@@ -89,11 +89,12 @@ const MISSING_API_KEY_PATTERN = /Missing environment variable:\s*`?(?:CODEX_API_
 // These are transient infrastructure failures that may resolve on retry.
 const SERVER_ERROR_PATTERN = /InternalServerError|ServiceUnavailableError|500 Internal Server Error|503 Service Unavailable/i;
 
-// Pattern to detect deterministic request-validation failures (HTTP 400 `invalid_request_error`)
+// Pattern to detect deterministic request-validation failures (HTTP 400 `invalid_request_error`
+// or `invalid_request_body`, including invalid replayed item IDs during resume)
 // within Codex's outer `turn.failed` event. The provider rejects the serialized request itself
 // (e.g. `"code": "empty_array"` on `messages[N].content`), so an identical fresh run produces
 // an identical rejection: retrying only re-bills the turns that succeeded before the failure point.
-const INVALID_REQUEST_ERROR_PATTERN = /invalid_request_error/i;
+const INVALID_REQUEST_ERROR_PATTERN = /invalid_request_(?:error|body)/i;
 
 function resolveMCPServerToolTimeouts(config, runtimeToolTimeoutSeconds) {
   const configuredServers = config.defaults?.mcp_servers && typeof config.defaults.mcp_servers === "object" ? config.defaults.mcp_servers : {};
@@ -299,21 +300,32 @@ function isInvalidModelError(output) {
 
 /**
  * Determines if Codex emitted a `turn.failed` provider event containing a deterministic
- * request-validation failure (HTTP 400 `invalid_request_error`). Such schema-level rejections
- * can never succeed on a fresh run with the same input, so they are treated as terminal.
+ * request-validation failure (HTTP 400 `invalid_request_error` or `invalid_request_body`).
+ * Such schema-level rejections cannot succeed by replaying the same request or session.
  * Tokens in agent transcripts and tool responses are intentionally ignored.
  * @param {string} output - Collected stdout+stderr from the process
  * @returns {boolean}
  */
 function isInvalidRequestError(output) {
-  return output.split(/\r?\n/).some(line => {
+  return extractInvalidRequestErrorCode(output) !== null;
+}
+
+/**
+ * @param {string} output
+ * @returns {string | null}
+ */
+function extractInvalidRequestErrorCode(output) {
+  for (const line of output.split(/\r?\n/)) {
     try {
       const event = JSON.parse(line);
-      return event?.type === "turn.failed" && event.error && INVALID_REQUEST_ERROR_PATTERN.test(JSON.stringify(event.error));
+      if (event?.type !== "turn.failed" || !event.error) continue;
+      const match = JSON.stringify(event.error).match(INVALID_REQUEST_ERROR_PATTERN);
+      if (match) return match[0].toLowerCase();
     } catch {
-      return false;
+      // Ignore non-JSON diagnostic lines.
     }
-  });
+  }
+  return null;
 }
 
 /**
@@ -987,7 +999,8 @@ async function main() {
       const isServer = isServerError(result.output);
       const isInvalidModel = isInvalidModelError(result.output);
       const isUnsupportedModelTools = isUnsupportedModelToolsError(result.output);
-      const isInvalidRequest = isInvalidRequestError(result.output);
+      const invalidRequestErrorCode = extractInvalidRequestErrorCode(result.output);
+      const isInvalidRequest = invalidRequestErrorCode !== null;
       const permissionDeniedCount = countPermissionDeniedIssues(result.output);
       const hasNumerousPermissionDenied = hasNumerousPermissionDeniedIssues(result.output);
       log(
@@ -1080,7 +1093,10 @@ async function main() {
       }
 
       if (isInvalidRequest) {
-        log(`attempt ${attempt + 1}: invalid_request_error (HTTP 400) — not retrying (the provider rejected the request payload; an identical fresh run would fail the same way)`);
+        emitInfrastructureIncomplete(`Codex request-body rejection (${invalidRequestErrorCode}): the provider rejected the request payload; not retrying because replaying the same request or session would fail identically.`, {
+          logger: log,
+        });
+        log(`attempt ${attempt + 1}: ${invalidRequestErrorCode} (HTTP 400) — not retrying (the provider rejected the request payload; replaying the same request or session would fail the same way)`);
         return { action: "stop" };
       }
 
@@ -1156,6 +1172,7 @@ if (typeof module !== "undefined" && module.exports) {
     isInvalidModelError,
     isUnsupportedModelToolsError,
     isInvalidRequestError,
+    extractInvalidRequestErrorCode,
     isReconnectExhaustedError,
     countPermissionDeniedIssues,
     hasNumerousPermissionDeniedIssues,
 
@@ -18,6 +18,7 @@ const {
   isInvalidModelError,
   isUnsupportedModelToolsError,
   isInvalidRequestError,
+  extractInvalidRequestErrorCode,
   isReconnectExhaustedError,
   countPermissionDeniedIssues,
   hasNumerousPermissionDeniedIssues,
@@ -208,6 +209,46 @@ process.stdout.write(JSON.stringify({type:"turn.completed",usage:{input_tokens:1
       expect(calls[1].stdin).not.toBe(calls[0].stdin);
     });
 
