codex-cli-mcp-slim 0.1.1__tar.gz → 0.1.2__tar.gz

{codex_cli_mcp_slim-0.1.1/src/codex_cli_mcp_slim.egg-info → codex_cli_mcp_slim-0.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codex-cli-mcp-slim
-Version: 0.1.1
+Version: 0.1.2
 Summary: A thin, auditable MCP server wrapping the Codex CLI (codex exec). Same tools as the deprecated `codex mcp-server`; forward-compatible with future CLI flags via extra_args passthrough.
 Author-email: tksfjt1024 <tksfjt1024@gmail.com>
 License: MIT
@@ -328,6 +328,31 @@ buffered output and reap the process, so the effective ceiling is
 `timeout_seconds + 20`. A timed-out call is flagged `isError` and carries
 whatever `codex` had printed so far.
 
+An MCP client may give up on a call that has sent neither a response nor a
+progress notification for a while. Claude Code 2.1.318 does so after 1800
+seconds by default for a stdio server ("sent no response or progress for
+1800s"), and a long `codex` turn can take longer than that. While `codex` runs,
+the server therefore sends a `notifications/progress` message every 60 seconds,
+so the call lasts until `codex` finishes or `timeout_seconds` runs out. A client
+gets these only when it sent a `progressToken` with the call, as Claude Code
+does; a client that gives up after less than 60 seconds without progress is not
+covered. With the default `timeout_seconds` of 1800 the call still ends after
+about 30 minutes, at the server's own timeout, so to let `codex` run longer,
+raise `timeout_seconds` (30 to 3600 per call) or `$CODEX_CLI_MCP_SLIM_TIMEOUT`,
+which sets the default. In the notification's `params`, `progress` counts the
+notifications sent so far and `message` says how long `codex` has been running:
+
+```json
+{
+  "jsonrpc": "2.0",
+  "method": "notifications/progress",
+  "params": {"progressToken": 7, "progress": 2, "message": "codex running for 120s"}
+}
+```
+
+If sending a notification raises an error, the server logs it to stderr and the
+call and its result are unaffected.
+
 ## Forward-compatibility example
 
 If a future `codex exec` release adds a new flag (say `--super-mode`), use it

{codex_cli_mcp_slim-0.1.1 → codex_cli_mcp_slim-0.1.2}/README.md

@@ -293,6 +293,31 @@ buffered output and reap the process, so the effective ceiling is
 `timeout_seconds + 20`. A timed-out call is flagged `isError` and carries
 whatever `codex` had printed so far.
 
+An MCP client may give up on a call that has sent neither a response nor a
+progress notification for a while. Claude Code 2.1.318 does so after 1800
+seconds by default for a stdio server ("sent no response or progress for
+1800s"), and a long `codex` turn can take longer than that. While `codex` runs,
+the server therefore sends a `notifications/progress` message every 60 seconds,
+so the call lasts until `codex` finishes or `timeout_seconds` runs out. A client
+gets these only when it sent a `progressToken` with the call, as Claude Code
+does; a client that gives up after less than 60 seconds without progress is not
+covered. With the default `timeout_seconds` of 1800 the call still ends after
+about 30 minutes, at the server's own timeout, so to let `codex` run longer,
+raise `timeout_seconds` (30 to 3600 per call) or `$CODEX_CLI_MCP_SLIM_TIMEOUT`,
+which sets the default. In the notification's `params`, `progress` counts the
+notifications sent so far and `message` says how long `codex` has been running:
+
+```json
+{
+  "jsonrpc": "2.0",
+  "method": "notifications/progress",
+  "params": {"progressToken": 7, "progress": 2, "message": "codex running for 120s"}
+}
+```
+
+If sending a notification raises an error, the server logs it to stderr and the
+call and its result are unaffected.
+
 ## Forward-compatibility example
 
 If a future `codex exec` release adds a new flag (say `--super-mode`), use it

{codex_cli_mcp_slim-0.1.1 → codex_cli_mcp_slim-0.1.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "codex-cli-mcp-slim"
-version = "0.1.1"
+version = "0.1.2"
 description = "A thin, auditable MCP server wrapping the Codex CLI (codex exec). Same tools as the deprecated `codex mcp-server`; forward-compatible with future CLI flags via extra_args passthrough."
 readme = "README.md"
 requires-python = ">=3.10"

{codex_cli_mcp_slim-0.1.1 → codex_cli_mcp_slim-0.1.2}/src/codex_cli_mcp_slim/server.py

