fix: avoid extra codex health prompts

Author: 777genius

README.md

@@ -134,13 +134,6 @@ jobs:
             chmod 600 ~/.codex/config.toml
           fi
 
-      - name: Verify Codex OAuth headless mode
-        env:
-          CODEX_MODEL: ${{ vars.REVIEW_CODEX_MODEL }}
-        run: |
-          codex exec --model "$CODEX_MODEL" --sandbox read-only --ephemeral --ignore-user-config -c approval_policy=never -c model_reasoning_effort='"low"' --output-last-message /tmp/codex-smoke.txt "Respond with exactly: codex-oauth-ok"
-          grep -q "codex-oauth-ok" /tmp/codex-smoke.txt
-
       - name: Run ReviewRouter
         uses: 777genius/review-router@v1
         env:
@@ -150,6 +143,7 @@ jobs:
           PR_NUMBER: ${{ github.event.pull_request.number || inputs.pr_number }}
           CODEX_MODEL: ${{ vars.REVIEW_CODEX_MODEL }}
           CODEX_REASONING_EFFORT: 'medium'
+          CODEX_HEALTHCHECK_MODE: 'binary'
           CODEX_AGENTIC_CONTEXT: 'true'
           FAIL_ON_NO_HEALTHY_PROVIDERS: 'true'
           INLINE_MAX_COMMENTS: '5'

__tests__/e2e/install-script.e2e.test.ts

@@ -220,14 +220,15 @@ describe('review-router curl installer e2e', () => {
     expect(workflow).toContain(
       'CODEX_AUTH_JSON: ${{ secrets.CODEX_AUTH_JSON }}'
     );
-    expect(workflow).toContain('codex-oauth-ok');
+    expect(workflow).not.toContain('codex-oauth-ok');
     expect(workflow).toContain('CODEX_MODEL: ${{ vars.REVIEW_CODEX_MODEL }}');
     expect(workflow).not.toContain(
       'REVIEW_PROVIDERS: ${{ vars.REVIEW_PROVIDERS }}'
     );
     expect(workflow).toContain("INLINE_MAX_COMMENTS: '5'");
     expect(workflow).toContain("INLINE_MIN_SEVERITY: 'major'");
     expect(workflow).toContain("CODEX_REASONING_EFFORT: 'medium'");
+    expect(workflow).toContain("CODEX_HEALTHCHECK_MODE: 'binary'");
     expect(workflow).toContain("CODEX_AGENTIC_CONTEXT: 'true'");
     expect(workflow).toContain('UPDATE_PR_DESCRIPTION:');
     expect(workflow).toContain("FAIL_ON_CRITICAL: 'true'");
@@ -473,7 +474,8 @@ describe('review-router curl installer e2e', () => {
     expect(result.status).toBe(0);
     const workflow = workflowText(result.workflowPath);
     expect(workflow).toContain('OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}');
-    expect(workflow).toContain('codex-api-ok');
+    expect(workflow).toContain('Validate OpenAI API key secret');
+    expect(workflow).not.toContain('codex-api-ok');
     expect(workflow).toContain('CODEX_MODEL: ${{ vars.REVIEW_CODEX_MODEL }}');
     expect(workflow).not.toContain(
       'REVIEW_PROVIDERS: ${{ vars.REVIEW_PROVIDERS }}'
@@ -484,6 +486,7 @@ describe('review-router curl installer e2e', () => {
     expect(workflow).toContain("FAIL_ON_MAJOR: 'true'");
     expect(workflow).not.toContain('FAIL_ON_SEVERITY:');
     expect(workflow).toContain("CODEX_REASONING_EFFORT: 'high'");
+    expect(workflow).toContain("CODEX_HEALTHCHECK_MODE: 'binary'");
     expect(workflow).toContain("CODEX_AGENTIC_CONTEXT: 'true'");
     expect(workflow).toContain("GRAPH_ENABLED: 'true'");
     expect(workflow).not.toContain('CODEX_AUTH_JSON');

__tests__/unit/providers/codex-provider.test.ts

@@ -61,6 +61,47 @@ describe('CodexProvider', () => {
     expect(args).not.toContain('--dangerously-bypass-approvals-and-sandbox');
   });
 
