Retry transient Codex Apps file upload failures

[guinness-oai]

Why

Codex Apps file parameters are uploaded with a direct PUT to a short-lived Sediment/Azure presigned URL. Today, one upload-stage transport failure consumes that URL and fails the whole MCP tool call. The surfaced error also collapses connect, TLS, request-body, and timeout failures into error sending request for url, while including the presigned query string.

This is the shared client-side failure reported in the Sites incident thread and the Codex box repro.

What changed

• Retry an upload-stage transport or HTTP failure once.
• Reopen the environment file stream and call /files again so the retry gets a fresh presigned URL.
• Do not retry create or finalize failures.
• Classify request failures as timeout, connect, body, request, or transport and retain the nested cause text.
• Remove query strings and fragments from URLs surfaced in errors so presigned credentials are not copied into logs or Slack.

Testing

• just test -p codex-api — 137 passed
• just test -p codex-core build_uploaded_argument_value_retries_upload_with_fresh_url — passed
• just fix -p codex-api
• just fix -p codex-core
• just fmt

The new core test forces the first presigned PUT to a closed local port, then verifies that Codex reopens the file, allocates a second URL, and completes the upload.