@@ -23,6 +23,7 @@ import os
 import shlex
 import signal
 import sys
+from collections.abc import Awaitable, Callable
 from importlib.metadata import version as _pkg_version
 from typing import Any, NamedTuple
 
@@ -42,6 +43,16 @@ logger = logging.getLogger("codex_cli_mcp_slim")
 CODEX_CMD = os.environ.get("CODEX_CMD", "codex")
 DEFAULT_TIMEOUT = int(os.environ.get("CODEX_CLI_MCP_SLIM_TIMEOUT", "1800"))
 
+# Seconds between the progress notifications _run_codex sends while codex runs. An MCP client
+# may abort a call that sends neither a response nor progress for a while (Claude Code does
+# so after 1800s by default: "sent no response or progress for 1800s"), and a long codex turn
+# outlasts that; the notifications are what keeps such a call alive.
+PROGRESS_INTERVAL = 60
+
+# ServerSession.report_progress, or anything called the same way. It does nothing when the
+# client sent no progress token with the call.
+_ReportProgress = Callable[..., Awaitable[None]]
+
 _PKG_NAME = "codex-cli-mcp-slim"
 
 # Flags placed right after `codex exec` on every invocation. main() fills this from the
@@ -200,6 +211,7 @@ async def _run_codex(
     prompt: str,
     timeout: int,
     env_overrides: dict[str, str] | None = None,
+    report_progress: _ReportProgress | None = None,
 ) -> dict[str, Any]:
     env = os.environ.copy()
     if env_overrides:
@@ -230,6 +242,11 @@ async def _run_codex(
 
     # shield the task so a first-wait timeout doesn't cancel the second wait below
     communicate_task = asyncio.ensure_future(proc.communicate(prompt.encode()))
+    progress_task = (
+        asyncio.ensure_future(_report_progress_every(PROGRESS_INTERVAL, report_progress))
+        if report_progress is not None
+        else None
+    )
     try:
         try:
             stdout, stderr = await asyncio.wait_for(
@@ -268,10 +285,25 @@ async def _run_codex(
         _kill_process_group(proc)
         raise
     finally:
-        if not communicate_task.done():
-            communicate_task.cancel()
-            with contextlib.suppress(Exception, asyncio.CancelledError):
-                await communicate_task
+        # The progress task ends before the result goes back, since the protocol has progress
+        # stop once the call completes; cancelling it also ends a notification stuck on a
+        # client that has stopped reading. Both tasks are cancelled before anything is
+        # awaited, and the wait is repeated until they have finished. The SDK cancels a call
+        # through an anyio cancel scope, which cancels this coroutine again at every await, so
+        # a single await here could be cut short and leave communicate() running for as long
+        # as a descendant outside the process group keeps the pipes open. A cancellation that
+        # arrives during the wait is raised once the tasks are done.
+        leftovers = {t for t in (progress_task, communicate_task) if t is not None and not t.done()}
+        for task in leftovers:
+            task.cancel()
+        interrupted: asyncio.CancelledError | None = None
+        while leftovers := {t for t in leftovers if not t.done()}:
+            try:
+                await asyncio.wait(leftovers)
+            except asyncio.CancelledError as exc:
+                interrupted = exc
+        if interrupted is not None:
+            raise interrupted
 
     return {
         "ok": proc.returncode == 0,
@@ -282,6 +314,27 @@ async def _run_codex(
     }
 
 
+async def _report_progress_every(interval: float, report_progress: _ReportProgress) -> None:
+    """Send a progress notification every `interval` seconds until cancelled.
+
+    `progress` counts the notifications, so it rises with each one as the protocol requires;
+    the message carries the time codex has been running. A notification that raises is logged
+    and the next one is still sent: it must not affect the codex run or its result. (The SDK
+    itself drops a notification on a closed transport, with a debug log and no exception.)
+    """
+    loop = asyncio.get_running_loop()
+    started = loop.time()
+    count = 0
+    while True:
+        await asyncio.sleep(interval)
+        count += 1
+        elapsed = round(loop.time() - started)
+        try:
+            await report_progress(count, message=f"codex running for {elapsed}s")
+        except Exception as exc:
+            logger.warning("progress notification failed: %s: %s", type(exc).__name__, exc)
+
+
 def _kill_process_group(proc: asyncio.subprocess.Process) -> None:
     """Kill codex's process group; a descendant that setsid/setpgid away from it is out of reach."""
     if sys.platform != "win32":
@@ -657,7 +710,12 @@ def _error_result(text: str) -> CallToolResult:
     return CallToolResult(content=[TextContent(type="text", text=f"[ERROR] {text}")], is_error=True)
 
