Summary

• add child.stdout.on("error", ...) and child.stderr.on("error", ...) to the runCodexExecResume child-spawn path so a parent-side pipe break on either Readable is routed into the same rejection the existing child.on("error", reject) path already handles, instead of escaping as an unhandled error event
• add two regression tests that drive the real production code path against a real Node child spawned via process.execPath --eval, with the spawn wrapper capturing the real ChildProcess reference and emitting a synthetic error on the real parent-side stdout / stderr readable

Why this change is needed

runCodexExecResume (extensions/codex/src/node-cli-sessions.ts:252) spawns the Codex CLI with stdio: ["pipe", "pipe", "pipe"] and registers a data handler on stdout and stderr, but neither stream has its own error handler. Node's EventEmitter contract is that an error event on a stream without a registered listener becomes an uncaughtException that crashes the gateway. On a real production teardown — the parent process exiting, the kernel resetting the pipe, the child being SIGKILLed mid-write — that contract fires and takes the gateway down.

This is the same pattern that Alix-007 fixed in #101596 (google-meet realtime) and #101597 (matrix deps) for sibling surfaces, and the same pattern that sunlit-deng fixed in #101777 for the Codex sandbox-exec-server subprocesses. This PR covers the parallel Codex node-cli-sessions surface that runs the codex exec resume CLI invocation.

The Codex app-server transport at extensions/codex/src/app-server/transport-stdio.ts:116 already routes stream errors through the CodexAppServerClient constructor (stdout at client.ts:145, stderr at client.ts:158, stdin EPIPE guard at client.ts:171), so that surface is covered and out of scope for this PR.

Verification

• node scripts/run-vitest.mjs extensions/codex/src/node-cli-sessions.test.ts — passed; 1 file, 9 tests (7 pre-existing + 2 new real-spawn stream-error tests)
• ./node_modules/.bin/oxfmt --check --threads=1 extensions/codex/src/node-cli-sessions.ts extensions/codex/src/node-cli-sessions.test.ts — all files correctly formatted
• ./node_modules/.bin/oxlint --tsconfig config/tsconfig/oxlint.extensions.json extensions/codex/src/node-cli-sessions.ts extensions/codex/src/node-cli-sessions.test.ts — no findings
• pnpm tsgo:extensions — passed
• pnpm tsgo:extensions:test — passed (test-typecheck gap is not bypassed)
• mutation check: renaming the new child.stdout?.on?.("error", ...) block to listen for "Xerror" instead of "error" makes the new rejects with the synthetic stream error when the child stdout pipe fails mid-run test fail with synthetic parent stdout read failure not being thrown; restoring the block makes the test pass. Renaming the stderr listener has the symmetric effect on the stderr test.

Evidence

The full preflight output (lint, format, typecheck, test) for this PR is captured in the per-step sections below. The decisive evidence is in ## Real behavior proof — the real child process spawned via process.execPath --eval and the synthetic parent-side stream error that the fix catches.

Real behavior proof

Behavior addressed: codex node-cli-sessions runCodexExecResume child stdout/stderr pipe errors no longer leak as unhandled error events. The new child.stdout.on("error", ...) and child.stderr.on("error", ...) listeners call reject(...) on the surrounding new Promise<number | null> that already hosts child.on("error", reject), so the existing runCodexExecResume failure path (and the upstream codex.cli.session.resume command handler) propagates a clear Error("synthetic parent stdout read failure") (or the stderr variant) to the caller instead of crashing the gateway with an unhandled error event.

Real environment tested: local Linux Node 22.22 source checkout. The new regression tests wrap the real node:child_process spawn (via vi.doMock + vi.importActual) and substitute the spawned command with process.execPath --eval running a long-lived script that calls process.stdin.resume(), writes a ready\n marker to stderr, and then idles. This produces a real Node child with the production stdio: ["pipe", "pipe", "pipe"] shape and real parent-side Readable streams. The wrapper records the real ChildProcess in a captured array; the test then emit("error", new Error("synthetic parent stdout read failure")) (or the stderr variant) on the real parent-side readable and asserts the surrounding handlePromise rejects with that exact error message.

