@bridge4dev/runner 0.68.0 → 0.69.0

package/dist/adapters/claude.js

@@ -353,6 +353,45 @@ class ClaudeSession {
      */
     turnFailureCode = null;
     turnFailureStatus = null;
+    /**
+     * The category the provider's own safety filter named, when it refused
+     * (#435, first item — recognition and nothing more).
+     *
+     * Two machine paths carry it and both are typed in the SDK the runner has
+     * (`@anthropic-ai/claude-agent-sdk@0.3.226`): the `model_refusal_no_fallback`
+     * system frame with `api_refusal_category`, and an ordinary assistant frame
+     * with `stop_reason: 'refusal'` and `stop_details.category`
+     * (`cyber | bio | frontier_llm | reasoning_extraction | general_harms`).
+     * Neither is read from prose — the ban on matching sentences is the whole
+     * reason `error-policy.ts` exists.
+     *
+     * Null on a CLI older than these frames, which reads as «we do not know» and
+     * leaves the session behaving exactly as it does today.
+     */
+    turnRefusalCategory = null;
+    /**
+     * Is there a turn for a refusal to attach itself to? (#455)
+     *
+     * Its only reader is the one-shot refusal mark. A refusal that arrives
+     * BETWEEN turns has no ending to mark, and a mark left waiting is spent by
+     * the next turn — which may be a perfectly good one, run after the window
+     * reopened, and would be filed as refused. Codex has had this guard since
+     * #258; Claude had not, and S1 wrote it down as a finding.
+     *
+     * Tracked on its own and not read off `turnClosed`, which looks like the
+     * same thing and is not: `turnClosed` is cleared by the first message of
+     * ANY kind after a `result`, and `rate_limit_event` — the very message a
+     * refusal arrives on, sent by the SDK with every request — is one of them.
+     * So it always said «a turn is open» by the time the refusal was read.
+     *
+     * Opened by anything that means work (a prompt going in, the agent
+     * speaking, a status, a tool result), closed by the `result` that ends the
+     * turn. It starts `true`, and `system:init` reopens it: a session is
+     * started in order to run a turn, and that is the behaviour the #258 test
+     * pins. The case it exists for — a refusal arriving after a turn has ended
+     * — is the one it answers exactly.
+     */
+    turnInFlight = true;
     /**
      * A `result` has gone out and no new message has arrived since (#406).
      *
@@ -483,6 +522,7 @@ class ClaudeSession {
      */
     resumingTurn() {
         this.aborting = false;
+        this.turnInFlight = true;
         // #252: the same «every path that starts a turn» property makes this the one
         // correct place to forget what the PREVIOUS turn did. Reset any earlier and
         // `turn_end` would report facts that had already been wiped; any later — say,
@@ -882,6 +922,29 @@ class ClaudeSession {
     rateLimitsAvailable = false;
     /** A refusal seen since the last turn ended, waiting to be reported with it. */
     limitBlockPending = false;
+    /**
+     * The wall itself, with its own clock — not a flag that one turn spends (#455).
+     *
+     * 2026-09-19, 01:29:45 UTC, run `827b4db2`, stage S2. Two turns hit the same
+     * weekly wall two seconds apart. The provider sent the refusal event on the
+     * FIRST one only; the CLI then finished the tool call it had started, ran
+     * into the same wall again, and that second turn arrived with the flag
+     * already spent. Bare, it read as an ordinary API error, matched
+     * `claude.invalid_request` and took the session — and the stage, and the run
+     * — down with it. The same night did it again to another run's stage O3.
+     *
+     * So the mark is a STATE, not a one-shot: while a window has refused and its
+     * reset is still ahead, any turn that ends on an API error is a refused turn.
+     * It comes down when its own reset passes, or when the provider says
+     * something that is not a refusal about the SAME window — an `allowed` event
+     * about the five-hour window must not take down a weekly wall.
+     *
+     * **A refusal that names no reset does not raise it.** There would be no
+     * clock to take it down, and a wall that never falls would swallow every
+     * genuine API error for the rest of the session. That case keeps today's
+     * one-shot behaviour, and #258's rule against inventing a reset stands.
