Standardize shell execution on unified exec (#39757)

## What changed

- Remove the legacy `shell_command` handler and runtime, leaving `exec_command`
  and `write_stdin` as the shell execution tools.
- Treat legacy `shell_command` model metadata as `unified_exec`, and normalize
  legacy user opt-outs so they do not disable command execution. Managed feature
  requirements and `shell_tool` can still disable it.
- Preserve shell approvals, sandboxing, zsh-fork support, and output truncation
  through the unified execution path.

## Testing

- Cover legacy configuration and model-metadata compatibility.
- Exercise unified shell execution, approvals, truncation, and `apply_patch`
  serialization across the app-server and core test suites.

GitOrigin-RevId: 5c2fd6164fc3519cdae4944cb9db276b8467311c

codex-rs/mcp-server/tests/common/lib.rs

@@ -10,5 +10,5 @@ pub use core_test_support::format_with_current_shell_non_login;
 pub use mcp_process::McpProcess;
 pub use mock_model_server::create_mock_responses_server;
 pub use responses::create_apply_patch_sse_response;
+pub use responses::create_command_execution_sse_response;
 pub use responses::create_final_assistant_message_sse_response;
-pub use responses::create_shell_command_sse_response;

codex-rs/mcp-server/tests/common/responses.rs

@@ -3,24 +3,27 @@ use std::path::Path;
 use core_test_support::responses;
 use serde_json::json;
 
-pub fn create_shell_command_sse_response(
+pub fn create_command_execution_sse_response(
     command: Vec<String>,
     workdir: Option<&Path>,
     timeout_ms: Option<u64>,
     call_id: &str,
 ) -> anyhow::Result<String> {
     let command_str = shlex::try_join(command.iter().map(String::as_str))?;
-    let arguments = serde_json::to_string(&json!({
-        "command": command_str,
+    let mut tool_call_arguments = json!({
+        "cmd": command_str,
         "workdir": workdir.map(|w| w.to_string_lossy()),
-        "timeout_ms": timeout_ms,
         "sandbox_permissions": "require_escalated",
         "justification": "Test approval request.",
-    }))?;
+    });
+    if let Some(timeout_ms) = timeout_ms {
+        tool_call_arguments["yield_time_ms"] = json!(timeout_ms);
+    }
+    let arguments = serde_json::to_string(&tool_call_arguments)?;
     let response_id = format!("resp-{call_id}");
     Ok(responses::sse(vec![
         responses::ev_response_created(&response_id),
-        responses::ev_function_call(call_id, "shell_command", &arguments),
+        responses::ev_function_call(call_id, "exec_command", &arguments),
         responses::ev_completed(&response_id),
     ]))
 }
@@ -39,11 +42,11 @@ pub fn create_apply_patch_sse_response(
     call_id: &str,
 ) -> anyhow::Result<String> {
     let command = format!("apply_patch <<'EOF'\n{patch_content}\nEOF");
-    let arguments = serde_json::to_string(&json!({ "command": command }))?;
+    let arguments = serde_json::to_string(&json!({ "cmd": command }))?;
     let response_id = format!("resp-{call_id}");
     Ok(responses::sse(vec![
         responses::ev_response_created(&response_id),
-        responses::ev_function_call(call_id, "shell_command", &arguments),
+        responses::ev_function_call(call_id, "exec_command", &arguments),
         responses::ev_completed(&response_id),
     ]))
 }