Function run_codex_cancellable 

pub async fn run_codex_cancellable<C>(
    codex: &Codex,
    args: Vec<String>,
    cancel: C,
) -> Result<CommandOutput>
where
    C: Future<Output = ()> + Send,

Run a codex command, stopping it gracefully if cancel resolves first.

On cancellation the run’s process group is sent SIGTERM, given the client’s termination_grace, then killed. Signalling the group rather than the pid is what reaches the subprocesses codex started for tool use; killing only the direct child leaves those running (#78).

Dropping the future instead is still safe, and still kills the group, but abruptly: Drop cannot wait out a grace period.

Retry does not apply. A cancelled run is a decision, not a transient failure.

On platforms without process groups this degrades to killing the child.