The contradiction check reads every heading and declaration line, inside fences or
+ * not and whoever "owns" it, so text copied into the listing can only push a turn toward null; it
+ * cannot hide another surface. The contradiction is reported even without rendered V1, because
+ * deferred V1 evidence must also yield to a rendered foreign surface.
+ */
+export function analyzeCodeModeExec(tools: readonly OcxTool[] | undefined): CodeModeExecAnalysis {
+  const analysis: CodeModeExecAnalysis = { genuineExec: false, renderedV1: false, foreignCollabClaim: false };
+  if (!tools || tools.length === 0) return analysis;
+  if (!declaresCodeModeExec(new Set(tools.filter(tool => !tool.namespace).map(tool => tool.name)))) return analysis;
+  for (const tool of tools) {
+    if (!isCodeModeExec(tool)) continue;
+    analysis.genuineExec = true;
+    // A rendered V1 spawn heading carries no raw-name suffix: the identifier needs no normalization.
+    if (renderedNestedTools(tool.description).some(rendered => rendered.raw === MULTI_AGENT_V1_SPAWN)) analysis.renderedV1 = true;
+    if (mentionedToolNames(tool.description).some(isForeignCollabName)) analysis.foreignCollabClaim = true;
+  }
+  return analysis;
+}
+
+/**
+ * "v1" when a genuine code-mode exec renders the V1 spawn tool and nothing that claims another
+ * collaboration surface; "ambiguous" when it renders both; null when it proves nothing.
+ */
+export function codeModeV1Evidence(tools: readonly OcxTool[] | undefined): CodeModeV1Evidence {
+  const analysis = analyzeCodeModeExec(tools);
+  if (!analysis.renderedV1) return null;
+  return analysis.foreignCollabClaim ? "ambiguous" : "v1";
+}

package/src/server/responses/codex-ws-exchange.ts

@@ -11,7 +11,9 @@ import type { CodexWsSession } from "./codex-ws-session";
 import { UPGRADE_DEADLINE_MS, CODEX_WS_LIVENESS_PING_INTERVAL_MS, CODEX_WS_RESPONSE_PRELUDE_TIMEOUT_MS, MAX_CODEX_WS_FRAME_BYTES,
   MAX_CODEX_WS_QUEUE_BYTES, markCodexWsResponse, markCodexWsPreludeProjection, normalizeResponsesWsRelayEvent, closedBeforeTerminalMessage,
   codexWsCreateFrameExceedsLimit, codexWsFailureDetail, codexWsPreResponseFailure, markCodexWsStage, codexWsOcxVersion,
-  markCodexWsSocketDeath, type CodexWsFailureStage, type CodexWsStageRecord } from "./codex-ws-wire";
+  markCodexWsSocketDeath, codexWsWrapperStatus, isCodexWsTerminalEvent, type CodexWsFailureStage, type CodexWsStageRecord,
+  type CodexWsTerminalEvent, codexWsPreOutputRefusalStatus, isEmptyCodexWsLifecycleEvent, codexWsFrameResponseIds,
+  markCodexWsPreOutputRefusal, type CodexWsPreOutputRefusalHold } from "./codex-ws-wire";
 
 interface ExchangeOptions {
   nativeControl?: NativeResponseControl;
@@ -26,6 +28,13 @@ interface ExchangeOptions {
   onPhysicalDispatch?: () => void;
   /** Bun version string the caller gated on; stamped onto the stage record. */
   bunVersion?: string;
+  /**
+   * Opt-in (#6969): how long empty lifecycle frames may be held so an authoritative upstream
+   * refusal that follows them, before any output, can settle as a replayable gateway status instead
+   * of a committed 200. Absent or zero keeps the exchange exactly as it was. Ignored on native
+   * control exchanges and on transports without the metadata channel.
+   */
+  preOutputRefusalHold?: CodexWsPreOutputRefusalHold;
 }
 
