fix(proxy): reconcile continuity stack integration

.github/scripts/detect_changed_areas.py

@@ -82,6 +82,8 @@ def _pull_request_files(event: dict[str, Any]) -> list[str]:
         try:
             payload, link = request_json(url)
         except GitHubApiError as exc:
+            if not exc.transient:
+                raise SystemExit(f"GitHub PR files request failed: {exc}") from exc
             print(
                 f"warning: GitHub PR files request failed after retries; falling back to the full CI suite: {exc}",
                 flush=True,
@@ -98,6 +100,9 @@ def _pull_request_files(event: dict[str, Any]) -> list[str]:
         for item in payload:
             if isinstance(item, dict) and isinstance(item.get("filename"), str):
                 files.append(item["filename"])
+                previous_filename = item.get("previous_filename")
+                if isinstance(previous_filename, str):
+                    files.append(previous_filename)
         url = next_link(link)
     return files
 

.github/scripts/fetch_pr_labels.py

@@ -26,13 +26,7 @@ def main() -> int:
         try:
             payload, link = request_json(url, token=os.environ.get("GH_TOKEN") or os.environ.get("GITHUB_TOKEN"))
         except GitHubApiError as exc:
-            print(
-                f"warning: GitHub PR labels request failed after retries; continuing without override labels: {exc}",
-                file=sys.stderr,
-                flush=True,
-            )
-            labels.clear()
-            break
+            raise SystemExit(f"GitHub PR labels request failed after retries: {exc}") from exc
         if not isinstance(payload, list):
             raise SystemExit(f"GitHub PR labels request returned {type(payload).__name__}, expected list")
         labels.extend(item["name"] for item in payload if isinstance(item, dict) and isinstance(item.get("name"), str))

.github/scripts/github_api.py

@@ -16,20 +16,67 @@
 from collections.abc import Callable
 from typing import Any
 
-RETRY_STATUS_CODES = {429, 500, 502, 503, 504}
+RETRY_STATUS_CODES = {500, 502, 503, 504}
+RATE_LIMIT_STATUS_CODES = {403, 429}
 DEFAULT_ATTEMPTS = 5
 DEFAULT_BASE_DELAY_SECONDS = 2.0
 DEFAULT_TIMEOUT_SECONDS = 30.0
+RATE_LIMIT_DETAIL_MARKERS = (
+    "api rate limit exceeded",
+    "rate limit exceeded",
+    "secondary rate limit",
+    "abuse detection mechanism",
+)
 
 
 class GitHubApiError(RuntimeError):
-    """Raised when a GitHub API request fails after retries."""
+    """Raised when a GitHub API request fails."""
+
+    def __init__(self, message: str, *, transient: bool = True) -> None:
+        super().__init__(message)
+        self.transient = transient
+
+
+def _is_rate_limit_http_error(exc: urllib.error.HTTPError, detail: str) -> bool:
+    if exc.code not in RATE_LIMIT_STATUS_CODES:
+        return False
+    if exc.code == 429:
+        return True
+    headers = exc.headers
+    retry_after = headers.get("Retry-After")
+    rate_remaining = headers.get("X-RateLimit-Remaining")
+    rate_reset = headers.get("X-RateLimit-Reset")
+    if retry_after or (rate_remaining == "0" and rate_reset):
+        return True
+    try:
+        payload = json.loads(detail)
+    except json.JSONDecodeError:
+        payload = {}
+    message = payload.get("message") if isinstance(payload, dict) else None
+    if not isinstance(message, str):
+        return False
+    message = message.lower()
+    return "rate limit" in message or "abuse detection" in message
 
 
 def _retry_delay(attempt_index: int, base_delay_seconds: float) -> float:
     return min(base_delay_seconds * (2**attempt_index), 30.0)
 
