Import four upstream fixes: a crash, a silent hook timeout, a silent wait timeout, and a hung connect

[Edo771977]

Four PRs opened upstream in the last day, each one verified against this fork's own code before importing — all four defects were present here.

341/341, full suite run twice. tsc clean.

Upstream PR	The defect, in this fork	Conflicts
#775	codex.mjs read item.changes.length on every fileChange start event. Codex can send that notification before the change list exists, and the TypeError aborted the whole turn — a job lost to a log line	none
#772	STOP_REVIEW_TIMEOUT_MS was 15 minutes and hooks.json gives the Stop hook 900 seconds — the same instant. Claude Code killed the hook exactly when spawnSync would have reported ETIMEDOUT, so the gate's own "review timed out, run /codex:review --wait or bypass" was never printed and the turn just ended	none
#774	status --wait recorded waitTimedOut in the JSON, but the text report was rendered from the job alone and the process exited 0, so a script polling /codex:status <id> --wait read a timed-out wait as a finished check	none
#773	BrokerCodexAppServerClient waited on connect or error and nothing else: an endpoint that never completes hung the command for good	2, resolved

openai#774 is the same principle this fork already applied to cancellation in #656 — an outcome nothing confirmed must not be reported as one.

openai#773 is taken in half, deliberately

The probe half stays ours. probeEndpoint() already bounds every connect attempt, and probeBrokerEndpoint() reports why an attempt failed — which ensureBrokerSession() needs in order to tell "nothing is there" from "there, but refusing" (PR #10). openai#773 rewrites waitForBrokerEndpoint() into a bounded loop returning a bare boolean, which would undo that, so HEAD wins for broker-lifecycle.mjs and its tests.

Their test for that half is also not imported: it replaces net.createConnection globally with a stub whose setTimeout() is a no-op, so it would fail against our implementation — which bounds the attempt through exactly that call — while proving nothing about it.

The client half was genuinely missing and is taken, with three changes on top:

• the connection is created through an injectable seam, so tests hand it a socket that never settles instead of monkey-patching net
• every settle path runs through one function that clears the deadline. A timer left armed after the attempt settled holds the event loop open for its whole budget — on a short-lived command, the difference between exiting now and exiting in 2s. Structurally impossible now rather than guarded by a test
• the budget is a named export resolved through resolveBrokerConnectTimeoutMs(), which a test pins, with the comment explaining why it is short: a broker that is merely refusing is handled a level up, by waiting for it, not by replacing it

Sabotage matrix for the new tests

sabotage	which test fails
connect deadline removed	"a broker connect that never settles is given up on"
default budget 2000 → 20000	"the broker connect budget defaults to 2s and honours an override"

🤖 Generated with Claude Code

https://claude.ai/code/session_01UXfvnjSC72HsM6EEPVt2Tg

---

Generated by Claude Code