 const HTTP_HEADER_TOKEN = /^[!#$%&'*+.^_`|~0-9a-z-]+$/i;
@@ -75,6 +84,8 @@ function rejectionHeaders(source: Record<string, unknown>, prelude: Headers): He
  * responses_websocket.rs accepts status/status_code and scalar header values;
  * unlike its native client, this relay converts only precommit 4xx. Returning a
  * post-send 5xx or fetch rejection could cause the outer retry wrapper to resend.
+ * The one 5xx exception is the opt-in pre-output refusal below (#6969): a structured upstream
+ * refusal with nothing relayed but empty lifecycle frames, which the caller may replay.
  */
 function wrappedRejectionResponse(payload: Record<string, unknown>, prelude: Headers): Response | null {
   if (payload.type !== "error" || payload.stream_id !== undefined) return null;
@@ -92,9 +103,20 @@ function wrappedRejectionResponse(payload: Record<string, unknown>, prelude: Hea
   }), { status, headers });
 }
 
+/** The client-facing error of a pre-output refusal projection, from the refusal's own error object. */
+function refusalErrorBody(source: unknown): Record<string, string> {
+  const error = record(source) ? source : {};
+  return {
+    type: typeof error.type === "string" ? error.type : "server_error",
+    ...(typeof error.code === "string" ? { code: error.code } : {}),
+    message: typeof error.message === "string" ? error.message : "Upstream declined the request before any output",
+  };
+}
+
 /** The sole SSE exchange state machine for both one-shot and retained sockets. */
 export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
-  const { session, url, init, prepared, sseFallback, onQuota, beforeDispatch, bunVersion, nativeControl, beforeContinuation } = options;
+  const { session, url, init, prepared, sseFallback, onQuota, beforeDispatch, bunVersion, nativeControl, beforeContinuation,
+    preOutputRefusalHold } = options;
   const { frameText, headers } = prepared;
   const signal = init.signal ?? undefined;
   return new Promise<Response>((resolve, reject) => {
@@ -120,6 +142,9 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
     // Numeric close code for the durable stage record; the reason string stays
     // out of it on purpose (#4191 content-free contract).
     let closeCode: number | null = null;
+    // #6740: which terminal frame the upstream itself sent, before any synthetic tail.
+    let terminalEvent: CodexWsTerminalEvent | null = null;
+    let terminalErrorStatus: number | null = null;
     let controller: ReadableStreamDefaultController<Uint8Array> | null = null;
     const encoder = new TextEncoder();
     const metadata = url === CODEX_RESPONSES_HTTP_URL ? new CodexWsMetadata(onQuota) : null;
@@ -135,6 +160,18 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
     // The resolved 200, retained so a later body failure can replace its
     // success-shaped stage record with the failure-shaped one (#4191).
     let committedResponse: Response | null = null;
+    // #6969: the pre-output refusal hold. While it is open, empty lifecycle frames are queued on the
+    // not-yet-exposed stream without resolving it. Every settle other than an eligible refusal
+    // commits first (deferredCommit), so the outcome is exactly what the exchange produced before.
+    const holdEnabled = (preOutputRefusalHold?.maxMs ?? 0) > 0 && metadata !== null && !nativeControl;
+    // Drops for good on any identity the exchange cannot tie to one response: a stream id, two
+    // different ids in one frame, or an id that differs from the first one seen. Independent of
+    // socket reuse, so a cold one-shot socket is held to the same rule as a pooled one.
+    let refusalEligible = holdEnabled;
+    let refusalResponseId: string | null = null;
+    let heldHeaders: Headers | null = null;
+    let deferredCommit = false;
+    let holdTimer: ReturnType<typeof setTimeout> | undefined;
     const stream = new ReadableStream<Uint8Array>({
       start(c) { controller = c; },
       cancel() {
@@ -149,6 +186,7 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
       clearTimeout(upgradeTimer);
       clearTimeout(silenceTimer);
       clearTimeout(pingTimer);
+      clearTimeout(holdTimer);
       signal?.removeEventListener("abort", onAbort);
       metadata?.finish();
       correlation?.finish();
@@ -200,14 +238,20 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
       reused: session.reused,
       ocxVersion: codexWsOcxVersion(),
       bunVersion: bunVersion ?? "unknown",
+      terminalEvent,
+      terminalErrorStatus,
     });
 