 
+def _is_transient_http_error(exc: urllib.error.HTTPError, detail: str) -> bool:
+    if exc.code in RETRY_STATUS_CODES:
+        return True
+    if _is_rate_limit_http_error(exc, detail):
+        return True
+    if exc.code != 403:
+        return False
+    remaining = exc.headers.get("x-ratelimit-remaining") if exc.headers is not None else None
+    if remaining == "0":
+        return True
+    normalized_detail = detail.lower()
+    return any(marker in normalized_detail for marker in RATE_LIMIT_DETAIL_MARKERS)
+
+
 def request_json(
     url: str,
     *,
@@ -57,12 +104,13 @@ def request_json(
         except urllib.error.HTTPError as exc:
             detail = exc.read().decode("utf-8", errors="replace")
             last_error = f"HTTP {exc.code}: {detail[:500]}"
-            if exc.code not in RETRY_STATUS_CODES or attempt_index + 1 >= attempts:
-                raise GitHubApiError(last_error) from exc
+            transient = _is_transient_http_error(exc, detail)
+            if not transient or attempt_index + 1 >= attempts:
+                raise GitHubApiError(last_error, transient=transient) from exc
         except (urllib.error.URLError, TimeoutError, json.JSONDecodeError) as exc:
             last_error = str(exc)
             if attempt_index + 1 >= attempts:
-                raise GitHubApiError(last_error) from exc
+                raise GitHubApiError(last_error, transient=True) from exc
 
         delay = _retry_delay(attempt_index, base_delay_seconds)
         print(

app/core/clients/codex.py

@@ -272,10 +272,7 @@ async def open_ws_with_route_metadata(
                         failure_phase="connect",
                         # No response.create frame can be delivered before the
                         # websocket open returns to its caller.
-                        retryable_same_contract=is_process_network_failure(
-                            exc,
-                            include_permanent_dns=False,
-                        ),
+                        retryable_same_contract=is_pre_dispatch_connection_failure(exc),
                     ) from None
         raise RuntimeError("unreachable Codex client websocket fallback state")
 

app/core/clients/proxy.py

@@ -3175,6 +3175,17 @@ async def _stream_via_http_after_websocket_rejection(
                 retryable_same_contract=True,
                 failed_session=None,
             ) from exc
+        if raise_for_status and exc.retryable_same_contract:
+            raise ProxyResponseError(
+                exc.status_code or 502,
+                openai_error(routed_error_code, response_error_message),
+                failure_phase="connect",
+                retryable_same_contract=True,
+                failure_detail=failure_detail,
+                failure_exception_type=failure_exception_type,
+                upstream_status_code=exc.status_code,
+                upstream_error_code=routed_error_code,
+            ) from exc
         yield format_sse_event(
             response_failed_event(routed_error_code, response_error_message, response_id=get_request_id()),
         )
@@ -3206,6 +3217,16 @@ async def _stream_via_http_after_websocket_rejection(
                 retryable_same_contract=retryable_same_contract,
                 failed_session=client_session,
             ) from exc
+        if raise_for_status and retryable_same_contract:
+            raise ProxyResponseError(
+                502,
+                openai_error(error_code or "upstream_unavailable", response_error_message),
+                failure_phase="connect",
+                retryable_same_contract=True,
+                failure_detail=failure_detail,
+                failure_exception_type=failure_exception_type,
+                failed_session=client_session,
+            ) from exc
         yield format_sse_event(
             response_failed_event(
                 error_code or "upstream_unavailable", response_error_message, response_id=get_request_id()

app/core/config/settings.py

@@ -297,6 +297,7 @@ class Settings(BaseSettings):
     http_responses_session_bridge_codex_idle_ttl_seconds: float = Field(default=900.0, gt=0)
     http_responses_session_bridge_codex_prewarm_enabled: bool = False
     http_responses_session_bridge_stuck_gate_retire_after_seconds: float = Field(default=300.0, gt=0)
+    http_responses_session_bridge_response_created_timeout_seconds: float = Field(default=120.0, gt=0)
     http_responses_session_bridge_max_sessions: int = Field(default=256, gt=0)
     http_responses_session_bridge_queue_limit: int = Field(default=8, gt=0)
     http_responses_session_bridge_gateway_safe_mode: bool = False