 
-async def _invoke(arguments: dict[str, Any] | None, *, reply: bool) -> CallToolResult:
+async def _invoke(
+    arguments: dict[str, Any] | None,
+    *,
+    reply: bool,
+    report_progress: _ReportProgress | None = None,
+) -> CallToolResult:
     """The body of both tools, taking a plain dict so callers need no SDK request object."""
     args = dict(arguments or {})
 
@@ -690,6 +748,7 @@ async def _invoke(arguments: dict[str, Any] | None, *, reply: bool) -> CallToolR
         prompt=args["prompt"],
         timeout=int(args.get("timeout_seconds") or DEFAULT_TIMEOUT),
         env_overrides=args.get("env"),
+        report_progress=report_progress,
     )
     parsed = _parse_events(result.get("stdout", ""))
     text = _format_result(result)
@@ -727,12 +786,16 @@ async def _invoke(arguments: dict[str, Any] | None, *, reply: bool) -> CallToolR
     )
 
 
-async def codex(arguments: dict[str, Any] | None) -> CallToolResult:
-    return await _invoke(arguments, reply=False)
+async def codex(
+    arguments: dict[str, Any] | None, *, report_progress: _ReportProgress | None = None
+) -> CallToolResult:
+    return await _invoke(arguments, reply=False, report_progress=report_progress)
 
 
-async def codex_reply(arguments: dict[str, Any] | None) -> CallToolResult:
-    return await _invoke(arguments, reply=True)
+async def codex_reply(
+    arguments: dict[str, Any] | None, *, report_progress: _ReportProgress | None = None
+) -> CallToolResult:
+    return await _invoke(arguments, reply=True, report_progress=report_progress)
 
 
 async def on_list_tools(
@@ -757,15 +820,20 @@ async def on_list_tools(
     return ListToolsResult(tools=[codex_tool, _REPLY_TOOL])
 
 
-async def on_call_tool(ctx: ServerRequestContext, params: CallToolRequestParams) -> CallToolResult:
+async def on_call_tool(
+    ctx: ServerRequestContext | None, params: CallToolRequestParams
+) -> CallToolResult:
     # An escaping exception would become a JSON-RPC error, which clients treat as a transport
     # failure rather than as something to show the model. CancelledError derives from
     # BaseException, so peer cancellation still propagates and _run_codex's killpg still runs.
+    # The session is scoped to this request, so its progress goes out against this call's
+    # token. Tests and direct callers pass no context; such a call simply sends no progress.
+    report_progress = ctx.session.report_progress if ctx is not None else None
     try:
         if params.name == "codex":
-            return await codex(params.arguments)
+            return await codex(params.arguments, report_progress=report_progress)
         if params.name == "codex-reply":
-            return await codex_reply(params.arguments)
+            return await codex_reply(params.arguments, report_progress=report_progress)
         return _error_result(f"unknown tool: {params.name}")
     except Exception as exc:
         logger.exception("%s failed", params.name)

{codex_cli_mcp_slim-0.1.1 → codex_cli_mcp_slim-0.1.2/src/codex_cli_mcp_slim.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codex-cli-mcp-slim
-Version: 0.1.1
+Version: 0.1.2
 Summary: A thin, auditable MCP server wrapping the Codex CLI (codex exec). Same tools as the deprecated `codex mcp-server`; forward-compatible with future CLI flags via extra_args passthrough.
 Author-email: tksfjt1024 <tksfjt1024@gmail.com>
 License: MIT
@@ -328,6 +328,31 @@ buffered output and reap the process, so the effective ceiling is
 `timeout_seconds + 20`. A timed-out call is flagged `isError` and carries
 whatever `codex` had printed so far.
 
