Fix retry classification for throttling and quota errors (#45602)

## Why

`slow_down` errors were treated as terminal server overloads, while exhausted credit balances and spend limits fell through to retryable stream errors.

## What changed

- Classify `slow_down` as a retryable rate limit in HTTP 503 responses and SSE failures, preserving the server message and parsing retry delays from SSE error messages.
- Map `credit_balance_exhausted`, `organization_spend_limit_exceeded`, and `project_spend_limit_exceeded` SSE errors to quota exhaustion so they terminate without retries.

## Testing

Extend tests to cover HTTP error classification and retryability, `slow_down` stream retry exhaustion and message-provided delays, and a single `UsageLimitExceeded` error with no retries for each quota error code.

GitOrigin-RevId: 7985eba71ba4a6fe897a45957e448fadd42f3963

codex-rs/codex-api/src/api_bridge.rs

@@ -74,15 +74,21 @@ pub fn map_api_error(err: ApiError) -> CodexErr {
 
                 if status == http::StatusCode::SERVICE_UNAVAILABLE
                     && let Ok(value) = serde_json::from_str::<serde_json::Value>(&body_text)
-                    && matches!(
-                        value
-                            .get("error")
-                            .and_then(|error| error.get("code"))
-                            .and_then(serde_json::Value::as_str),
-                        Some("server_is_overloaded" | "slow_down")
-                    )
+                    && let Some(error) = value.get("error")
                 {
-                    return CodexErr::ServerOverloaded;
+                    match error.get("code").and_then(Value::as_str) {
+                        Some("server_is_overloaded") => return CodexErr::ServerOverloaded,
+                        Some("slow_down") => {
+                            return CodexErr::new(CodexErrorDetails::RateLimitExceeded(
+                                error
+                                    .get("message")
+                                    .and_then(Value::as_str)
+                                    .unwrap_or_default()
+                                    .to_owned(),
+                            ));
+                        }
+                        _ => {}
+                    }
                 }
 
                 if (status == http::StatusCode::BAD_REQUEST

codex-rs/codex-api/src/api_bridge_tests.rs

@@ -52,21 +52,29 @@ fn map_api_error_preserves_retry_delay() {
 }
 
 #[test]
-fn map_api_error_maps_server_overloaded_from_503_body() {
-    let body = serde_json::json!({
-        "error": {
-            "code": "server_is_overloaded"
-        }
-    })
-    .to_string();
-    let err = map_api_error(ApiError::Transport(TransportError::Http {
-        status: http::StatusCode::SERVICE_UNAVAILABLE,
-        url: Some("http://example.com/v1/responses".to_string()),
-        headers: None,
-        body: Some(body),
-    }));
-
-    assert!(matches!(err.details(), CodexErrorDetails::ServerOverloaded));
+fn map_api_error_distinguishes_capacity_from_slow_down() {
+    for (code, expected, retryable) in [
+        (
+            "server_is_overloaded",
+            CodexErrorInfo::ServerOverloaded,
+            false,
+        ),
+        ("slow_down", CodexErrorInfo::RateLimitExceeded, true),
+        ("unknown_error", CodexErrorInfo::Other, true),
+    ] {
+        let err = map_api_error(ApiError::Transport(TransportError::Http {
+            status: http::StatusCode::SERVICE_UNAVAILABLE,
+            url: None,
+            headers: None,
+            body: Some(
+                serde_json::json!({"error": {"code": code, "message": "retry later"}}).to_string(),
+            ),
+        }));
+        assert_eq!(
+            (err.to_codex_protocol_error(), err.is_retryable()),
+            (expected, retryable)
+        );
+    }
 }
 
 #[test]

codex-rs/codex-api/src/sse/responses.rs

@@ -455,7 +455,7 @@ pub fn process_responses_event(
                         let delay = try_parse_retry_after(&error);
                         let message = error.message.unwrap_or_default();
                         response_error = match error.code.as_deref() {
-                            Some("rate_limit_exceeded") => {
+                            Some("rate_limit_exceeded" | "slow_down") => {
                                 ApiError::RateLimitExceeded { message, delay }
                             }
                             _ => ApiError::Retryable { message, delay },
@@ -683,7 +683,10 @@ async fn process_sse_with_treatment(
 }
 
 fn try_parse_retry_after(err: &Error) -> Option<Duration> {
-    if err.code.as_deref() != Some("rate_limit_exceeded") {
+    if !matches!(
+        err.code.as_deref(),
+        Some("rate_limit_exceeded" | "slow_down")
+    ) {
         return None;
     }
 
@@ -713,7 +716,15 @@ fn is_context_window_error(error: &Error) -> bool {
 }
 
 fn is_quota_exceeded_error(error: &Error) -> bool {
-    error.code.as_deref() == Some("insufficient_quota")
+    matches!(
+        error.code.as_deref(),
+        Some(
+            "insufficient_quota"
+                | "credit_balance_exhausted"
+                | "organization_spend_limit_exceeded"
+                | "project_spend_limit_exceeded"
+        )
+    )
 }
 
 fn is_usage_not_included(error: &Error) -> bool {
@@ -726,7 +737,6 @@ fn is_cyber_policy_error(error: &Error) -> bool {
 
 fn is_server_overloaded_error(error: &Error) -> bool {
     error.code.as_deref() == Some("server_is_overloaded")
-        || error.code.as_deref() == Some("slow_down")
 }
 
 fn cyber_policy_fallback_message() -> String {
@@ -1118,6 +1128,7 @@ mod tests {
     async fn failed_response_classification_uses_error_code() {
         for (code, message) in [
             ("rate_limit_exceeded", "Temporary limit."),
+            ("slow_down", "Temporary limit."),
             (
                 "unknown_error",
                 "Rate limit reached. Please try again in 1s.",
@@ -1131,7 +1142,7 @@ mod tests {
             let events = collect_events(&[sse.as_bytes()]).await;
             match (code, events.as_slice()) {
                 (
-                    "rate_limit_exceeded",
+                    "rate_limit_exceeded" | "slow_down",
                     [
                         Err(ApiError::RateLimitExceeded {
                             message: actual,