     const commitResponse = () => {
       if (responseCommitted) return;
       responseCommitted = true;
+      deferredCommit = false;
+      clearTimeout(holdTimer);
       clearTimeout(silenceTimer);
       clearTimeout(pingTimer);
-      const responseHeaders = metadata?.snapshot() ?? new Headers();
+      // A held preamble froze the prelude headers at the first Responses event, which is the moment
+      // they were frozen before the hold existed.
+      const responseHeaders = heldHeaders ? new Headers(heldHeaders) : metadata?.snapshot() ?? new Headers();
       responseHeaders.set("content-type", "text/event-stream; charset=utf-8");
       const response = new Response(stream, { status: 200, headers: responseHeaders });
       metadata?.commit();
@@ -218,9 +262,73 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
       resolve(response);
     };
 
+    /**
+     * Open the hold at the first empty lifecycle frame: freeze the prelude and bound the wait by
+     * both the hold's own maximum and its absolute end. False when no time is left, so the frame
+     * commits exactly as it would without the hold.
+     */
+    const beginHold = (): boolean => {
+      if (heldHeaders) return true;
+      if (!metadata || !preOutputRefusalHold) return false;
+      const waitMs = Math.min(preOutputRefusalHold.maxMs, preOutputRefusalHold.until - Date.now());
+      if (waitMs <= 0) return false;
+      heldHeaders = metadata.snapshot();
+      metadata.commit();
+      holdTimer = setTimeout(() => {
+        if (!terminal && !responseCommitted) commitResponse();
+      }, waitMs);
+      return true;
+    };
+
+    const noteRefusalIdentity = (payload: Record<string, unknown>) => {
+      const ids = codexWsFrameResponseIds(payload);
+      if (payload.stream_id !== undefined || ids === null || ids.length > 1) {
+        refusalEligible = false;
+        return;
+      }
+      const id = ids[0];
+      if (id === undefined) return;
+      if (refusalResponseId === null) refusalResponseId = id;
+      else if (id !== refusalResponseId) refusalEligible = false;
+    };
+
+    /**
+     * Settle an authoritative pre-output refusal (#6969) as the gateway status the upstream stated,
+     * without the non-replayable marker: nothing but empty lifecycle frames was relayed, and the
+     * upstream ended that response itself. The caller's transient ladder and pool move may send the
+     * turn again; if neither does, the registered restore hands the client the original stream,
+     * which is already complete on `stream`.
+     */
+    const resolveRefusal = (status: number, payload: Record<string, unknown>, headers: Headers, prelude: Headers) => {
+      responseCommitted = true;
+      deferredCommit = false;
+      clearTimeout(holdTimer);
+      const stage = stageRecord(null);
+      const source = payload.type === "error"
+        ? payload.error
+        : record(payload.response) ? payload.response.error : undefined;
+      const projection = new Response(JSON.stringify({ error: refusalErrorBody(source) }), { status, headers });
+      markCodexWsPreludeProjection(projection);
+      markCodexWsStage(projection, stage);
+      const observed = Boolean(metadata && onQuota);
+      markCodexWsPreOutputRefusal(projection, () => {
+        const restoredHeaders = new Headers(prelude);
+        restoredHeaders.set("content-type", "text/event-stream; charset=utf-8");
+        const restored = new Response(stream, { status: 200, headers: restoredHeaders });
+        markCodexWsResponse(restored, observed);
+        // The same record object, so the attempt that adopted it keeps reading one stage.
+        markCodexWsStage(restored, stage);
+        return restored;
+      });
+      resolve(projection);
+    };
+
     const failStream = (error: unknown, status: 502 | 504 = 502, { socketDied = false } = {}) => {
       if (terminal) return;
       terminal = true;
+      // A held preamble or refusal was a commit deferred, not avoided: settle as the committed
+      // body failure it would have been, never as a new pre-response gateway status.
+      if (deferredCommit) commitResponse();
       if (sent && !responseCommitted && metadata) {
         // Nothing has been promised to the client yet, so the honest answer is a gateway