+An MCP client may give up on a call that has sent neither a response nor a
+progress notification for a while. Claude Code 2.1.318 does so after 1800
+seconds by default for a stdio server ("sent no response or progress for
+1800s"), and a long `codex` turn can take longer than that. While `codex` runs,
+the server therefore sends a `notifications/progress` message every 60 seconds,
+so the call lasts until `codex` finishes or `timeout_seconds` runs out. A client
+gets these only when it sent a `progressToken` with the call, as Claude Code
+does; a client that gives up after less than 60 seconds without progress is not
+covered. With the default `timeout_seconds` of 1800 the call still ends after
+about 30 minutes, at the server's own timeout, so to let `codex` run longer,
+raise `timeout_seconds` (30 to 3600 per call) or `$CODEX_CLI_MCP_SLIM_TIMEOUT`,
+which sets the default. In the notification's `params`, `progress` counts the
+notifications sent so far and `message` says how long `codex` has been running:
+
+```json
+{
+  "jsonrpc": "2.0",
+  "method": "notifications/progress",
+  "params": {"progressToken": 7, "progress": 2, "message": "codex running for 120s"}
+}
+```
+
+If sending a notification raises an error, the server logs it to stderr and the
+call and its result are unaffected.
+
 ## Forward-compatibility example
 
 If a future `codex exec` release adds a new flag (say `--super-mode`), use it

{codex_cli_mcp_slim-0.1.1 → codex_cli_mcp_slim-0.1.2}/src/codex_cli_mcp_slim.egg-info/SOURCES.txt

@@ -12,5 +12,6 @@ src/codex_cli_mcp_slim.egg-info/requires.txt
 src/codex_cli_mcp_slim.egg-info/top_level.txt
 tests/test_basic.py
 tests/test_call_tool.py
+tests/test_progress.py
 tests/test_subprocess_stdin_isolation.py
 tests/test_timeout_handling.py

