Keep remote exec commands native to the executor

[jif-oai]

Summary

• Remote unified-exec now sends the original command argv to exec-server instead of materializing the orchestrator's sandbox wrapper first.
• Local unified-exec keeps the existing sandbox path unchanged.
• Add a focused regression test for a macOS-selected sandbox producing plain remote argv.

Before:

macOS orchestrator -> /usr/bin/sandbox-exec ... -> Linux exec-server

After:

macOS orchestrator -> /bin/bash -lc pwd -> Linux exec-server

This is intentionally only the first cleanup step. Remote unified-exec commands are sent without a process sandbox until the targeted follow-ups below land. For the macOS-to-Linux path this is not a practical regression: the old sandboxed attempt failed before process launch because the Linux executor could not spawn macOS sandbox paths.

Targeted follow-ups

1. Carry sandbox intent separately from argv.

   • Add an optional sandbox field to exec-server process params.
   • Reuse FileSystemSandboxContext rather than introducing a new sandbox model.
   • Carry managed-network enforcement as one explicit bit.
   • Keep argv plain.

2. Apply that intent inside exec-server.

   • Add a small process-start adapter before LocalProcess::exec.
   • Reuse the existing codex-sandboxing SandboxManager and exec-server runtime paths.
   • Follow the same shape already used by exec-server filesystem sandboxing.
   • Do not duplicate or move the sandbox implementations.

3. Report the sandbox actually used.

   • Return the executor-selected sandbox type from process/start.
   • Use that value in core for sandbox-denial detection and retry behavior.

End state

The orchestrator sends plain commands plus portable sandbox intent. The executor chooses and applies its own native sandbox: Linux executors use Linux sandboxing, macOS executors use Seatbelt, and Windows executors use Windows sandboxing. Concrete wrapper argv, helper paths, and sandbox env markers never cross the executor boundary.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0b7660c330

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jif-oai]

CI is unrelated and due to snapshot_rollback_past_compaction_replays_append_only_history