Fix CI ripgrep auth scope and effort tests

Scope GITHUB_TOKEN to the explicit ripgrep fallback postinstall instead of the full Bun dependency install, preserving normal install behavior without exposing the token to all lifecycle scripts.

Replace leaking effort test module mocks with env-driven provider setup, expand provider env isolation, and allow the cold Codex import test enough time to avoid timeout flake.

Author: jatmn

.github/workflows/pr-checks.yml

@@ -37,10 +37,20 @@ jobs:
           cache-dependency-path: python/requirements.txt
 
       - name: Install dependencies
+        id: install
         run: bun install --frozen-lockfile
+        continue-on-error: true
+
+      - name: Install ripgrep binary with GitHub auth
+        if: steps.install.outcome == 'failure'
+        run: node node_modules/@vscode/ripgrep/lib/postinstall.js
         env:
           GITHUB_TOKEN: ${{ github.token }}
 
+      - name: Retry dependency install
+        if: steps.install.outcome == 'failure'
+        run: bun install --frozen-lockfile
+
       - name: Smoke check
         run: bun run smoke
 

.github/workflows/release.yml

@@ -57,10 +57,20 @@ jobs:
           bun-version: 1.3.11
 
       - name: Install dependencies
+        id: install
         run: bun install --frozen-lockfile
+        continue-on-error: true
+
+      - name: Install ripgrep binary with GitHub auth
+        if: steps.install.outcome == 'failure'
+        run: node node_modules/@vscode/ripgrep/lib/postinstall.js
         env:
           GITHUB_TOKEN: ${{ github.token }}
 
+      - name: Retry dependency install
+        if: steps.install.outcome == 'failure'
+        run: bun install --frozen-lockfile
+
       - name: Run unit tests
         run: bun test --max-concurrency=1
 

src/utils/effort.codex.test.ts

@@ -1,77 +1,106 @@
-import { afterEach, expect, mock, test } from 'bun:test'
-// Import the real auth.js and providerConfig.js up front so we can spread
-// their export surfaces into mock factories. `mock.module()` is process-global
-// in bun:test and `mock.restore()` does not undo it (see user.test.ts), so
-// any module we mock here needs to keep the full original export shape — or
-// downstream tests that load it via openaiShim/client/codexShim crash with
-// "Export named 'X' not found in module".
-import * as actualAuth from './auth.js'
-import * as actualProviderConfig from '../services/api/providerConfig.js'
-import * as actualThinking from './thinking.js'
-import * as actualGrowthbook from 'src/services/analytics/growthbook.js'
-import * as actualProviders from './model/providers.js'
-import * as actualModelSupportOverrides from './model/modelSupportOverrides.js'
+import { afterEach, beforeEach, expect, mock, test } from 'bun:test'
+
+const ENV_KEYS = [
+  'CLAUDE_CODE_USE_BEDROCK',
+  'CLAUDE_CODE_USE_FOUNDRY',
+  'CLAUDE_CODE_USE_GEMINI',
+  'CLAUDE_CODE_USE_GITHUB',
+  'CLAUDE_CODE_USE_MISTRAL',
+  'CLAUDE_CODE_USE_OPENAI',
+  'CLAUDE_CODE_USE_VERTEX',
+  'CLAUDE_CODE_PROVIDER_PROFILE_ENV_APPLIED',
+  'MISTRAL_BASE_URL',
+  'OPENAI_BASE_URL',
+  'OPENAI_MODEL',
+  'OPENAI_API_BASE',
+  'XAI_API_KEY',
+  'MINIMAX_API_KEY',
+] as const
+
+const originalEnv: Record<string, string | undefined> = {}
+type TestProvider = 'codex' | 'openai' | 'firstParty'
+
+function resolveProviderFromEnv(): TestProvider {
+  if (process.env.CLAUDE_CODE_USE_OPENAI) {
+    const baseUrl = process.env.OPENAI_BASE_URL ?? ''
+    const model = process.env.OPENAI_MODEL ?? ''
+    return baseUrl.includes('/backend-api/codex') || model.startsWith('codex')
+      ? 'codex'
+      : 'openai'
+  }
+  return 'firstParty'
+}
 
-afterEach(() => {
+function installProviderMock(provider?: TestProvider): void {
+  mock.module('./model/providers.js', () => ({
+    getAPIProvider: () => provider ?? resolveProviderFromEnv(),
+    getAPIProviderForStatsig: () => provider ?? resolveProviderFromEnv(),
+    isFirstPartyAnthropicBaseUrl: () => true,
+    isGithubNativeAnthropicMode: () => false,
+    usesAnthropicAccountFlow: () =>
+      (provider ?? resolveProviderFromEnv()) === 'firstParty',
+  }))
+}
+
+beforeEach(() => {
   mock.restore()
+  installProviderMock()
+  for (const key of ENV_KEYS) {
+    originalEnv[key] = process.env[key]
+  }
 })
 