+     */
+    limitWall = null;
     /**
      * The one key the window map is written under, from every source.
      *
@@ -1083,6 +1146,22 @@ class ClaudeSession {
         this.limitBlockPending = false;
         return blocked;
     }
+    /**
+     * Is a refused window still refusing? (#455)
+     *
+     * Reads its own clock and forgets itself once the reset has passed, so the
+     * caller never has to remember to. Returns the window so the feed line can
+     * say until when.
+     */
+    standingLimitWall(now = Date.now()) {
+        if (this.limitWall === null)
+            return null;
+        if (this.limitWall.until <= now) {
+            this.limitWall = null;
+            return null;
+        }
+        return this.limitWall;
+    }
     emitRateLimits(blocked = null) {
         // Signed by THIS session's account (#422 §8, S2 item 4): the windows come
         // from its own stream and from readings measured under its own home. The
@@ -1227,8 +1306,25 @@ class ClaudeSession {
                 status: typeof info['status'] === 'string' ? info['status'] : null,
             });
         }
-        if (refused)
-            this.limitBlockPending = true;
+        if (refused) {
+            // The one-shot flag keeps its old job: mark the turn that is running
+            // RIGHT NOW. It is deliberately not set between turns — a refusal with
+            // no turn around it has no ending to mark, and the flag would instead be
+            // spent by the next turn, which may be a perfectly good one after the
+            // window reopened. Codex has had this guard since #258; Claude had not.
+            //
+            if (this.turnInFlight)
+                this.limitBlockPending = true;
+            // …and the wall is what covers every turn after that one, for as long as
+            // the provider says the window is shut (#455).
+            const until = resetsAt === null ? Number.NaN : Date.parse(resetsAt);
+            if (Number.isFinite(until) && until > Date.now())
+                this.limitWall = { key, until };
+        }
+        else if (this.limitWall?.key === key) {
+            // Not a refusal, and about the very window that refused: the wall is down.
+            this.limitWall = null;
+        }
         this.emitRateLimits(refused ? { key, resetsAt } : null);
     }
     /** Fire-and-forget capability refresh — never throws into the caller. */
@@ -1797,9 +1893,36 @@ class ClaudeSession {
     beginTurnFacts() {
         this.turnFailureCode = null;
         this.turnFailureStatus = null;
+        this.turnRefusalCategory = null;
         this.turnProduced = false;
         this.turnIrreversible = false;
     }
+    /**
+     * Record a refusal by the provider's safety filter, from either frame.
+     *
+     * It does two things and no more, because #435 is a much larger ticket and
+     * this is only its first item: it gives the turn a cause of its own —
+     * `model_refusal`, ours and not the SDK's, because the SDK's closed enum has
+     * no member for this — and it keeps the category so the feed can name it and
+     * the platform can store it.
+     *
+     * The cause matters beyond the wording. Without it a refusal that named
+     * nothing else ended as `terminal_reason: 'api_error'`, which the adapter
+     * spells `server_error`, which the policy table retries FIVE times — and
+     * re-sending a request the filter already refused is the one repeat the
+     * project has written down as actively harmful to the account.
+     */
+    noteRefusal(category, explanation) {
+        this.turnRefusalCategory = category ?? 'unknown';
+        this.turnFailureCode = 'model_refusal';
+        this.emit({
+            type: 'notice',
+            level: 'warn',
+            text: `The model’s safety filter refused to answer (${this.turnRefusalCategory})` +
+                (explanation ? ` — ${maskString(explanation).slice(0, 300)}` : '') +
+                '. This is the provider’s filter, not a fault in the task or the connection.',
+        });
+    }
     /**
      * Remember a tool call as work that happened, and judge whether it can be
      * taken back.
@@ -2275,6 +2398,11 @@ class ClaudeSession {
                     this.turnClosed = false;
                     this.beginTurnFacts();
                 }
+                // #455. Deliberately NOT folded into the guard above: that one is
+                // cleared by every message, and `rate_limit_event` is a message. A
+                // refusal must not be able to open the turn it is then attached to.