codex_cli_mcp_slim-0.1.2/tests/test_progress.py

@@ -0,0 +1,306 @@
+"""Tests for the progress notifications sent while codex runs.
+
+An MCP client may abort a tool call that sends neither a response nor a progress
+notification for too long (Claude Code: "sent no response or progress for 1800s"), and a
+codex turn can outlast that. These tests run a fake codex binary through the tool and
+record what reaches the request context's `session.report_progress`, or, through the SDK's
+in-process client, what reaches the client's progress callback.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import contextlib
+import json
+import logging
+import os
+import re
+import sys
+from pathlib import Path
+from types import SimpleNamespace
+
+import anyio
+import pytest
+from mcp.client import Client
+from mcp.types import CallToolRequestParams
+
+from codex_cli_mcp_slim import server
+from codex_cli_mcp_slim.server import _run_codex, on_call_tool
+
+EVENTS = "".join(
+    json.dumps(event) + "\n"
+    for event in (
+        {"type": "thread.started", "thread_id": "thread-1"},
+        {"type": "item.completed", "item": {"type": "agent_message", "text": "done"}},
+        {"type": "turn.completed", "usage": {"input_tokens": 1, "output_tokens": 1}},
+    )
+)
+
+CALLS = [
+    ("codex", {"prompt": "p"}),
+    ("codex-reply", {"thread_id": "thread-1", "prompt": "p"}),
+]
+
+
+@pytest.fixture
+def fake_codex(tmp_path: Path, monkeypatch):
+    """Point CODEX_CMD at a script that reads the prompt, sleeps, then prints EVENTS."""
+
+    def make(sleep: float) -> None:
+        script = tmp_path / "codex"
+        script.write_text(
+            f"#!{sys.executable}\n"
+            "import sys, time\n"
+            "sys.stdin.read()\n"
+            f"time.sleep({sleep})\n"
+            f"sys.stdout.write({EVENTS!r})\n"
+        )
+        script.chmod(0o755)
+        monkeypatch.setattr(server, "CODEX_CMD", str(script))
+
+    return make
+
+
+class Recorder:
+    """Stands in for `ServerSession.report_progress`, recording each call."""
+
+    def __init__(self, error: Exception | None = None, hang: bool = False) -> None:
+        self.calls: list[tuple[float, float | None, str | None]] = []
+        self.error = error
+        self.hang = hang
+
+    async def report_progress(
+        self, progress: float, total: float | None = None, message: str | None = None
+    ) -> None:
+        self.calls.append((progress, total, message))
+        if self.hang:
+            await asyncio.Event().wait()
+        if self.error is not None:
+            raise self.error
+
+
+def _ctx(recorder: Recorder) -> SimpleNamespace:
+    return SimpleNamespace(session=recorder)
+
+
+@pytest.mark.parametrize(("name", "arguments"), CALLS)
+async def test_progress_is_reported_every_interval_while_codex_runs(
+    fake_codex, monkeypatch, name, arguments
+) -> None:
+    # codex finishes halfway between the second and third notification, so a second of
+    # scheduling jitter either way leaves the count alone. The elapsed time in the message
+    # moves with that jitter, so only its form is checked.
+    monkeypatch.setattr(server, "PROGRESS_INTERVAL", 2)
+    fake_codex(5)
+    recorder = Recorder()
+
+    result = await on_call_tool(
+        _ctx(recorder), CallToolRequestParams(name=name, arguments=arguments)
+    )
+
+    assert result.is_error is False
+    assert result.content[0].text.startswith("done\n\n[codex] thread_id=thread-1")
+    assert [(progress, total) for progress, total, _ in recorder.calls] == [(1, None), (2, None)]
+    assert all(re.fullmatch(r"codex running for \d+s", message) for _, _, message in recorder.calls)
+    # Nothing is sent once the result is back.
+    await asyncio.sleep(2.5)
+    assert len(recorder.calls) == 2
+
+
+async def test_progress_reaches_the_client_that_asked_for_it(fake_codex, monkeypatch) -> None:
+    # Through the SDK's own request context rather than a stand-in: the notifications reach
+    # the callback of the call that passed one, and a call without a callback gets none.
+    monkeypatch.setattr(server, "PROGRESS_INTERVAL", 0.25)
+    fake_codex(1)
+    received: list[tuple[float, float | None, str | None]] = []
+
+    async def on_progress(progress: float, total: float | None, message: str | None) -> None:
+        received.append((progress, total, message))
+
+    async with Client(server.server) as client:
+        result = await client.call_tool("codex", {"prompt": "p"}, progress_callback=on_progress)
+        assert result.is_error is False
+        assert received, "no progress reached the callback"
+        assert [progress for progress, _, _ in received] == list(range(1, len(received) + 1))
+        assert all(total is None for _, total, _ in received)
+        assert all(re.fullmatch(r"codex running for \d+s", message) for _, _, message in received)
+
+        received.clear()
+        result = await client.call_tool("codex", {"prompt": "p"})
+        assert result.is_error is False
+        assert received == []
+
+
+async def test_no_progress_when_codex_finishes_within_the_interval(fake_codex) -> None:
+    fake_codex(0)
+    recorder = Recorder()
+
+    result = await on_call_tool(
+        _ctx(recorder), CallToolRequestParams(name="codex", arguments={"prompt": "p"})
+    )
+
+    assert result.is_error is False
+    assert recorder.calls == []
+
+
+async def test_a_call_without_a_request_context_still_runs(fake_codex, monkeypatch) -> None:
+    monkeypatch.setattr(server, "PROGRESS_INTERVAL", 0.1)
+    fake_codex(0.5)
+
+    result = await on_call_tool(
+        None, CallToolRequestParams(name="codex", arguments={"prompt": "p"})
+    )
+
+    assert result.is_error is False
+    assert result.content[0].text.startswith("done\n\n[codex] thread_id=thread-1")