Exact steps or command run after this patch:

• node scripts/run-vitest.mjs extensions/codex/src/node-cli-sessions.test.ts --reporter=verbose — full file passes, 9 tests:
  • runCodexExecResume stream error handling > rejects with the synthetic stream error when the child stdout pipe fails mid-run (~170 ms)
  • runCodexExecResume stream error handling > rejects with the synthetic stream error when the child stderr pipe fails mid-run (~180 ms)

Evidence after fix (output of the verbose test run):

✓ |extension-codex| extensions/codex/src/node-cli-sessions.test.ts > runCodexExecResume stream error handling > rejects with the synthetic stream error when the child stdout pipe fails mid-run 168ms
✓ |extension-codex| extensions/codex/src/node-cli-sessions.test.ts > runCodexExecResume stream error handling > rejects with the synthetic stream error when the child stderr pipe fails mid-run 178ms

Test Files  1 passed (1)
     Tests  9 passed (9)

The stdout-pipe test asserts:

• await expect(handlePromise).rejects.toThrow("synthetic parent stdout read failure")
• The promise comes from the production runCodexExecResume after it has spawned a real Node child via process.execPath --eval and attached the stream-error handler in this PR
• The capture wrapper around spawn returns the real ChildProcess and the test emits a synthetic error on the real child.stdout readable

The stderr-pipe test is the same shape, but emits the error on the stderr readable instead of stdout.

Observed result after fix: the previously unhandled child.stdout.on("error", ...) and child.stderr.on("error", ...) paths are now caught inside the existing runCodexExecResume promise contract. The error reaches the upstream codex.cli.session.resume command handler through the existing child.on("error", reject) rejection, which the calling command then surfaces to the gateway as a normal rejected command outcome — no unhandled error event, no gateway crash.

What was not tested: a real OS-level EPIPE or RST triggered by a parent process being SIGKILLed externally. Local Linux Node child processes do not always surface that condition as a stream error event in the test environment, so the regression test exercises the simpler error event contract directly. The pattern is identical to what Alix-007 used in #101597 (matrix deps MERGED 2026-07-08) and sunlit-deng used in #101777 (codex sandbox-exec-server subprocesses, OPEN, 🐚 ready for maintainer look) — those PRs also rely on a synthetic error event for their regression tests, not a kernel-level RST. The Codex app-server transport at extensions/codex/src/app-server/transport-stdio.ts:116 is a different long-lived spawn that already has full stream-error coverage in the CodexAppServerClient constructor; it is intentionally out of scope for this PR.

Campaign coordination

This PR is part of the active stream-error campaign wave in 2026-07:

• MERGED: fix(voice-call): handle tunnel child stream errors and stop-after-exit hang #101394 voice-call tunnel (cxbAsDev), fix(memory-host-sdk): handle stdout/stderr stream errors in runCliCommand #101402 memory-host-sdk, fix(matrix): handle stdout/stderr stream errors in dependency commands #101597 matrix deps (Alix-007), fix(google-meet): handle stdout/stderr stream errors in local audio bridge #101596 google-meet realtime (Alix-007)
• OPEN: fix(microsoft-foundry): handle stdout/stderr stream errors in az login #101598 microsoft-foundry az login (Alix-007), fix(codex-supervisor): handle stdout/stderr stream errors in stdio transport #101599 codex-supervisor stdio (Alix-007), fix(acpx): handle target stdout stream errors #101846 acpx mcp-proxy (qingminglong), fix(codex): suppress stdout/stderr stream errors in sandbox subprocesses #101777 codex sandbox-exec-server subprocesses (sunlit-deng), fix(browser): bound Chrome launch stderr diagnostics #101506 browser chrome stderr (mikasa0818), fix(qa-lab): handle stdout/stderr stream errors in gateway child spawns #102104 qa-lab gateway-child (this author, re-review pending), fix(google-meet): handle stdout/stderr stream errors in node host #102105 google-meet node-host (this author, re-review pending)

Collision check: no open PR found for extensions/codex/src/node-cli-sessions.ts or for the runCodexExecResume stream-error issue. Verified via gh pr list --state all --search "node-cli-sessions" --json number,title,state and file-level gh pr list --state all --search "runCodexExecResume" --json number,title,state; the only fuzzy hits are unrelated test-infra PRs.