+                if (msg.type !== 'result' && msg.type !== 'rate_limit_event')
+                    this.turnInFlight = true;
                 // Ticket #126: where we are in the transcript, remembered BEFORE the
                 // message is interpreted.
                 //
@@ -2326,6 +2454,37 @@ class ClaudeSession {
                                 this.emit({ type: 'compaction', phase: 'finished', ok: true });
                             }
                         }
+                        else if (msg.subtype === 'model_refusal_fallback') {
+                            /**
+                             * Another model took the turn, so the turn is not refused — and
+                             * recording the category here branded the WHOLE turn a refusal
+                             * even when the fallback answered and the turn later broke on
+                             * something else entirely (independent QA of this stage). A line
+                             * in the feed, and nothing else.
+                             */
+                            this.emit({
+                                type: 'notice',
+                                level: 'info',
+                                text: `The model’s safety filter refused (${msg.api_refusal_category ?? 'unknown'}); ` +
+                                    `${msg.fallback_model} took the turn instead.`,
+                            });
+                        }
+                        else if (msg.subtype === 'model_refusal_no_fallback') {
+                            /**
+                             * The provider's safety filter refused the answer (#435, п. 1).
+                             *
+                             * Until now this fell through to `onTaskMessage`, whose `default:
+                             * break` dropped it — so the one frame that says WHY was thrown
+                             * away and the turn ended as «the connection to the model
+                             * failed». The connection was fine in every case examined; on
+                             * the night of 2026-09-17 this machine saw seventeen of them.
+                             *
+                             * Only `…_no_fallback` is recorded as the turn's cause: it is
+                             * the one that kills the turn. Its sibling `…_fallback` is
+                             * handled one branch above and says nothing about the ending.
+                             */
+                            this.noteRefusal(msg.api_refusal_category, msg.api_refusal_explanation);
+                        }
                         else if (msg.subtype === 'api_retry') {
                             // #252. The CLI hit a retryable error and is ALREADY retrying it
                             // itself — this is telemetry, not a failure. Two jobs here, and the
@@ -2397,6 +2556,23 @@ class ClaudeSession {
                         const failure = msg.error;
                         if (typeof failure === 'string' && failure)
                             this.turnFailureCode = failure;
+                        /**
+                         * The second machine path to the same fact (#435, п. 1), and the
+                         * one that needs no cast: `msg.message` is a typed `BetaMessage`,
+                         * and `refusal` is a member of its `stop_reason` union.
+                         *
+                         * `SDKAssistantMessageError` — the enum read one line above — has
+                         * no member for a refusal, which is exactly why this frame has to
+                         * be looked at separately rather than folded into `failureCode`.
+                         */
+                        // A SUBAGENT's refusal is not the turn's ending — the Task tool
+                        // call it lives in reports its own failure and the parent turn
+                        // carries on. Branding the whole turn with it named the wrong
+                        // cause and stored the wrong reason (independent QA of this
+                        // stage). The same guard the block below uses, two lines up.
+                        if (msg.message.stop_reason === 'refusal' && !fromSubagent) {
+                            this.noteRefusal(msg.message.stop_details?.category, msg.message.stop_details?.explanation);
+                        }
                         for (const block of msg.message.content) {
                             if (block.type === 'text' && !fromSubagent && block.text.trim()) {
                                 // An API-error message is the CLI TELLING us the turn broke, not
@@ -2513,9 +2689,29 @@ class ClaudeSession {
                             this.turnClosed = false;
                             this.beginTurnFacts();
                         }
+                        // Whatever it was, it is over now (#455).
+                        this.turnInFlight = false;
                         const gaveUp = msg.subtype === 'success' && terminalReason === 'api_error';
+                        /**
+                         * #455. A turn that ended on an API error while a refused window
+                         * is still refusing IS that refusal, whether or not the provider
+                         * troubled itself to send a second event about it.