+
+
+async def test_a_failing_progress_notification_leaves_the_result_alone(
+    fake_codex, monkeypatch, caplog
+) -> None:
+    monkeypatch.setattr(server, "PROGRESS_INTERVAL", 0.1)
+    fake_codex(0.5)
+    recorder = Recorder(error=RuntimeError("report_progress raised"))
+
+    with caplog.at_level(logging.WARNING, logger="codex_cli_mcp_slim"):
+        result = await on_call_tool(
+            _ctx(recorder), CallToolRequestParams(name="codex", arguments={"prompt": "p"})
+        )
+
+    assert result.is_error is False
+    assert result.content[0].text.startswith("done\n\n[codex] thread_id=thread-1")
+    # A failed notification does not stop the next one.
+    assert len(recorder.calls) >= 2
+    assert "progress notification failed: RuntimeError: report_progress raised" in caplog.text
+
+
+async def test_a_hanging_progress_notification_does_not_hold_the_result(
+    fake_codex, monkeypatch
+) -> None:
+    monkeypatch.setattr(server, "PROGRESS_INTERVAL", 0.1)
+    fake_codex(0.3)
+    recorder = Recorder(hang=True)
+
+    before = asyncio.all_tasks()
+    result = await asyncio.wait_for(
+        on_call_tool(
+            _ctx(recorder), CallToolRequestParams(name="codex", arguments={"prompt": "p"})
+        ),
+        timeout=5,
+    )
+
+    assert result.is_error is False
+    assert len(recorder.calls) == 1
+    leaked = {t for t in asyncio.all_tasks() - before if not t.done()}
+    assert not leaked, f"the stuck notification was left running: {leaked}"
+
+
+async def test_timeout_still_reports_and_stops_the_progress_task(monkeypatch) -> None:
+    monkeypatch.setattr(server, "PROGRESS_INTERVAL", 0.2)
+    recorder = Recorder()
+    argv = [sys.executable, "-c", "import time; time.sleep(60)"]
+
+    before = asyncio.all_tasks()
+    result = await _run_codex(
+        prompt="p", argv=argv, timeout=1, report_progress=recorder.report_progress
+    )
+
+    assert not result["ok"]
+    assert result["error"] == "timeout after 1s"
+    assert recorder.calls
+    leaked = {t for t in asyncio.all_tasks() - before if not t.done()}
+    assert not leaked, f"tasks left running after the timeout: {leaked}"
+
+
+async def test_cancellation_kills_codex_and_stops_the_progress_task(
+    tmp_path: Path, monkeypatch
+) -> None:
+    monkeypatch.setattr(server, "PROGRESS_INTERVAL", 0.1)
+    recorder = Recorder()
+    pid_file = tmp_path / "proc.pid"
+    argv = [
+        sys.executable,
+        "-c",
+        'import os, time; open(os.environ["PID_FILE"], "w").write(str(os.getpid())); '
+        "time.sleep(30)",
+    ]
+
+    before = asyncio.all_tasks()
+    task = asyncio.ensure_future(
+        _run_codex(
+            prompt="p",
+            argv=argv,
+            timeout=20,
+            env_overrides={"PID_FILE": str(pid_file)},
+            report_progress=recorder.report_progress,
+        )
+    )
+    for _ in range(50):
+        if pid_file.exists() and recorder.calls:
+            break
+        await asyncio.sleep(0.1)
+    assert pid_file.exists(), "process never started"
+    assert recorder.calls, "no progress before the cancellation"
+    proc_pid = int(pid_file.read_text())
+
+    task.cancel()
+    with pytest.raises(asyncio.CancelledError):
+        await task
+
+    leaked = {t for t in asyncio.all_tasks() - before - {task} if not t.done()}
+    assert not leaked, f"tasks left running after the cancellation: {leaked}"
+    for _ in range(30):
+        try:
+            os.kill(proc_pid, 0)
+        except ProcessLookupError:
+            break
+        await asyncio.sleep(0.1)
+    else:
+        with contextlib.suppress(ProcessLookupError):
+            os.kill(proc_pid, 9)
+        raise AssertionError(f"process {proc_pid} still alive after caller cancellation")
+
+
+async def test_cancellation_through_an_anyio_scope_still_cleans_up_communicate(
+    tmp_path: Path, monkeypatch
+) -> None:
+    # The SDK cancels a call through an anyio cancel scope, which cancels the task again at
+    # every await. The cleanup in _run_codex's `finally` awaits too, so a second
+    # cancellation must not cut it short: here a descendant that left codex's process group
+    # keeps the pipes open, and a communicate() task nobody cancelled would outlive the call
+    # for as long as that descendant runs.
+    monkeypatch.setattr(server, "PROGRESS_INTERVAL", 0.1)
+    recorder = Recorder()
+    pid_file = tmp_path / "escaped.pid"
+    escaped_code = (
+        'import os, time; open(os.environ["PID_FILE"], "w").write(str(os.getpid())); time.sleep(30)'
+    )
+    leader_code = (
+        "import subprocess, sys, time; "
+        f"subprocess.Popen([sys.executable, '-c', {escaped_code!r}], start_new_session=True); "
+        "time.sleep(30)"
+    )
+    argv = [sys.executable, "-c", leader_code]
+
+    before = asyncio.all_tasks()
+    try:
+        with anyio.CancelScope() as scope:
+            asyncio.get_running_loop().call_later(0.5, scope.cancel)
+            await _run_codex(
+                prompt="p",
+                argv=argv,
+                timeout=20,
+                env_overrides={"PID_FILE": str(pid_file)},
+                report_progress=recorder.report_progress,
+            )
+        assert scope.cancelled_caught, "the cancellation did not reach _run_codex"
+        leaked = {t for t in asyncio.all_tasks() - before if not t.done()}
+        assert not leaked, f"tasks left running after the cancellation: {leaked}"
+    finally:
+        for _ in range(20):
+            if pid_file.exists():
+                break
+            await asyncio.sleep(0.1)
+        if pid_file.exists():
+            with contextlib.suppress(ProcessLookupError):
+                os.kill(int(pid_file.read_text()), 9)