A Codex app-server that ignores SIGTERM can hold session close and server shutdown indefinitely #34458

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Area

apps/server

Steps to reproduce

makeCodexAppServerSpawnCommand builds the app-server's ChildProcess.make without
forceKillAfter. A stand-in that ignores SIGTERM shows the effect:

1. Spawn /bin/sh -c "trap '' TERM; echo ready; while :; do sleep 1; done" through
   makeCodexAppServerSpawnCommand and wait for ready.
2. Close the scope that owns it, as session close and server shutdown do.

Expected behavior

The process is asked to stop, and killed when it does not, as the Codex probe in CodexProvider
does (forceKillAfter: "2 seconds").

Actual behavior

Effect's spawner sends SIGTERM to the process group and then waits for the leader to exit with no
time limit, so Scope.close does not return while the process runs. A real app-server only hits
this when it does not exit on SIGTERM (stuck, or ignoring the signal), but nothing bounds the wait
when it happens.

#20973 (closed, unmerged) addressed the same mechanism for ProcessRunner and helpers; this direct
app-server spawn is not covered by it.

Impact

Minor bug or occasional failure

Version or commit

main at 7e565c5

Environment

macOS 26; the spawner behaviour is the same on Linux. Windows stops processes with
taskkill /T /F.

Logs or stack traces

None; a regression test is in the linked PR.