From c3d3732daa2a580c1385a5a679c4005015bda56a Mon Sep 17 00:00:00 2001
From: zeroaltitude <zeroaltitude@gmail.com>
Date: Tue, 3 Mar 2026 21:43:48 -0700
Subject: [PATCH] fix(browser): restore res.json before originalJson flush and
 in catch block

If originalJson(interceptedBody) throws (e.g. BigInt serialization),
the outer catch would hit the intercepted res.json. Now restores
before both the flush and in the catch block as a safety net.

Addresses codex-connector P1 on PR #30323.
---
 src/browser/routes/agent.shared.ts | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/browser/routes/agent.shared.ts b/src/browser/routes/agent.shared.ts
index 5be92f9c0c2..33b15d23b45 100644
--- a/src/browser/routes/agent.shared.ts
+++ b/src/browser/routes/agent.shared.ts
@@ -183,11 +183,18 @@ export async function withRouteTabContext<T>(
           }
         }
       }
+      // Restore res.json before flushing so that if originalJson throws
+      // (e.g. BigInt serialization), the outer catch can still send errors.
+      params.res.json = originalJson;
       originalJson(interceptedBody);
     }
 
     return result;
   } catch (err) {
+    // Ensure res.json is always restored for error handling.
+    if (params.res.json !== originalJson) {
+      params.res.json = originalJson;
+    }
     handleRouteError(params.ctx, params.res, err);
     return undefined;
   }