* fix(codex): surface gateway auth failures instead of a silent 600s stall
When the codex SDK head can't authenticate to its model gateway, the codex
CLI retries silently and emits no turn events, so the turn stalled to the 600s
idle watchdog and died with a generic "wedged LLM or tool call" message — even
though the real cause (a 401/403 on the CLI's stderr) was in hand the whole
time.
Parse the CLI's ``unexpected status <code> ... url:`` stderr line and:
- Attribute it: record the parsed cause into the shared idle-watchdog failure
slot the scaffold already reads, so a stalled turn surfaces the real gateway
error rather than the generic reason. Adds a general record_transport_failure
alongside the native forwarder's record_post_failure — no scaffold change.
- Fail fast: an auth-class (401/403) rejection arms a fast-fail once the CLI
has also exhausted its own retry budget (a final Reconnecting N/N), so the
turn ends in seconds with a retryable=False ExecutorError naming the status,
model, and url — instead of riding the full idle watchdog. Both signals are
tracked independently (either arrival order), so a blip the CLI recovers from
never kills a healthy turn. The idle wait polls on a shorter interval to act
on the signal promptly; the 600s warn window and its cadence are unchanged.
Co-authored-by: Isaac
Signed-off-by: manffred-calvosanchez_data <manffred.calvosanchez@databricks.com>
* fix(codex): reserve auth hint for auth failures
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* fix(codex): interrupt fast-failed auth turns
Signed-off-by: dbczumar <corey.zumar@databricks.com>
* test(codex): cover gateway auth fast-fail e2e
Signed-off-by: dbczumar <corey.zumar@databricks.com>
---------
Signed-off-by: manffred-calvosanchez_data <manffred.calvosanchez@databricks.com>
Signed-off-by: dbczumar <corey.zumar@databricks.com>
Co-authored-by: dbczumar <corey.zumar@databricks.com>
Manfred Calvo
9a3d4dea54