+                         *
+                         * The wall is asked only on a turn that ended on an API error —
+                         * `terminal_reason: 'api_error'`, or a cause the API's own enum
+                         * named on the assistant frame. A turn that ran out of turns, or
+                         * one the person stopped, is not a refusal and is not dressed up
+                         * as one.
+                         */
+                        const wall = gaveUp || this.turnFailureCode !== null ? this.standingLimitWall() : null;
+                        // Named only when the refusal is what ENDED the turn — the same
+                        // condition the reported category uses further down. A turn that
+                        // met a refusal and then broke on something else is not a refused
+                        // turn, and a sentence saying it was would be a new lie in place
+                        // of the old one (independent QA of this stage).
+                        const refusal = this.turnFailureCode === 'model_refusal' ? this.turnRefusalCategory : null;
                         const failure = gaveUp
-                            ? API_ERROR_TURN_MESSAGE
+                            ? apiErrorTurnMessage(wall, refusal)
                             : msg.subtype === 'success'
                                 ? ''
                                 : classifyError(msg.subtype, msg.errors);
@@ -2573,11 +2769,15 @@ class ClaudeSession {
                             this.refreshUsage();
                         }
                         else {
+                            // #455: the one-shot flag OR the standing wall. Read in this
+                            // order and both read: the flag has to be consumed either way,
+                            // or it would outlive the turn it belongs to.
+                            const markedByEvent = this.consumeLimitBlock();
                             this.emit({
                                 type: 'turn_end',
                                 ok: false,
                                 errorMessage: failure,
-                                ...(this.consumeLimitBlock() ? { limitBlocked: true } : {}),
+                                ...(markedByEvent || wall !== null ? { limitBlocked: true } : {}),
                                 // #252: the cause and the ending arrive on different messages —
                                 // the closed enum rides on the assistant message, this `result`
                                 // has no such field. Handed over so the supervisor can decide
@@ -2598,6 +2798,16 @@ class ClaudeSession {
                                     : {}),
                                 ...(this.turnProduced ? { produced: true } : {}),
                                 ...(this.turnIrreversible ? { irreversible: true } : {}),
+                                // #435 п. 1: the reason travels up. Absent means «this runner
+                                // is older than the fix» — never «no refusal».
+                                //
+                                // Tied to the CAUSE and not merely to «a refusal happened
+                                // somewhere in this turn»: if the turn went on and broke on
+                                // something else, the refusal is not why it ended, and saying
+                                // it was would store a reason that is not true.
+                                ...(this.turnRefusalCategory !== null && this.turnFailureCode === 'model_refusal'
+                                    ? { refusalCategory: this.turnRefusalCategory }
+                                    : {}),
                             });
                             this.refreshUsage();
                         }
@@ -2783,14 +2993,37 @@ function stringifyContent(content) {
     return content === undefined ? '' : JSON.stringify(content);
 }
 /**
- * What the feed says about a turn Claude Code gave up on (#406).
+ * What the feed says about a turn Claude Code gave up on (#406, rewritten for
+ * #455 on the owner's decision of 2026-09-19).
+ *
+ * It used to be one sentence for every case: «The connection to the model
+ * failed and Claude Code ended the turn on an API error». It was wrong in both
+ * cases anybody has actually looked at — a spent plan limit and a refusal by
+ * the model's safety filter — and wrong in the expensive direction: the person
+ * spends an hour looking for a network fault that is not there. The connection
+ * was in order every time.
+ *
+ * So it says what is known and stops where knowledge stops. A standing wall is
+ * named with its reset; a recognised refusal is named as a refusal; and when
+ * neither is known the sentence no longer asserts anything about the
+ * connection.
  *
- * Deliberately free of «mid-response» and «may be incomplete»: `refine()` in
- * `error-policy.ts` matches those two phrases and narrows a retry to a single
- * «carry on» attempt. Here the narrowing must come from `produced`, which is a
- * fact about the turn, and not from the wording of a sentence.
+ * Still deliberately free of «mid-response» and «may be incomplete»: `refine()`
+ * in `error-policy.ts` matches those two phrases and narrows a retry to a
+ * single «carry on» attempt. The narrowing must come from `produced`, which is
+ * a fact about the turn, and not from the wording of a sentence.
