fix(stream): retry pre-output TLS close_notify EOF and abort thinking-only streams on transient drops

src/providers/codex/client.rs

@@ -3046,6 +3046,10 @@ fn is_retryable_transport_error(err: &CodexError) -> bool {
         || message.contains("transport error")
         || message.contains("connection reset")
         || message.contains("connection closed")
+        || message.contains("peer closed connection")
+        || message.contains("close_notify")
+        || message.contains("unexpected eof")
+        || message.contains("unexpected-eof")
         || message.contains("timed out")
         || message.contains("econnreset")
         || message.contains("etimedout")
@@ -3060,6 +3064,10 @@ fn is_retryable_reqwest_error(err: &reqwest::Error) -> bool {
     let msg = err.to_string().to_lowercase();
     msg.contains("connection reset")
         || msg.contains("connection closed")
+        || msg.contains("peer closed connection")
+        || msg.contains("close_notify")
+        || msg.contains("unexpected eof")
+        || msg.contains("unexpected-eof")
         || msg.contains("econnreset")
         || msg.contains("etimedout")
         || msg.contains("epipe")
@@ -5692,6 +5700,20 @@ mod tests {
         assert!(!should_retry_without_continuation(&timeout, None));
     }
 
+    #[test]
+    fn statusless_tls_close_notify_unexpected_eof_is_retryable() {
+        let err = CodexError {
+            status: 0,
+            message: "WebSocket stream error: IO error: peer closed connection without sending TLS close_notify: https://docs.rs/rustls/latest/rustls/manual/_03_howto/index.html#unexpected-eof".to_string(),
+            detail: None,
+            retry_after: None,
+            usage_limit: None,
+            origin: CodexErrorOrigin::WebSocket,
+        };
+        assert!(is_retryable_transport_error(&err));
+        assert!(super::super::events::retryable_message(&err.message));
+    }
+
     #[tokio::test]
     async fn http_request_compression_gzip_encodes_body_and_preserves_traffic_capture() {
         use std::io::Read;

src/providers/codex/events.rs

@@ -189,17 +189,16 @@ pub(crate) fn classify_event_failure(payload: &Value) -> Option<CodexEventFailur
         || lower.contains("context window")
         || lower.contains("context length exceeded");
 
+    let policy_violation = code.is_some_and(|c| {
+        matches!(c, "cyber_policy" | "invalid_prompt" | "bio_policy")
+            || c.ends_with("_policy")
+            || c.ends_with("_policy_violation")
+    });
     let kind = if context_window
+        || policy_violation
         || matches!(
             code,
-            Some(
-                "context_length_exceeded"
-                    | "insufficient_quota"
-                    | "usage_not_included"
-                    | "cyber_policy"
-                    | "invalid_prompt"
-                    | "bio_policy"
-            )
+            Some("context_length_exceeded" | "insufficient_quota" | "usage_not_included")
         ) {
         CodexFailureKind::Permanent
     } else if matches!(code, Some("server_is_overloaded" | "slow_down")) {
@@ -235,7 +234,7 @@ pub(crate) fn classify_event_failure(payload: &Value) -> Option<CodexEventFailur
         413
     } else {
         explicit_status.unwrap_or(match code {
-            Some("cyber_policy" | "invalid_prompt" | "bio_policy") => 400,
+            _ if policy_violation => 400,
             Some("insufficient_quota") => 429,
             Some("usage_not_included") => 403,
             _ => match kind {
@@ -549,7 +548,7 @@ fn scalar_string_value(value: &Value) -> Option<String> {
     }
 }
 
-fn retryable_message(message: &str) -> bool {
+pub(super) fn retryable_message(message: &str) -> bool {
     [
         "server error",
         "internal server error",
@@ -570,7 +569,10 @@ fn retryable_message(message: &str) -> bool {
         "etimedout",
         "und_err_socket",
         "fetch failed",
+        "peer closed connection",
+        "close_notify",
         "unexpected eof",
+        "unexpected-eof",
     ]
     .iter()
     .any(|needle| message.contains(needle))