Module codex_spawn 

Codex CLI spawn + JSONL parsing helper shared by enrich and ingest --mode codex.

G31 (v1.0.69): enrich --mode codex was missing five critical hardening flags compared to ingest --mode codex. This module extracts the spawn pipeline into a single helper that BOTH call-sites consume, guaranteeing the same defaults everywhere.

G32 (v1.0.69): enrich --mode codex used serde_json::from_str on the raw stdout, but codex exec --json emits JSONL (one event per line). parse_codex_jsonl iterates line-by-line, picking the last item.completed of type agent_message as the assistant text.

G33 (v1.0.69): validate the model against the ChatGPT Pro OAuth whitelist stored in ~/.codex/models_cache.json BEFORE spawning the subprocess.

Structs

CodexResult

Combined result of one codex exec invocation.

CodexSpawnArgs

Configuration for the codex spawner.

CodexUsage

Token usage reported by Codex on turn.completed events.

Constants

CODEX_PRO_OAUTH_MODELS

Models accepted by Codex CLI when using ChatGPT Pro OAuth.

Functions

build_codex_command

Builds the codex exec command with the canonical hardening flags.

list_codex_models

Returns the list of models accepted by Codex with ChatGPT Pro OAuth.

parse_codex_jsonl

Parses JSONL output from codex exec --json.

parse_extraction_text

Parses the agent_message text as an ExtractionResult JSON payload.

suggest_codex_model

Suggests the closest codex OAuth model to a user-supplied substring (G33). Returns None when no candidate is close enough.

trusted_schema_path

Computes a schema path under the cache dir so codex exec accepts it as part of a trusted directory (rejects /tmp on hardened installs).

validate_codex_model

Validates the requested model against CODEX_PRO_OAUTH_MODELS.