fix(codex): settle stream error only after child exits to preserve session guard lifecycle

wangmiao0668000666 · wangmiao0668000666 · commit bda9070a7912 · 2026-07-08T21:18:32.000+08:00
diff --git a/extensions/codex/src/node-cli-sessions.test.ts b/extensions/codex/src/node-cli-sessions.test.ts
@@ -327,6 +327,7 @@ describe("runCodexExecResume stream error handling", () => {
       child?.stdout?.emit("error", new Error("synthetic parent stdout read failure"));
       await expect(handlePromise).rejects.toThrow("synthetic parent stdout read failure");
       expect(child?.killed).toBe(true);
+      expect(child?.exitCode !== null || child?.signalCode !== null).toBe(true);
     } finally {
       vi.doUnmock("node:child_process");
       vi.resetModules();
@@ -355,6 +356,7 @@ describe("runCodexExecResume stream error handling", () => {
       child?.stderr?.emit("error", new Error("synthetic parent stderr read failure"));
       await expect(handlePromise).rejects.toThrow("synthetic parent stderr read failure");
       expect(child?.killed).toBe(true);
+      expect(child?.exitCode !== null || child?.signalCode !== null).toBe(true);
     } finally {
       vi.doUnmock("node:child_process");
       vi.resetModules();
diff --git a/extensions/codex/src/node-cli-sessions.ts b/extensions/codex/src/node-cli-sessions.ts
@@ -294,21 +294,23 @@ async function runCodexExecResume(params: {
     child.stdout.on("data", (chunk: Buffer) => stdout.push(chunk));
     child.stderr.on("data", (chunk: Buffer) => stderr.push(chunk));
     child.stdin.end(params.prompt);
+    let streamError: Error | undefined;
     const exitCode = await new Promise<number | null>((resolve, reject) => {
       child.on("error", reject);
       child.on("exit", (code) => resolve(code));
       // Guard against unhandled EPIPE / read-failure errors on the parent-side
       // stdout/stderr Readable. When the child terminates abruptly the pipe
       // can break before the "exit" event fires, so the stream layer emits
       // an asynchronous "error" that would otherwise crash the gateway.
+      // Unlike the earlier pattern of rejecting immediately, we record the
+      // error and wait for the child to exit via the existing exit-listener so
+      // the caller's active-session guard is not released while the child
+      // process is still running.
       const routeStreamError = (error: unknown) => {
-        // Kill the child before surfacing the stream error so the caller's
-        // active-session guard is not released while the child is still running
-        // and the process does not become orphaned.
+        streamError = error instanceof Error ? error : new Error(String(error));
         child.kill("SIGTERM");
         const sigkill = setTimeout(() => child.kill("SIGKILL"), 2_000);
         sigkill.unref();
-        reject(error instanceof Error ? error : new Error(String(error)));
       };
       child.stdout?.on?.("error", routeStreamError);
       child.stderr?.on?.("error", routeStreamError);
@@ -318,6 +320,9 @@ async function runCodexExecResume(params: {
         clearTimeout(forceKillTimeout);
       }
     });
+    if (streamError) {
+      throw streamError;
+    }
     if (timedOut) {
       throw new Error(`codex exec resume timed out after ${String(params.timeoutMs)}ms`);
     }
