fix(billing): carry the codex denial message across the ACP boundary

A plain Error serializes to a bare -32603 "Internal error" at the ACP
boundary, so the gateway text never reached the host's classifier — the
denial read as a fatal session error and triggered a kill/respawn/resend
loop instead of the upgrade modal. Reject with
RequestError.internalError(undefined, message) like the Claude adapter,
which lands client-side as "Internal error: …needs a paid PostHog plan…"
and classifies correctly. The test now asserts the RequestError shape, not
just the in-process rejection.

Generated-By: PostHog Code
Task-Id: 1039ea23-9930-44e2-9888-b05cf8b129ec

Author: adboio

packages/agent/src/adapters/codex-app-server/codex-app-server-agent.test.ts

@@ -4,6 +4,7 @@ import type {
   NewSessionRequest,
   PromptRequest,
 } from "@agentclientprotocol/sdk";
+import { RequestError } from "@agentclientprotocol/sdk";
 import { describe, expect, it } from "vitest";
 import type {
   AppServerClientHandlers,
@@ -1619,7 +1620,20 @@ describe("CodexAppServerAgent", () => {
       },
     });
 
-    await expect(done).rejects.toThrow("needs a paid PostHog plan");
+    const err = await done.then(
+      () => {
+        throw new Error("prompt resolved instead of rejecting");
+      },
+      (e: unknown) => e,
+    );
+    // Must be a RequestError with the gateway text in its message — a plain
+    // Error crosses the ACP boundary as a bare "Internal error", which the
+    // host classifies as fatal and answers with a kill/respawn loop.
+    expect(err).toBeInstanceOf(RequestError);
+    expect((err as RequestError).message).toContain("Internal error: ");
+    expect((err as RequestError).message).toContain(
+      "needs a paid PostHog plan",
+    );
   });
 
   it("ends the turn without turn/start when no prompt block is usable", async () => {

packages/agent/src/adapters/codex-app-server/codex-app-server-agent.ts

@@ -19,6 +19,7 @@ import type {
   SetSessionConfigOptionResponse,
   StopReason,
 } from "@agentclientprotocol/sdk";
+import { RequestError } from "@agentclientprotocol/sdk";
 import {
   classifyGatewayLimitError,
   mcpToolKey,
@@ -1259,13 +1260,15 @@ export class CodexAppServerAgent extends BaseAcpAgent {
         });
         const message = error?.message ?? "";
         // A gateway billing denial rejects the prompt so the host classifies
-        // it and shows the upgrade gate; a silent refusal would hide it.
+        // it and shows the upgrade gate. It must be a RequestError: a plain
+        // Error serializes to a bare "Internal error" at the ACP boundary,
+        // which the host reads as fatal and answers with a respawn loop.
         if (classifyGatewayLimitError(message) !== null) {
           if (this.compactionActive) {
             this.compactionActive = false;
             this.emitCompactionBoundary();
           }
-          this.turns.fail(new Error(message));
+          this.turns.fail(RequestError.internalError(undefined, message));
           return;
         }
         void this.finalizeTurn("refusal");