@biggora/claude-plugins 1.1.1 → 1.2.0

package/.claude/settings.local.json

@@ -7,7 +7,9 @@
       "WebFetch(domain:commafeed.hm.neutron.lv)",
       "WebFetch(domain:raw.githubusercontent.com)",
       "Bash(done)",
-      "Bash(npm --version)"
+      "Bash(npm --version)",
+      "Bash(python \"C:/Users/biggora/.claude/plugins/cache/anthropic-agent-skills/document-skills/b0cbd3df1533/skills/skill-creator/eval-viewer/generate_review.py\" \"codex-cli-workspace/iteration-1\" --skill-name \"codex-cli\" --benchmark \"codex-cli-workspace/iteration-1/benchmark.json\" --static \"codex-cli-workspace/iteration-1/review.html\")",
+      "Bash(start \"\" \"E:/Projects/npm/claude-plugins/claude-plugins/codex-cli-workspace/iteration-1/review.html\")"
     ]
   }
 }

package/README.md

@@ -70,19 +70,19 @@ claude-plugins skills remove commafeed-api
 #### Install Examples
 
 ```bash
-npx skills add https://github.com/biggora/claude-plugins-registry --skill --skill codex-cli
-npx skills add https://github.com/biggora/claude-plugins-registry --skill --skill gemini-cli
-npx skills add https://github.com/biggora/claude-plugins-registry --skill --skill n8n-api
-npx skills add https://github.com/biggora/claude-plugins-registry --skill --skill notebook-lm
-npx skills add https://github.com/biggora/claude-plugins-registry --skill --skill commafeed-api
-npx skills add https://github.com/biggora/claude-plugins-registry --skill --skill tm-search
-npx skills add https://github.com/biggora/claude-plugins-registry --skill --skill wp-rest-api
-npx skills add https://github.com/biggora/claude-plugins-registry --skill --skill youtube-search
-npx skills add https://github.com/biggora/claude-plugins-registry --skill --skill youtube-thumbnail
-npx skills add https://github.com/biggora/claude-plugins-registry --skill --skill screen-recording
-npx skills add https://github.com/biggora/claude-plugins-registry --skill --skill text-to-speech
-npx skills add https://github.com/biggora/claude-plugins-registry --skill --skill test-web-ui
-npx skills add https://github.com/biggora/claude-plugins-registry --skill --skill test-mobile-app
+npx skills add https://github.com/biggora/claude-plugins-registry --skill codex-cli
+npx skills add https://github.com/biggora/claude-plugins-registry --skill gemini-cli
+npx skills add https://github.com/biggora/claude-plugins-registry --skill n8n-api
+npx skills add https://github.com/biggora/claude-plugins-registry --skill notebook-lm
+npx skills add https://github.com/biggora/claude-plugins-registry --skill commafeed-api
+npx skills add https://github.com/biggora/claude-plugins-registry --skill tm-search
+npx skills add https://github.com/biggora/claude-plugins-registry --skill wp-rest-api
+npx skills add https://github.com/biggora/claude-plugins-registry --skill youtube-search
+npx skills add https://github.com/biggora/claude-plugins-registry --skill youtube-thumbnail
+npx skills add https://github.com/biggora/claude-plugins-registry --skill screen-recording
+npx skills add https://github.com/biggora/claude-plugins-registry --skill text-to-speech
+npx skills add https://github.com/biggora/claude-plugins-registry --skill test-web-ui
+npx skills add https://github.com/biggora/claude-plugins-registry --skill test-mobile-app
 ```
 
 ## Plugins

package/codex-cli-workspace/iteration-1/benchmark.json

@@ -0,0 +1,122 @@
+{
+  "metadata": {
+    "skill_name": "codex-cli",
+    "skill_path": "src/skills/codex-cli/SKILL.md",
+    "executor_model": "claude-opus-4-6",
+    "timestamp": "2026-03-11T00:00:00Z",
+    "evals_run": 3,
+    "runs_per_configuration": 1
+  },
+  "runs": [
+    {
+      "eval_id": 1,
+      "eval_name": "ci-integration",
+      "configuration": "with_skill",
+      "result": {
+        "pass_rate": 1.0,
+        "passed": 6,
+        "failed": 0,
+        "total": 6
+      },
+      "timing": {
+        "total_tokens": 68449,
+        "duration_ms": 60126
+      }
+    },
+    {
+      "eval_id": 1,
+      "eval_name": "ci-integration",
+      "configuration": "without_skill",
+      "result": {
+        "pass_rate": 0.5,
+        "passed": 3,
+        "failed": 3,
+        "total": 6
+      },
+      "timing": {
+        "total_tokens": 64960,
+        "duration_ms": 44585
+      }
+    },
+    {
+      "eval_id": 2,
+      "eval_name": "mcp-server-config",
+      "configuration": "with_skill",
+      "result": {
+        "pass_rate": 1.0,
+        "passed": 6,
+        "failed": 0,
+        "total": 6
+      },
+      "timing": {
+        "total_tokens": 67753,
+        "duration_ms": 38647
+      }
+    },
+    {
+      "eval_id": 2,
+      "eval_name": "mcp-server-config",
+      "configuration": "without_skill",
+      "result": {
+        "pass_rate": 0.167,
+        "passed": 1,
+        "failed": 5,
+        "total": 6
+      },
+      "timing": {
+        "total_tokens": 64950,
+        "duration_ms": 41699
+      }
+    },
+    {
+      "eval_id": 3,
+      "eval_name": "profiles-troubleshooting",
+      "configuration": "with_skill",
+      "result": {
+        "pass_rate": 1.0,
+        "passed": 6,
+        "failed": 0,
+        "total": 6
+      },
+      "timing": {
+        "total_tokens": 67804,
+        "duration_ms": 38914
+      }
+    },
+    {
+      "eval_id": 3,
+      "eval_name": "profiles-troubleshooting",
+      "configuration": "without_skill",
+      "result": {
+        "pass_rate": 0.167,
+        "passed": 1,
+        "failed": 5,
+        "total": 6
+      },
+      "timing": {
+        "total_tokens": 65148,
+        "duration_ms": 51576
+      }
+    }
+  ],
+  "run_summary": {
+    "with_skill": {
+      "mean_pass_rate": 1.0,
+      "stddev_pass_rate": 0.0,
+      "mean_tokens": 68002,
+      "mean_duration_ms": 45896
+    },
+    "without_skill": {
+      "mean_pass_rate": 0.278,
+      "stddev_pass_rate": 0.192,
+      "mean_tokens": 65019,
+      "mean_duration_ms": 45953
+    },
+    "delta": {
+      "pass_rate": "+72.2%",
+      "tokens": "+4.6%",
+      "duration": "-0.1%"
+    }
+  },
+  "notes": "The skill achieves 100% pass rate across all 3 evals vs 27.8% baseline. Without the skill, Claude heavily hallucinated CLI flags (--approval-mode, --sandbox write-only, --no-sandbox, --mcp-server), config format (JSON instead of TOML), config keys (approval_mode instead of approval_policy), and approval mode values (suggest/auto-edit/full-auto instead of untrusted/on-request/never/reject). The skill completely eliminates these hallucinations at negligible additional token cost."
+}

