fix(broker): bound broker handshake so a wedged broker can't hang the client (closes #29) - #30

…-review critical)

Codex adversarial review caught that `error.code = REQUEST_TIMEOUT_CODE` on a
plain `new Error(...)` fails the repo's mandatory `npm run build`
(TS2339: Property 'code' does not exist on type 'Error'). CI runs this build,
so the head could not pass its shipping gate. The same pre-existing breakage
in BrokerCodexAppServerClient's handshakeError (landed in #30) is fixed too.

Cast the errors to ProtocolError (extended to include `code?: string`), the
same pattern createProtocolError already uses.

Co-Authored-By: Claude <[email protected]>

… hang the client (closes #31) (#32)

* fix(app-server): bound request() so a wedged spawned app-server can't hang the client (closes #31)

SpawnedCodexAppServerClient.initialize had the same unbounded handshake shape
PR #30 fixed only on the broker path: request("initialize") had no deadline,
so a spawned codex app-server that accepted stdin but never answered hung the
client forever. RED-first: a stalled-initialize fake-codex behavior reproduces
the hang (connect() never settles within 2s).

Deeper fix (as promised in #31 / upstream openai#509), not a third copy of the
bounded-handshake pattern:

- AppServerClientBase.request(method, params, options) gains an optional
  timeoutMs (+ onTimeout for transport cleanup). Optional/undefined-default, so
  all existing 2-arg call sites are unchanged. Timer is unref'd, cleared in
  handleLine/handleExit. Timeout rejects with BROKER_HANDSHAKE_TIMEOUT_CODE and
  removes the pending entry; a late answer for that id is a no-op in handleLine.
- SpawnedCodexAppServerClient.initialize now passes timeoutMs (10s default,
  spawnedInitializeTimeoutMs override), and kills the child on handshake
  failure so a timeout doesn't orphan the spawned process.
- BrokerCodexAppServerClient.initialize drops its inline Promise.race and uses
  request(timeoutMs, onTimeout=socket.destroy) — one mechanism, both transports.
- CodexAppServerClient.connect tags broker-transport init failures with
  brokerFatal; withAppServer's fallback OR-chain collapses to
  (broker-busy) || (brokerFatal).

Verified: RED→GREEN (304ms, EBROKERTIMEOUT); broker suite 11/11 green; npm test
unchanged (4 pre-existing failures).

Co-Authored-By: Claude <[email protected]>

* fix(broker): restore post-handshake broker/busy direct fallback (cycle-review critical)

Codex adversarial review caught that collapsing withAppServer's fallback onto
error.transport broke the #29 path: broker/busy (-32001) arrives AFTER a
successful handshake, while the error is created by createProtocolError with
rpcCode but NO transport (transport is tagged only on handshake failure in
connect()'s catch). So every overlapping /codex:* command failed for the
duration of a long-running broker turn instead of falling back to direct.

Restore client?.transport === "broker" for the busy branch (post-handshake,
client is assigned); keep error.brokerFatal for handshake failures (client is
null, tagged in connect). Adds spawnBusyBroker helper + an end-to-end test
that drives a successful initialize, then -32001 on the first RPC, and
verifies the operation completes via the direct fallback.

Co-Authored-By: Claude <[email protected]>

* fix(app-server): make timeout-error code assignments type-safe (cycle-review critical)

Codex adversarial review caught that `error.code = REQUEST_TIMEOUT_CODE` on a
plain `new Error(...)` fails the repo's mandatory `npm run build`
(TS2339: Property 'code' does not exist on type 'Error'). CI runs this build,
so the head could not pass its shipping gate. The same pre-existing breakage
in BrokerCodexAppServerClient's handshakeError (landed in #30) is fixed too.

Cast the errors to ProtocolError (extended to include `code?: string`), the
same pattern createProtocolError already uses.

Co-Authored-By: Claude <[email protected]>

---------

Co-authored-by: axisrow <[email protected]>
Co-authored-by: Claude <[email protected]>

Ships accumulated fixes since fork.4:
- #29 broker-busy hang (PR #30): bound broker handshake
- #31 spawned-app-server handshake (PR #32): bound request() primitive
- openai#508 config-driven sandbox + --read-only (PR #33) + resume-sandbox fail-closed
- #34 model/effort in /codex:rescue launch line (PR #35)
- #28 turn-timeout gaps (already in fork.4 base)

Co-Authored-By: Claude <[email protected]>