  */
-const API_ERROR_TURN_MESSAGE = 'The connection to the model failed and Claude Code ended the turn on an API error';
+function apiErrorTurnMessage(wall, refusalCategory) {
+    if (wall !== null) {
+        return ('The plan limit is spent — the provider refused this turn. It reopens at ' +
+            `${new Date(wall.until).toISOString().replace('T', ' ').slice(0, 16)} UTC.`);
+    }
+    if (refusalCategory !== null) {
+        return (`The model’s safety filter refused to answer (${refusalCategory}) and no fallback model ` +
+            'took the turn. Nothing is wrong with the connection or with the task.');
+    }
+    return 'Claude Code ended the turn on an API error.';
+}
 function classifyError(subtype, errors) {
     // Optional on purpose despite the SDK's type: a `result` without `errors`
     // threw from inside the event pump, which the loop's catch turned into a

package/dist/adapters/codex.js

@@ -1529,6 +1529,11 @@ class CodexSession {
                 // agent that would refuse every turn with the same credential.
                 if (this.endedOnAuthFailure(str(detail['message']) ?? ''))
                     return;
+                // #446. A provider body with a machine-readable cause ends the TURN,
+                // which is the one door the retry policy stands behind. Everything
+                // else keeps going the old way — straight to a failed session.
+                if (this.endedOnProviderApiError(detail))
+                    return;
                 this.classifyAndEmitFailure(new Error(str(detail['message']) ?? 'Codex reported an error'));
                 return;
             }
@@ -2035,6 +2040,74 @@ class CodexSession {
      * the same sentence printed itself once per refusal — eight times in the
      * feed of the session this was found on.
      */
+    /**
+     * The provider rejected the request outright, and said so in a body we can
+     * READ (#446).
+     *
+     * 2026-09-18, 20:27:44 UTC: OpenAI answered a turn with
+     * `{"error":{"code":"unsupported_parameter","param":"access_programs.cyber"},
+     * "status":400}` and the session died with the raw JSON in the feed, the
+     * stage stopped as «unknown», and a run with three stages left went to
+     * NEEDS_YOU. Nothing in this repository asks for that parameter — the CLI
+     * adds it — and the same account, machine and model ran fifteen other
+     * sessions that day without it.
+     *
+     * Two things had to change and this is the first. The machine cause never
+     * reached the policy: this notification rebuilt the failure as
+     * `new Error(detail.message)` and `classifyAndEmitFailure` threw everything
+     * but the sentence away, so `classifyFailure` saw «no code» and answered
+     * `stop` — which is the right answer to «no code» and the wrong one here.
+     *
+     * **Why this ends the TURN rather than calling the policy from here.** The
+     * `error` branch is a dead end for retry by construction: `armApiRetry` has
+     * exactly one call site, in `turn_end`, and with it live all the guards that
+     * make an automatic retry safe — the session-wide ceiling, the open-card
+     * check, the «same failure twice» rule, one counter, one feed line. A second
+     * entrance next to it would be a second set of all of them. The machinery
+     * for ending a turn from this notification already exists a few lines below,
+     * where the limit refusal uses it, down to remembering the id so Codex's own
+     * late ending is not counted twice.
+     *
+     * Returns false whenever there is nothing readable, or no turn to end — and
+     * then the old path runs exactly as before.
+     */
+    endedOnProviderApiError(detail) {
+        const api = readProviderApiError(detail);
+        if (api === null)
+            return false;
+        if (this.activeTurnId === null)
+            return false;
+        const turnId = this.activeTurnId;
+        this.selfSettledTurnId = turnId;
+        this.activeTurnId = null;
+        this.subagents.endTurn();
+        const detailMessage = str(detail['message']);
+        this.emit({
+            type: 'turn_end',
+            ok: false,
+            // «This REQUEST», not «this turn»: the turn may well have run tools —
+            // the incident's had committed a second earlier, and the same event
+            // carries `produced` and `irreversible` to say so. Saying the turn did
+            // nothing would be the same false statement this ticket exists to
+            // remove, pointing the other way (independent QA of this stage).
