Fix action hang when descendants keep stdio open

[Ce1ling]

Summary

• isolate the Codex process tree behind action-owned stdout and stderr pipes while preserving live log forwarding
• complete runCodexExec from the direct child process exit and close the private pipes so surviving descendants cannot keep the runner transport open
• add a regression test where fake Codex writes its final result, exits successfully, and leaves a descendant holding inherited stdio

The Linux sudo -> sh -> setpriv -> env privilege-isolation chain is unchanged. The fix only changes the boundary between that process tree and the action runner's log streams.

Fixes #150.

Root cause

runCodexExec passed the runner's stdout and stderr descriptors directly to the entire Codex process tree. A descendant that survived the direct Codex process could retain those descriptors after the result had been written, preventing the GitHub Actions runner from observing the end of its log transport.

Waiting for Node's close event also couples command completion to inherited stream closure. The action now forwards private child pipes and uses the direct child's exit event as the command result, then tears down those private pipes.

Test plan

• corepack pnpm run check
• corepack pnpm test (145 tests: 142 passed, 3 platform-dependent skips)
• regression proof with the production fix temporarily removed: the focused test fails after 2 seconds with ETIMEDOUT
• focused test with the fix restored: passes in about 0.5-0.8 seconds and preserves stdout, stderr, and final-message
• git diff --check

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[Ce1ling]

I have read the CLA Document and I hereby sign the CLA

[Ce1ling]

Issue #150 has been fixed upstream in Codex CLI 0.150.0, so this PR is no longer strictly necessary.
It may still be useful as a defensive fix, but it may also make sense to close it. I’ll leave that decision to the maintainers.

Either way, thanks for tracking this down and getting the CLI fix out so quickly.

[Ce1ling]

Quick update: based on the reports in #169, the hang still reproduces even with Codex CLI 0.150.1, so this wrapper-level fix still seems necessary.
Could you please take another look and let me know whether this should be merged, or if any changes are needed?

[johangp]

I can confirm the same issue it hangs with v1.12. It's not related to the CLI version as I tried different ones. I'd to pin the Codex Action to v1.11

[sylvesterkaczmarek]

Switching completion to exit fixes the descendant-FD hang, but destroying stdout/stderr in the exit handler can lose output. exit can fire before the child pipes have drained, so a larger final write may still be buffered when closeOutputStreams() unpipes and destroys them. The current regression only writes tiny log lines. Could we drain already-buffered output after the direct child exits without waiting for descendant-held EOF, and add a large final stdout/stderr regression?

[Ce1ling]

I pushed an update based on your feedback.The action now waits briefly after the direct child exits to let buffered stdout/stderr drain, without waiting for EOF from descendants that may still hold the pipes open.

I also added a regression test with large final stdout/stderr output, including the descendant-held-stdio case.
The drain is bounded to 1 second so a stuck descendant or runner backpressure cannot hang the action indefinitely.

pnpm run check and the full test suite are passing. Could you take another look?

[sylvesterkaczmarek]

The process-completion boundary looks sound. Using the direct child exit event avoids coupling completion to descendant-held descriptors, while the bounded drain preserves already-buffered stdout/stderr without reintroducing an indefinite wait. The regression coverage exercises both inherited stdio and large final output. No blocking issues found.

[Ce1ling]

Thanks for the review. The PR is ready from my side — please merge when convenient.

[nicolas-bourdeau]

🔴 Blocking: the new regression test fails in the GitHub Actions environment because GITHUB_OUTPUT is inherited by the fake Codex runner (test/runCodexExec.test.mjs:113-119). @actions/core.setOutput("final-message", ...) therefore writes to that file, not to result.stdout, but the test asserts /fake final message/ in stdout at test/runCodexExec.test.mjs:142. Reproduced with GITHUB_OUTPUT="$(mktemp)" node --test test/runCodexExec.test.mjs: the first test fails while the large-output test passes. Please either clear GITHUB_OUTPUT for this subprocess or assert the final-message output from a temporary output file; then rerun the CI-equivalent suite.

[Ce1ling]

@nicolas-bourdeau Thanks for reviewing this.

I've fixed the test issue in f93255f, and the full test suite passes locally with GITHUB_OUTPUT set.
The CI run is waiting for approval, could you please authorize it when you have a moment?

[Ce1ling]

Hi @viyatb-oai,

Thanks again for getting the CLI-side fix out for this in #150. It's still reproducing in the reports from #169 and #172, so this wrapper-level fix still looks necessary. runCodexExec now completes on the direct child's exit instead of waiting for descendants to release stdio, with a regression test for that case.

The one thing still blocking is CI, since the Verify TypeScript Build run needs a maintainer to approve it on a fork PR. Could you please take a look, approve the run, and let me know whether you'd want this merged? Tests pass locally and the branch is on current main.