+    it.each(["stdout", "stderr"])("stops after an invalid_request_body resume rejection on %s and reports the cause", stream => {
+      const id = "0199a213-81c0-7800-8aa1-bbab2a035a53";
+      const dir = makeHarnessTempDir("invalid-request-body-");
+      const safeOutputsPath = path.join(dir, "safe-outputs.jsonl");
+      const safeOutputsCLI = path.join(dir, "safeoutputs.cjs");
+      fs.writeFileSync(
+        safeOutputsCLI,
+        `#!${process.execPath}
+const fs = require("fs");
+const args = process.argv.slice(2);
+const item = { type: args[0] };
+for (let i = 1; i < args.length; i += 2) item[args[i].slice(2)] = args[i + 1];
+fs.appendFileSync(process.env.GH_AW_SAFE_OUTPUTS, JSON.stringify(item) + "\\n");
+`
+      );
+      fs.chmodSync(safeOutputsCLI, 0o700);
+      const { result, calls } = runHarnessFixture(
+        `
+process.stdout.write(JSON.stringify({type:"thread.started",thread_id:"${id}"})+"\\n");
+const resumed = process.argv.includes("resume");
+const message = resumed ? JSON.stringify({error:{message:"Invalid 'input[13].id': 'ctco_example'. Expected an ID that begins with 'fc'.",code:"invalid_request_body"}}) : "connection reset";
+process.${stream}.write(JSON.stringify({type:"turn.failed",error:{message}})+"\\n");
+process.exit(1);`,
+        { env: { GH_AW_HARNESS_MAX_RETRIES: "3", GH_AW_SAFE_OUTPUTS: safeOutputsPath, GH_AW_SAFEOUTPUTS_CLI: safeOutputsCLI } }
+      );
+      expect(result.status).toBe(1);
+      expect(calls).toHaveLength(2);
+      expect(calls[1].args).toEqual(["exec", "--json", "resume", id, "-"]);
+      expect(result.stderr).toContain("invalid_request_body (HTTP 400) — not retrying");
+      const items = fs
+        .readFileSync(safeOutputsPath, "utf8")
+        .trim()
+        .split("\n")
+        .map(line => JSON.parse(line));
+      expect(items).toHaveLength(1);
+      expect(items[0]).toMatchObject({ type: "report_incomplete", reason: "infrastructure_error" });
+      expect(items[0].details).toContain("request-body rejection (invalid_request_body)");
+      expect(items[0].details).toContain("not retrying");
+    });
+
     it("does not select a session when ephemeral mode prevents persistence", () => {
       expect(buildCodexResumeArgs(["exec", "--ephemeral", "-"], "0199a213-81c0-7800-8aa1-bbab2a035a53")).toBeNull();
       expect(buildCodexResumeArgs(["exec", "-"], "not-an-id")).toBeNull();
@@ -842,11 +883,26 @@ env_key = "OPENAI_API_KEY"
       expect(isInvalidRequestError('{"type":"turn.failed","error":{"type":"invalid_request_error"}}')).toBe(true);
     });
 
+    it("extracts the invalid request error code", () => {
+      expect(extractInvalidRequestErrorCode('{"type":"turn.failed","error":{"type":"invalid_request_error"}}')).toBe("invalid_request_error");
+      expect(extractInvalidRequestErrorCode('{"type":"turn.failed","error":{"code":"invalid_request_body"}}')).toBe("invalid_request_body");
+      expect(extractInvalidRequestErrorCode('{"type":"item.completed","item":{"text":"invalid_request_body"}}')).toBeNull();
+    });
+
+    it("returns true for the observed nested invalid_request_body item-ID rejection", () => {
+      const output = String.raw`{"type":"turn.failed","error":{"message":"{\"error\":{\"message\":\"Invalid 'input[13].id': 'ctco_example'. Expected an ID that begins with 'fc'.\",\"code\":\"invalid_request_body\"}}\n"}}`;
+      expect(isInvalidRequestError(output)).toBe(true);
+      expect(isInvalidRequestError('{"type":"turn.failed","error":{"code":"invalid_request_body"}}')).toBe(true);
+    });
+
     it("returns false for unrelated errors and tool transcript content", () => {
       expect(isInvalidRequestError("rate_limit_exceeded")).toBe(false);
       expect(isInvalidRequestError("500 Internal Server Error")).toBe(false);
       expect(isInvalidRequestError("GitHub API responded with 400 Bad Request")).toBe(false);
       expect(isInvalidRequestError('{"type":"item.completed","item":{"type":"tool_call_output","output":"invalid_request_error"}}')).toBe(false);
+      expect(isInvalidRequestError('{"type":"item.completed","item":{"type":"agent_message","text":"invalid_request_body"}}')).toBe(false);
+      expect(isInvalidRequestError('{"type":"item.completed","item":{"type":"tool_call_output","output":"invalid_request_body"}}')).toBe(false);
+      expect(isInvalidRequestError("invalid_request_body")).toBe(false);
       expect(isInvalidRequestError("")).toBe(false);
     });
   });