+            errorMessage: maskString(`The provider rejected the request outright (${api.code}` +
+                `${api.param === undefined ? '' : `, ${api.param}`}). Nothing of this request reached ` +
+                `a model.${api.message === undefined ? '' : ` Provider: ${api.message}`}`).slice(0, 500),
+            failureCode: providerApiFailureCode(api),
+            ...(api.status !== undefined ? { failureStatus: api.status } : {}),
+            ...(this.consumeLimitBlock() ? { limitBlocked: true } : {}),
+            ...(this.turnProduced ? { produced: true } : {}),
+            ...(this.turnIrreversible ? { irreversible: true } : {}),
+        });
+        log.info('codex: provider rejected the request', {
+            sessionId: this.spec.sessionId,
+            code: api.code,
+            param: api.param ?? null,
+            status: api.status ?? null,
+            raw: detailMessage === undefined ? null : maskString(detailMessage).slice(0, 200),
+        });
+        return true;
+    }
     noteRateLimitRefusal(error) {
         if (!this.announceRateLimitRefusal(error))
             return false;
@@ -2177,12 +2250,33 @@ class CodexSession {
             // `responseStreamConnectionFailed`, `contextWindowExceeded`, …) and it is
             // the ONLY thing allowed to open the door to an automatic retry — the
             // message next to it is prose, and prose can be written by agents.
-            const failureCode = str(error['codexErrorInfo']);
-            const failureStatus = error['httpStatusCode'];
+            // #446. The provider's OWN body, when the turn failure carries one: a
+            // code from the API's dictionary, kept apart from Codex's by its `api:`
+            // prefix, so a rule can be about one without ever matching the other.
+            // Codex's own code wins when both are there — it is the more specific
+            // statement about what happened, and the table is written around it.
+            const api = readProviderApiError(error);
+            const failureCode = str(error['codexErrorInfo']) ?? (api === null ? undefined : providerApiFailureCode(api));
+            const rawStatus = error['httpStatusCode'];
+            const failureStatus = typeof rawStatus === 'number' ? rawStatus : api?.status;
+            /**
+             * #435, first item, the Codex half — so the platform says ONE thing
+             * about one event whichever agent met it.
+             *
+             * `cyberPolicy` is Codex's word for «the content filter refused», the
+             * same class of event as Claude's `stop_reason: 'refusal'`. It stays
+             * `retry: false` and the session still ends FAILED; what changes is that
+             * the reason now travels, instead of the platform calling a content
+             * refusal a broken connection.
+             */
+            const refusalCategory = failureCode === 'cyberPolicy' ? 'cyber' : null;
             this.emit({
                 type: 'turn_end',
                 ok: false,
-                errorMessage: maskString(str(error['message']) ?? 'The Codex turn failed').slice(0, 500),
+                errorMessage: maskString(refusalCategory === null
+                    ? (str(error['message']) ?? 'The Codex turn failed')
+                    : 'The model’s safety filter refused to answer (cyber). This is the provider’s ' +
+                        'filter, not a fault in the task or the connection.').slice(0, 500),
                 // Without this the session goes FAILED — terminal — and the pause armed
                 // one line earlier would ring into a dead row and throw the person's
                 // queued words away instead of sending them.
@@ -2191,6 +2285,7 @@ class CodexSession {
                 ...(typeof failureStatus === 'number' ? { failureStatus } : {}),
                 ...(this.turnProduced ? { produced: true } : {}),
                 ...(this.turnIrreversible ? { irreversible: true } : {}),
+                ...(refusalCategory !== null ? { refusalCategory } : {}),
             });
             return;
         }
@@ -2701,6 +2796,74 @@ export function isAuthError(message) {
 function describe(error) {
     return String(error instanceof Error ? error.message : error);
 }
+/**
+ * Read `{"error":{"code":…,"param":…},"status":…}` out of a notification.
