codex: the CLI install is the one pre-agent installer not on the shared retry window

[tend-agent]

install-claude-binary.sh and install-proxy-uv.sh both retry their CDN fetch on the shared window in shared/steps/lib/retry.sh (#906, #907, #908). The Codex harness has a third pre-agent installer that isn't on it: codex/action.yaml:120-124 runs npm install -g "@openai/codex@${{ inputs.codex_version }}" bare — one attempt, no timeout, no backoff.

The failure mode is the one the shared window exists for. The step runs ahead of Run Codex, so an npm registry blip costs the whole run: the job goes red having done none of the work the trigger asked for, exactly as a CDN blip on claude.ai did before #906. Five steps sit ahead of the agent in that action (security preflight, rate-limit preflight, auth validation, the CLI install, plugin install, AGENTS.md staging), and this is the only one that reaches out to a third-party registry.

Proposed fix

retry_install can't be called from where the install currently lives — it's an inline run: block, and the lib is only reachable from a script under shared/steps/. So the change is an extraction first, matching what install-proxy-uv.sh already does:

# shared/steps/install-codex-cli.sh
set -euo pipefail
SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
# shellcheck source=lib/retry.sh
. "${SCRIPT_DIR}/lib/retry.sh"

retry_install "codex ${CODEX_VERSION}" "npm install -g '@openai/codex@${CODEX_VERSION}'"
codex --version

with the action step becoming a run: bash "${{ github.action_path }}/../shared/steps/install-codex-cli.sh" plus env: CODEX_VERSION: ${{ inputs.codex_version }}.

One thing to settle first

retry_install hardcodes timeout 60, which suits a curl | sh that fetches a single installer script. A global npm install resolves and unpacks a dependency tree, and I haven't measured how long @openai/codex takes on a cold runner — if it can legitimately exceed 60s, dropping it under the current lib would convert slow installs into failures rather than riding out blips. Whoever picks this up should time the install on a runner and either confirm 60s is generous or add an optional third parameter (retry_install LABEL COMMAND [TIMEOUT], defaulting to 60) before wiring codex in.

Raised in the review of #908, where the shared lib lands.

[tend-agent]

Fixed in #910, stacked on #908 where lib/retry.sh lands — it'll retarget to main when #908 merges. The extraction is the one proposed here: shared/steps/install-codex-cli.sh sourcing the lib the way install-proxy-uv.sh does, with CODEX_VERSION passed through env: rather than interpolated into the run: body.

On the thing to settle first — 60s stands, no third parameter. Three cold installs of @openai/codex@0.131.0-alpha.22 on a GitHub-hosted runner with an empty npm cache: 3.08s, 2.60s, 2.63s (218 MB unpacked, 2 packages). @openai/codex ships a prebuilt per-platform binary, so the shape that would justify a longer window — a dependency tree to resolve, a toolchain to run — isn't there. ~20x headroom under the current lib. The measurement and its date are in the new script's header so a future version bump can re-check it rather than re-derive it.

One adjacent gap that surfaced reviewing #910, not covered by it: the enumeration in lib/retry.sh's header counts three pre-agent third-party reaches, but there's a fourth. proxy/setup-sandbox.sh:319 warms the uvx cache with "$UVX" --from "$MITMPROXY" mitmdump --version (MITMPROXY being mitmproxy==${MITMPROXY_VERSION}), which resolves from PyPI on a cold UV_CACHE_DIR under set -euo pipefail, ahead of the agent step in the Claude action. The cache key is tend-mitmproxy-${{ runner.os }}-${{ inputs.mitmproxy_version }}, so a miss is guaranteed on the first run after every mitmproxy_version bump — the weekly-bump PR is precisely when a PyPI blip would cost a run. Wrong PR to fix it in (different harness, atomic PRs), so it's filed separately as #911 — which is also where the retry_install LABEL COMMAND [TIMEOUT] question raised here may come back, since a cold mitmproxy resolve is a real dependency tree rather than a prebuilt binary.