Stabilize remote full-ci test startup paths

[starr-openai]

Why

After the earlier full-ci fixes, the Docker-backed remote test lane still exposed startup assumptions that do not hold in minimal remote containers: helper paths were inferred from local defaults and remote denial tests requested bash.

Failure evidence: remote Ubuntu test job with uploaded nextest JUnit artifact

What changed

• carry remote Codex and sandbox-helper paths through the remote test harness config
• create custom remote Codex parent directories before docker cp
• publish the remote Codex path only when this script installed that binary
• quote remote exec-server startup paths instead of interpolating them through sh -lc
• run remote network-denial fixtures with sh/non-login shell settings available in the minimal container

CI evidence

Recent failed rust-ci-full test runs that exposed this flake family:

• https://github.com/openai/codex/actions/runs/26115775739
• https://github.com/openai/codex/actions/runs/26114840740
• https://github.com/openai/codex/actions/runs/26114668996
• https://github.com/openai/codex/actions/runs/26113530208

Those failed test lanes uploaded nextest JUnit artifacts successfully. Representative artifacts from the latest run:

• https://github.com/openai/codex/actions/runs/26115775739/artifacts/7091965331
• https://github.com/openai/codex/actions/runs/26115775739/artifacts/7092022050
• https://github.com/openai/codex/actions/runs/26115775739/artifacts/7091820251

Walkthrough

• Issue: the Docker-backed remote lane had startup assumptions that did not hold across steps or minimal containers: the installed remote Codex path was not persisted to the later test step, path quoting was brittle, and remote denial fixtures asked for bash.
• Likely introducing change: remote test env setup around scripts/test-remote-env.sh plus the remote unified-exec fixtures in this PR.
• Fix: use the remote Codex path already provided by the Docker setup, quote remote exec startup paths safely, use sh/non-login shell settings, and keep the remote harness pointed at the binary the script actually installed.

Verification

• unstacked the PR onto current origin/main; GitHub now shows base main and a one-commit standalone diff containing only the intended three files
• focused remote-env verification passed for both installed custom-path mode and external exec-server mode on the standalone source snapshot
• current CI is green on the standalone PR head

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 094370503d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Create the custom remote Codex directory

When CODEX_TEST_REMOTE_CODEX_PATH is set to a path outside /tmp/codex-remote-env, this assignment is accepted but setup_remote_env still only creates /tmp/codex-remote-env before docker cp. Docker does not create missing parent directories for a container destination, so a value like CODEX_TEST_REMOTE_CODEX_PATH=/opt/codex-test/codex fails before the remote tests start; create dirname "$remote_codex_path" in the container before copying/linking the binary.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Require an installed Codex path for external exec servers

When this script is sourced with CODEX_TEST_REMOTE_EXEC_SERVER_URL already set, the copy/link block is skipped, but this new default is still exported and the test harness now uses it for config.codex_self_exe and config.codex_linux_sandbox_exe. In that external-server mode there is no guarantee that /tmp/codex-remote-env/codex exists on the remote host, so tests that re-enter Codex or sandbox filesystem helpers can fail with a missing helper path; only set/export this default when the script installs the binary, or require callers with a preexisting exec server to provide a valid remote path.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Keep the leak check longer than the sideband delay

With the sideband accept delay increased to 5 seconds, this test still only waits 700 ms before asserting that no stale event or handshake occurred and then shuts the fake websocket server down. If closing the conversation fails to abort the pending sideband connect, the leaked task will remain blocked in this delay and only surface after the 5-second accept completes, so the regression this test is meant to catch now passes; wait past the configured delay or use a shorter delay than the stale-event timeout.

Useful? React with 👍 / 👎.