         // status, not a 200 whose body then fails. The frame may already be executing
@@ -305,7 +413,7 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
         reject(reason);
         return;
       }
-      if (!responseCommitted && metadata) {
+      if (!responseCommitted && metadata && !deferredCommit) {
         // Sent, unacknowledged. The proxy's own connect deadline is an origin-silence
         // verdict and settles like one; a caller abort is the caller's decision, so the
         // exchange rejects with that reason and disposing the socket cancels the turn.
@@ -497,16 +605,23 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
       }
       if (!controlFrame && !type.startsWith("response.") && type !== "error") return;
       let steeringEnded = false;
+      let refusalStatus: number | undefined;
+      let refusalHeaders: Headers | undefined;
+      let refusalPrelude: Headers | undefined;
       if (!controlFrame) {
         firstResponseAt ??= Date.now();
         try {
           if (nativeControl) steeringEnded = nativeControl.observe(normalized.payload);
           else correlation?.accept(normalized.payload);
         } catch (error) { failStream(error); return; }
+        const holdOpen = refusalEligible && sent && !responseCommitted;
+        if (holdOpen) noteRefusalIdentity(normalized.payload);
         // Correlation must run first: a reused socket's foreign-stream error settles as a
         // non-replayable 502 above, never as the refused-create 4xx projection below, which
         // is the one status family that could authorize an account replay.
-        if (metadata && sent && !responseCommitted && type === "error") {
+        // Only before anything was held: after an empty preamble a 4xx frame keeps today's
+        // in-body delivery, so a held 429 can never become a quota rotation it was not before.
+        if (metadata && sent && !responseCommitted && !deferredCommit && type === "error") {
           let rejection: Response | null;
           try { rejection = wrappedRejectionResponse(normalized.payload, metadata.snapshot()); }
           catch (error) { failStream(error); return; }
@@ -520,7 +635,30 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
             return;
           }
         }
-        commitResponse();
+        let holdFrame = false;
+        if (holdOpen && refusalEligible) {
+          refusalStatus = codexWsPreOutputRefusalStatus(normalized.payload);
+          if (refusalStatus !== undefined) {
+            // Built before anything settles: a refusal whose metadata cannot be projected within the
+            // header bounds is delivered the way it was before, in the committed body.
+            try {
+              refusalPrelude = heldHeaders ?? metadata?.snapshot() ?? new Headers();
+              const declared = normalized.payload.headers;
+              refusalHeaders = rejectionHeaders(record(declared) ? declared : {}, refusalPrelude);
+            } catch {
+              refusalStatus = undefined;
+            }
+          }
+          holdFrame = refusalStatus === undefined && isEmptyCodexWsLifecycleEvent(normalized.payload) && beginHold();
+        }
+        if (refusalStatus === undefined && !holdFrame) commitResponse();
+        else deferredCommit = true;
+        // Record the terminal the upstream sent as soon as it is accepted, before the relay-size and
+        // queue checks below: a body failure that follows is still an exchange that received it.
+        if (!nativeControl && isCodexWsTerminalEvent(type)) {
+          terminalEvent = type;
+          terminalErrorStatus = type === "error" ? (codexWsWrapperStatus(normalized.payload) ?? null) : null;
+        }
       }
       const prefix = encoder.encode(`event: ${type}\ndata: `);
       const suffix = encoder.encode("\n\n");
@@ -558,6 +696,9 @@ export function codexWsExchange(options: ExchangeOptions): Promise<Response> {
           markCodexWsStage(committedResponse, stageRecord(null));
         }
         session.release(completedId);
+        if (refusalStatus !== undefined && refusalHeaders && refusalPrelude && !responseCommitted) {
+          resolveRefusal(refusalStatus, normalized.payload, refusalHeaders, refusalPrelude);
+        }
       }
     };