+  it('uses binary-only health checks by default to avoid consuming Codex usage', async () => {
+    spawnMock.mockImplementation((_cmd: string, _args: string[]) =>
+      createMockProcess()
+    );
+
+    const provider = new CodexProvider('gpt-5.4-mini');
+    await expect(provider.healthCheck(1000)).resolves.toBe(true);
+
+    expect(spawnMock).toHaveBeenCalledTimes(1);
+    expect(spawnMock.mock.calls[0][0]).toBe('codex');
+    expect(spawnMock.mock.calls[0][1]).toEqual(['--version']);
+    expect(
+      spawnMock.mock.calls.some(
+        (call) => Array.isArray(call[1]) && call[1][0] === 'exec'
+      )
+    ).toBe(false);
+  });
+
+  it('supports explicit exec health checks when requested', async () => {
+    process.env.CODEX_HEALTHCHECK_MODE = 'exec';
+    spawnMock.mockImplementation((_cmd: string, args: string[]) => {
+      if (args.includes('--version')) {
+        return createMockProcess();
+      }
+
+      return createMockProcess(() => {
+        const outputIndex = args.indexOf('--output-last-message');
+        fs.writeFileSync(args[outputIndex + 1], 'codex-health-ok');
+      });
+    });
+
+    const provider = new CodexProvider('gpt-5.4-mini');
+    await expect(provider.healthCheck(1000)).resolves.toBe(true);
+
+    const execCall = spawnMock.mock.calls.find(
+      (call) => Array.isArray(call[1]) && call[1][0] === 'exec'
+    );
+    expect(execCall).toBeTruthy();
+    expect(execCall?.[1]).toContain('gpt-5.4-mini');
+  });
+
   it('can disable interactive/tool features for isolated discussion prompts', () => {
     const provider = new CodexProvider('gpt-5.4-mini');
     const args = (provider as any).buildExecArgs({

action.yml

@@ -113,7 +113,7 @@ inputs:
   CODEX_HEALTHCHECK_MODE:
     description: "Codex provider health check mode: exec, binary, or none"
     required: false
-    default: "exec"
+    default: "binary"
   CODEX_HEALTHCHECK_REASONING_EFFORT:
     description: "Codex reasoning effort used for health checks"
     required: false

dist/index.js

@@ -13152,12 +13152,12 @@ var CodexProvider = class extends Provider {
     this.model = model;
     this.options = options;
   }
-  // Verify the CLI is available and, by default, that the selected model works
-  // with the current Codex auth. Binary-only checks can mark unsupported models
-  // as healthy, which then creates green "no provider" review runs.
+  // Verify the CLI is available. Model/auth failures are surfaced by the real
+  // review call; a model-exec health check costs an extra Codex subscription
+  // request and can exhaust limited OAuth usage before review starts.
   async healthCheck(_timeoutMs = 5e3) {
     const timeoutMs = Math.max(500, _timeoutMs ?? 5e3);
-    const mode = (process.env.CODEX_HEALTHCHECK_MODE || "exec").toLowerCase();
+    const mode = (process.env.CODEX_HEALTHCHECK_MODE || "binary").toLowerCase();
     let timeoutId;
     let isTimedOut = false;
     const timeoutPromise = new Promise((_, reject) => {
@@ -27206,7 +27206,7 @@ function failureDetails(kind) {
         summary: "The Codex CLI could not run successfully in CI.",
         steps: [
           "Verify the workflow installs `@openai/codex` before running ReviewRouter.",
-          "Check the `Verify Codex OAuth headless mode` or `Verify Codex API key headless mode` step.",
+          "Check the ReviewRouter run logs for the Codex CLI error. Usage-limit errors usually need a later rerun or a lower-cost model.",
           "If this is a model issue, verify `REVIEW_CODEX_MODEL` is a current supported Codex model."
         ]
       };
@@ -27215,7 +27215,7 @@ function failureDetails(kind) {
         summary: "No configured review provider passed the health check.",
         steps: [
           "Check provider credentials and model variables.",
-          "For Codex OAuth, verify the smoke step can run `codex exec` headlessly.",
+          "For Codex OAuth, verify `CODEX_AUTH_JSON` is present and the account has available Codex usage.",
           "For OpenRouter or OpenAI API mode, verify the API key secret is available to this repository."
         ]
       };

dist/index.js.map

@@ -222,15 +222,21 @@ By default, the installer does not copy `~/.codex/config.toml`. Local Codex conf
 REVIEW_ROUTER_INCLUDE_CODEX_CONFIG=1 bash scripts/install.sh
 ```
 
-The generated workflow installs the official Codex CLI and runs a headless smoke check before review:
+The generated workflow installs the official Codex CLI and restores OAuth credentials before review. It does not run a separate headless smoke prompt by default because that would consume an extra Codex subscription request on every PR run and rerun.
 
