chore(codex): add cloud environment setup script

[aram-devdocs]

Summary

• Adds scripts/codex-setup.sh as the single source of truth for the OpenAI Codex Cloud environment at chatgpt.com/codex.
• Codex UI runs bash scripts/codex-setup.sh — all install behavior flows through this file rather than the UI, so changes land via PR.
• Mirrors the Ubuntu CI lanes in .github/workflows/ci.yml: apt deps (GL, X11, ALSA, Vulkan), .NET 8 SDK, rustup components (rustfmt/clippy + wasm32 target), pinned wasm-pack 0.13.1, npm install for the TS SDK, plus cargo fetch and a core build to prime target/ for the network-isolated agent phase.
• Persists CMAKE_POLICY_VERSION_MINIMUM=3.5 and PATH into ~/.bashrc because setup-phase exports don't cross into the agent shell.

Codex UI config to pair with this script

Field	Value
Container image	universal
Setup script	Manual → bash scripts/codex-setup.sh
Container caching	On
Agent internet access	Off (setup pre-fetches all deps)
Env: CODEX_ENV_RUST_VERSION	1.92.0
Env: CODEX_ENV_PYTHON_VERSION	3.11
Env: CODEX_ENV_NODE_VERSION	20
Env: CODEX_ENV_GO_VERSION	1.22
Env: CODEX_ENV_JAVA_VERSION	17
Env: CMAKE_POLICY_VERSION_MINIMUM	3.5

Test plan

• Save environment in Codex UI pointing at bash scripts/codex-setup.sh, with caching On.
• Trigger a task; verify setup phase runs green through apt / .NET / rust / wasm-pack / npm / cargo fetch / cargo build.
• In the agent phase run cargo check --workspace, ./codegen.sh, and xvfb-run cargo test and confirm they work without internet.
• Edit a trivial line in scripts/codex-setup.sh, confirm Codex invalidates the cache and reruns it.

🤖 Generated with Claude Code

[claude]

Claude finished @aram-devdocs's task in 1m 51s —— View job

---

Code Review — scripts/codex-setup.sh

• Gather context (PR metadata, files changed)
• Read scripts/codex-setup.sh
• Compare against CI workflow configuration
• Perform 7-phase review
• Post final review

---

Verdict: APPROVED with warnings — No blockers. A few gaps worth addressing before the first real Codex task run.

---

Phase 1 — Context

Infrastructure-only change: single new shell script, no Rust/FFI/SDK/engine layers touched. PR type: chore. Architecture invariants don't apply.

---

Phase 2 — Architecture

Not applicable (no Rust source changes).

---

Phase 3 — Anti-Pattern Scan

No shell anti-patterns (no unquoted expansions, no set omission, no rm -rf / risk).

---

Phase 4 — Quality Assessment

Strong positives:

• set -euo pipefail on line 12 — excellent safety default
• Idempotent guards on dotnet, rustup, and wasm-pack (checks before installing)
• .bashrc uses a start/end marker pair to prevent duplicate injection
• npm ci (not npm install) — deterministic, lockfile-respecting
• cargo fetch --locked — correct choice for seeding an offline registry
• shellcheck disable=SC1091 comments on sourced files — shows awareness of static analysis

---

Phase 5 — Warnings (non-blocking)

#	Location	Issue
W1	Line 71	wasm-pack URL hardcodes x86_64 — if Codex ever provisions arm64 containers, this silently downloads the wrong binary and wasm-pack won't run. Consider probing with $(uname -m) and mapping to the musl target triple.
W2	Lines 54–63	CODEX_ENV_RUST_VERSION is documented in the PR table but never used — rustup component add targets whatever stable resolves to at install time. If the codex-universal image has 1.92.0 active, the fallback install path installs stable (potentially newer/different). The components will be added to the right toolchain if codex-universal already has rustup, but on a clean image the pinned version is lost. Consider rustup override set "${CODEX_ENV_RUST_VERSION:-stable}" after the rustup block.
W3	Lines 84–87	Playwright / Chromium not pre-fetched — npm ci installs the Playwright package but not the Chromium binary. CI runs npx playwright install --with-deps chromium before any browser-based test (xvfb-run npm run test:native, npm run coverage:native, web smoke). In the offline agent phase these will fail trying to download Chromium. Either add (cd sdks/typescript && npx playwright install --with-deps chromium) to the setup, or explicitly note in the script that browser tests are out of scope for the Codex agent.
W4	Line 113	Partial workspace pre-build — cargo build -p goud-engine-core -p goud-engine primes the two packages needed for codegen, but the agent-phase cargo check --workspace and xvfb-run cargo test will still need to compile the remaining workspace crates cold. This is correct for the stated goal ("builds ffi_manifest.json"), but the test plan implies cargo test will work fully offline; consider whether the wider workspace needs pre-building too.

---

Phase 6 — CI Parity Check

Compared every Ubuntu apt-get install line in ci.yml against the script:

Package	Script	CI
libgl1-mesa-dev, libglu1-mesa-dev	✅	✅
libxrandr-dev … libxxf86vm-dev	✅	✅
libxkbcommon-x11-dev	✅	✅ (most jobs; missing in preflight — pre-existing CI inconsistency, not introduced here)
libasound2-dev libudev-dev	✅	✅
libvulkan-dev mesa-vulkan-drivers	✅ script only	Not in CI (fine, defensive)
lua5.4 liblua5.4-dev	✅ script only	lua-sdk-check installs lua5.4 separately
xvfb	✅	✅ (sandbox-parity)
cmake pkg-config	✅ script only	cmake added per-job in C/C++ jobs
wasm-pack version	0.13.1 ✅	0.13.1 ✅
.NET version	8.0 ✅	8.0.x ✅

No meaningful gaps.

---

Phase 7 — Scope Verification

Changes match the PR description exactly. No unrelated files modified. No version bump needed (scripts dir only).

---

Summary

This is a well-written, operationally sound setup script. The three things worth fixing before your first real Codex task run are:

1. W3 (Playwright) — most likely to cause a confusing silent failure when running TypeScript SDK tests offline. Fix this →
2. W2 (Rust version pinning) — ensures the agent toolchain matches CODEX_ENV_RUST_VERSION=1.92.0.
3. W1 (architecture) — low risk today but cheap to future-proof.