How one-shot codex subprocesses are executed.

Command.run/3 routes every synchronous command (Exec, ExecResume, Review, CodexWrapper.exec/2) through the configured runner. The default is CodexWrapper.Runner.Port, the /bin/sh-with-closed-stdin Port the library has always used.

For leak-free execution -- where a timeout or BEAM death kills the whole codex process group (the CLI and every stdio MCP server it spawned) rather than abandoning it -- add forcola to your deps and select its runner:

# mix.exs
{:forcola, "~> 0.3.5 or ~> 0.4.0"}

# config/config.exs
config :codex_wrapper, runner: CodexWrapper.Runner.Forcola

Runner.Forcola only compiles when forcola is present, so the dependency stays optional. See #48.

Contract

run/4 returns {:ok, {stdout, exit_code}} on completion (a non-zero exit is not an error -- callers decide what an exit code means), {:error, :timeout} when the timeout elapsed, and other {:error, reason} tuples for spawn/signal/io failures.

stream_lines/4 returns a lazy Enumerable of stdout lines for the NDJSON paths (Exec.stream/2, ExecResume.stream/2, Review.stream/2, and Session.stream/3 through the first two). Lines arrive without their trailing newline, stderr is never merged into them, and the stream ends when the process exits. A deadline emits a final {:error, {:timeout, ms}} or {:error, {:idle_timeout, ms}} item.

A non-zero exit ends the stream without raising, on either runner -- the same silent-halt the streaming paths have always had. Callers that need the exit code should use execute/2 rather than stream/2.