 ```yaml
-- name: Verify Codex OAuth headless mode
+- name: Restore Codex OAuth config
+  env:
+    CODEX_AUTH_JSON: ${{ secrets.CODEX_AUTH_JSON }}
   run: |
-    codex exec --model "$CODEX_MODEL" --sandbox read-only --ephemeral --ignore-user-config -c approval_policy=never -c model_reasoning_effort='"low"' --output-last-message /tmp/codex-smoke.txt "Respond with exactly: codex-oauth-ok"
-    grep -q "codex-oauth-ok" /tmp/codex-smoke.txt
+    test -n "$CODEX_AUTH_JSON"
+    mkdir -p ~/.codex
+    printf '%s' "$CODEX_AUTH_JSON" > ~/.codex/auth.json
+    chmod 600 ~/.codex/auth.json
 ```
 
+ReviewRouter uses a binary-only Codex health check by default. The real review call is the authoritative auth/model check. If you explicitly want an extra model-exec health check, set `CODEX_HEALTHCHECK_MODE=exec`, but expect higher subscription usage.
+
 Use this only in trusted automation. Do not put personal Codex OAuth credentials into public/open-source repos where untrusted workflow changes can access secrets. GitHub does not expose repository secrets to fork PR workflows by default, and the generated workflow skips fork PRs by default.
 
 Default Codex model:

docs/install.md

@@ -1117,25 +1117,15 @@ YAML
             printf '%s' "$CODEX_CONFIG_TOML" > ~/.codex/config.toml
             chmod 600 ~/.codex/config.toml
           fi
-
-      - name: Verify Codex OAuth headless mode
-        env:
-          CODEX_MODEL: ${{ vars.REVIEW_CODEX_MODEL }}
-        run: |
-          codex exec --model "$CODEX_MODEL" --sandbox read-only --ephemeral --ignore-user-config -c approval_policy=never -c model_reasoning_effort='"low"' --output-last-message /tmp/codex-smoke.txt "Respond with exactly: codex-oauth-ok"
-          grep -q "codex-oauth-ok" /tmp/codex-smoke.txt
 YAML
     elif [ "$AUTH_MODE" = "openai" ]; then
       cat <<'YAML'
 
-      - name: Verify Codex API key headless mode
+      - name: Validate OpenAI API key secret
         env:
-          CODEX_MODEL: ${{ vars.REVIEW_CODEX_MODEL }}
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
         run: |
           test -n "$OPENAI_API_KEY"
-          codex exec --model "$CODEX_MODEL" --sandbox read-only --ephemeral --ignore-user-config -c approval_policy=never -c model_reasoning_effort='"low"' --output-last-message /tmp/codex-smoke.txt "Respond with exactly: codex-api-ok"
-          grep -q "codex-api-ok" /tmp/codex-smoke.txt
 YAML
     fi
 
@@ -1198,6 +1188,7 @@ YAML
 YAML
       cat <<YAML
           CODEX_REASONING_EFFORT: '$CODEX_REASONING_EFFORT'
+          CODEX_HEALTHCHECK_MODE: 'binary'
           CODEX_AGENTIC_CONTEXT: 'true'
 YAML
     elif [ "$AUTH_MODE" = "openrouter" ]; then

scripts/install.sh

@@ -115,7 +115,7 @@ function failureDetails(kind: FailureKind): { summary: string; steps: string[] }
         summary: 'The Codex CLI could not run successfully in CI.',
         steps: [
           'Verify the workflow installs `@openai/codex` before running ReviewRouter.',
-          'Check the `Verify Codex OAuth headless mode` or `Verify Codex API key headless mode` step.',
+          'Check the ReviewRouter run logs for the Codex CLI error. Usage-limit errors usually need a later rerun or a lower-cost model.',
           'If this is a model issue, verify `REVIEW_CODEX_MODEL` is a current supported Codex model.',
         ],
       };
@@ -124,7 +124,7 @@ function failureDetails(kind: FailureKind): { summary: string; steps: string[] }
         summary: 'No configured review provider passed the health check.',
         steps: [
           'Check provider credentials and model variables.',
-          'For Codex OAuth, verify the smoke step can run `codex exec` headlessly.',
+          'For Codex OAuth, verify `CODEX_AUTH_JSON` is present and the account has available Codex usage.',
           'For OpenRouter or OpenAI API mode, verify the API key secret is available to this repository.',
         ],
       };

src/github/failure-summary.ts

@@ -38,12 +38,12 @@ export class CodexProvider extends Provider {
     super(`codex/${model}`);
   }
 
-  // Verify the CLI is available and, by default, that the selected model works
-  // with the current Codex auth. Binary-only checks can mark unsupported models
-  // as healthy, which then creates green "no provider" review runs.
+  // Verify the CLI is available. Model/auth failures are surfaced by the real
+  // review call; a model-exec health check costs an extra Codex subscription
+  // request and can exhaust limited OAuth usage before review starts.
   async healthCheck(_timeoutMs: number = 5000): Promise<boolean> {
     const timeoutMs = Math.max(500, _timeoutMs ?? 5000);
-    const mode = (process.env.CODEX_HEALTHCHECK_MODE || 'exec').toLowerCase();
+    const mode = (process.env.CODEX_HEALTHCHECK_MODE || 'binary').toLowerCase();
 
     let timeoutId: NodeJS.Timeout;
     let isTimedOut = false;