-async function importFreshEffortModule(options: {
-  provider: 'codex' | 'openai'
-  supportsCodexReasoningEffort: boolean
-}) {
-  mock.module('./model/providers.js', () => ({
-    ...actualProviders,
-    getAPIProvider: () => options.provider,
-  }))
-  mock.module('./model/modelSupportOverrides.js', () => ({
-    ...actualModelSupportOverrides,
-    get3PModelCapabilityOverride: () => undefined,
-  }))
-  mock.module('../services/api/providerConfig.js', () => ({
-    ...actualProviderConfig,
-    supportsCodexReasoningEffort: () => options.supportsCodexReasoningEffort,
-  }))
-  mock.module('./auth.js', () => ({
-    ...actualAuth,
-    isProSubscriber: () => false,
-    isMaxSubscriber: () => false,
-    isTeamSubscriber: () => false,
-  }))
-  mock.module('./thinking.js', () => ({
-    ...actualThinking,
-    isUltrathinkEnabled: () => false,
-  }))
-  mock.module('src/services/analytics/growthbook.js', () => ({
-    ...actualGrowthbook,
-    getFeatureValue_CACHED_MAY_BE_STALE: (_key: string, fallback: unknown) =>
-      fallback,
-  }))
+afterEach(() => {
+  for (const key of ENV_KEYS) {
+    if (originalEnv[key] === undefined) {
+      delete process.env[key]
+    } else {
+      process.env[key] = originalEnv[key]
+    }
+  }
+  installProviderMock()
+})
+
+async function importFreshEffortModule(options: { provider: TestProvider }) {
+  for (const key of ENV_KEYS) {
+    delete process.env[key]
+  }
+  installProviderMock(options.provider)
+  if (options.provider === 'codex') {
+    process.env.CLAUDE_CODE_USE_OPENAI = '1'
+    process.env.OPENAI_MODEL = 'gpt-5.4'
+  } else if (options.provider === 'openai') {
+    process.env.CLAUDE_CODE_USE_OPENAI = '1'
+    process.env.OPENAI_BASE_URL = 'https://api.openai.com/v1'
+    process.env.OPENAI_MODEL = 'gpt-5.4'
+  }
 
   return import(`./effort.js?ts=${Date.now()}-${Math.random()}`)
 }
 
-test('gpt-5.4 on the ChatGPT Codex backend supports effort selection', async () => {
-  const { getAvailableEffortLevels, modelSupportsEffort } =
-    await importFreshEffortModule({
-      provider: 'codex',
-      supportsCodexReasoningEffort: true,
-    })
-
-  expect(modelSupportsEffort('gpt-5.4')).toBe(true)
-  expect(getAvailableEffortLevels('gpt-5.4')).toEqual([
-    'low',
-    'medium',
-    'high',
-    'xhigh',
-  ])
-})
+test(
+  'gpt-5.4 on the ChatGPT Codex backend supports effort selection',
+  async () => {
+    const { getAvailableEffortLevels, modelSupportsEffort } =
+      await importFreshEffortModule({
+        provider: 'codex',
+      })
+
+    expect(modelSupportsEffort('gpt-5.4')).toBe(true)
+    expect(getAvailableEffortLevels('gpt-5.4')).toEqual([
+      'low',
+      'medium',
+      'high',
+      'xhigh',
+    ])
+  },
+  15_000,
+)
 
 test('gpt-5.4 on the OpenAI provider still supports effort selection', async () => {
   const { getAvailableEffortLevels, modelSupportsEffort } =
     await importFreshEffortModule({
       provider: 'openai',
-      supportsCodexReasoningEffort: true,
     })
 
   expect(modelSupportsEffort('gpt-5.4')).toBe(true)
@@ -87,7 +116,6 @@ test('gpt-5.3-codex-spark stays without effort controls', async () => {
   const { getAvailableEffortLevels, modelSupportsEffort } =
     await importFreshEffortModule({
       provider: 'codex',
-      supportsCodexReasoningEffort: false,
     })
 
   expect(modelSupportsEffort('gpt-5.3-codex-spark')).toBe(false)
@@ -97,7 +125,6 @@ test('gpt-5.3-codex-spark stays without effort controls', async () => {
 test('toPersistableEffort normalizes xhigh to max so it survives settings write', async () => {
   const { toPersistableEffort } = await importFreshEffortModule({
     provider: 'openai',
-    supportsCodexReasoningEffort: true,
   })
 
   expect(toPersistableEffort('xhigh')).toBe('max')
@@ -112,7 +139,6 @@ test('standardEffortToOpenAI maps max to xhigh for shim payload', async () => {
   const { standardEffortToOpenAI, openAIEffortToStandard } =
     await importFreshEffortModule({
       provider: 'openai',
-      supportsCodexReasoningEffort: true,
     })
 
   expect(standardEffortToOpenAI('max')).toBe('xhigh')
@@ -128,7 +154,6 @@ test('e2e: xhigh → persisted max → resolveAppliedEffort → wire xhigh on Op
     standardEffortToOpenAI,
   } = await importFreshEffortModule({
     provider: 'openai',
-    supportsCodexReasoningEffort: true,
   })
 
   // Picker writes the OpenAI-shaped value; toPersistableEffort normalizes.
@@ -147,19 +172,16 @@ test('e2e: xhigh → persisted max → resolveAppliedEffort → wire xhigh on Op
 
 test('e2e: max on non-Opus Anthropic model still clamps to high', async () => {
   const { resolveAppliedEffort } = await importFreshEffortModule({
-    provider: 'firstParty' as unknown as 'openai',
-    supportsCodexReasoningEffort: false,
+    provider: 'firstParty',
   })
 
   expect(resolveAppliedEffort('claude-sonnet-4-6', 'max')).toBe('high')
 })
 
-
 test('getEffortSuffix shows the effective displayed effort for supported models', async () => {
   const { getDisplayedEffortLevel, getEffortSuffix } =
     await importFreshEffortModule({
       provider: 'openai',
-      supportsCodexReasoningEffort: true,
     })
 
   expect(getEffortSuffix('gpt-5.4', 'medium')).toBe(' with medium effort')
@@ -173,7 +195,6 @@ test('getEffortSuffix shows the effective displayed effort for supported models'
 test('getEffortSuffix stays hidden for models without effort controls', async () => {
   const { getEffortSuffix } = await importFreshEffortModule({
     provider: 'codex',
-    supportsCodexReasoningEffort: false,
   })
 
   expect(getEffortSuffix('gpt-5.3-codex-spark', 'medium')).toBe('')