+ *
+ * **Parsed as data, not matched as prose**, and the difference is the whole
+ * point: `error-policy.ts` forbids deciding anything from a sentence, because
+ * an agent's own output travels in the same stream and a report quoting a
+ * provider's error would otherwise be able to fire a rule. JSON.parse is not
+ * pattern matching — either the body is a structure with a `code` field in it
+ * or this returns null and nothing happens.
+ *
+ * Two shapes, because the body arrives either way depending on how far up the
+ * CLI wrapped it: as the notification's own record, or as JSON inside its
+ * `message` string. The nested `error` object is required — a bare top-level
+ * `code` on a Codex notification is Codex's OWN vocabulary
+ * (`codexErrorInfo`), and mixing the two dictionaries is the thing #446 п. 3
+ * asked not to do.
+ */
+function readProviderApiError(root) {
+    const fromRecord = (value) => {
+        const inner = asRecord(asRecord(value)['error']);
+        const code = str(inner['code']);
+        if (code === undefined || code === '')
+            return null;
+        const param = str(inner['param']);
+        const raw = asRecord(value)['status'] ?? inner['status'] ?? asRecord(value)['httpStatusCode'];
+        const status = typeof raw === 'number' ? raw : undefined;
+        const message = str(inner['message']);
+        return {
+            code,
+            ...(param === undefined ? {} : { param }),
+            ...(status === undefined ? {} : { status }),
+            ...(message === undefined ? {} : { message }),
+        };
+    };
+    const direct = fromRecord(root);
+    if (direct !== null)
+        return direct;
+    const text = str(asRecord(root)['message']);
+    if (text === undefined)
+        return null;
+    // The body is sometimes wrapped in a sentence («stream error: {…}»), so the
+    // braces are located rather than assumed to be the whole string. Bounded by
+    // the first `{` and the last `}`: anything else is not a body.
+    const start = text.indexOf('{');
+    const end = text.lastIndexOf('}');
+    if (start === -1 || end <= start)
+        return null;
+    try {
+        return fromRecord(JSON.parse(text.slice(start, end + 1)));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The code a rule can match, with the provider's dictionary kept apart from
+ * Codex's own (#446 п. 3).
+ *
+ * `api:` is the prefix, so `unsupported_parameter` can never be confused with
+ * a `codexErrorInfo` member. The parameter's FIRST segment rides along when
+ * there is one, so a rule can be about `access_programs` without being about
+ * every `unsupported_parameter` there will ever be — and without being tied to
+ * the exact sub-name (`access_programs.cyber`) the CLI happened to send.
+ */
+function providerApiFailureCode(api) {
+    const family = api.param === undefined ? '' : `:${api.param.split('.')[0] ?? api.param}`;
+    return `api:${api.code}${family}`;
+}
 /**
  * "The thread you asked for is not there." Matched on the message and not on an
  * error class, because the same condition arrives as an RPC error or as a

package/dist/adapters/error-policy.d.ts

@@ -76,6 +76,17 @@ export interface ErrorRule {
     bucket?: Exclude<RetryBucket, 'stop'>;
     attempts?: number;
     backoff?: BackoffProfile;
+    /**
+     * The provider threw the whole request away — nothing of it reached a model.
+     *
+     * Changes nothing about WHETHER we carry on; it changes what we SAY when we
+     * do. The default sentence tells the agent its answer was cut off part-way
+     * and to check what it had already finished — true for a dropped stream,
+     * false and expensive here: the agent goes looking for half-done work that
+     * does not exist, and the feed tells the person the connection failed when
+     * it did not (#446 п. 6, #455 owner's decision of 2026-09-19).
+     */
+    refusedWhole?: boolean;
     /**
      * `false` → the row is INERT: counted, never acted on.
      *
@@ -122,6 +133,12 @@ export interface RetryDecision {
     backoff: BackoffProfile;
     /** Which row decided, or `null` when nothing matched and the default applied. */
     ruleId: string | null;
+    /**
+     * The provider threw the whole request away — so whatever we say next must
+     * not talk about a connection or about half-finished work. See
+     * `ErrorRule.refusedWhole`.
+     */
+    refusedWhole: boolean;
 }
 /**
  * What may this failure do next?