package/codex-cli-workspace/iteration-1/eval-1-ci-integration/eval_metadata.json

@@ -0,0 +1,13 @@
+{
+  "eval_id": 1,
+  "eval_name": "ci-integration",
+  "prompt": "I want to set up OpenAI Codex CLI in my GitHub Actions pipeline to auto-fix lint errors on PRs. How do I configure it with full-auto mode and workspace-write sandbox? My OPENAI_API_KEY is stored in GitHub secrets.",
+  "assertions": [
+    {"id": "installs-globally", "text": "Shows npm install -g @openai/codex for global installation"},
+    {"id": "uses-exec-mode", "text": "Uses 'codex exec' for non-interactive CI mode (not bare 'codex')"},
+    {"id": "full-auto-flag", "text": "Uses --full-auto flag and correctly explains it equals -a on-request -s workspace-write"},
+    {"id": "api-key-from-secrets", "text": "Shows OPENAI_API_KEY set from ${{ secrets.OPENAI_API_KEY }} in env"},
+    {"id": "provides-workflow-yaml", "text": "Provides a complete GitHub Actions workflow YAML snippet"},
+    {"id": "no-hallucinated-flags", "text": "Does not invent non-existent CLI flags or options"}
+  ]
+}

package/codex-cli-workspace/iteration-1/eval-1-ci-integration/with_skill/grading.json

@@ -0,0 +1,52 @@
+{
+  "expectations": [
+    {
+      "text": "Shows npm install -g @openai/codex for global installation",
+      "passed": true,
+      "evidence": "Line 44: 'run: npm install -g @openai/codex'"
+    },
+    {
+      "text": "Uses 'codex exec' for non-interactive CI mode (not bare 'codex')",
+      "passed": true,
+      "evidence": "Line 53: 'codex exec \\' used in the workflow step"
+    },
+    {
+      "text": "Uses --full-auto flag and correctly explains it equals -a on-request -s workspace-write",
+      "passed": true,
+      "evidence": "Line 54: '--full-auto' and line 80-83: 'The --full-auto flag is a convenience shortcut equivalent to: codex exec -a on-request -s workspace-write'"
+    },
+    {
+      "text": "Shows OPENAI_API_KEY set from ${{ secrets.OPENAI_API_KEY }} in env",
+      "passed": true,
+      "evidence": "Line 58: 'OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}'"
+    },
+    {
+      "text": "Provides a complete GitHub Actions workflow YAML snippet",
+      "passed": true,
+      "evidence": "Lines 14-67: Complete workflow with checkout, node setup, install, lint, codex exec, and commit/push steps"
+    },
+    {
+      "text": "Does not invent non-existent CLI flags or options",
+      "passed": true,
+      "evidence": "All flags used (--full-auto, -a never, -s workspace-write, -c, --model, --profile, --dangerously-bypass-approvals-and-sandbox) match the skill documentation"
+    }
+  ],
+  "summary": {
+    "passed": 6,
+    "failed": 0,
+    "total": 6,
+    "pass_rate": 1.0
+  },
+  "claims": [
+    {
+      "claim": "--full-auto equals -a on-request -s workspace-write",
+      "type": "factual",
+      "verified": true,
+      "evidence": "Matches skill doc line 64: '# Equivalent to: -a on-request -s workspace-write'"
+    }
+  ],
+  "eval_feedback": {
+    "suggestions": [],
+    "overall": "No suggestions, evals look solid"
+  }
+}

package/codex-cli-workspace/iteration-1/eval-1-ci-integration/with_skill/outputs/response.md

@@ -0,0 +1,163 @@
+# Setting Up OpenAI Codex CLI in GitHub Actions to Auto-Fix Lint Errors
+
+## Overview
+
+You can use `codex exec` (the non-interactive mode of Codex CLI) inside a GitHub Actions workflow to automatically fix lint errors on pull requests. The key pieces are:
+
+- **`--full-auto` flag** -- shortcut for `-a on-request -s workspace-write`, which allows Codex to write files within the working directory without requiring interactive approval.
+- **`OPENAI_API_KEY`** -- passed from GitHub Secrets via the `env` block.
+
+## Workflow File
+
+Create `.github/workflows/codex-lint-fix.yml` in your repository:
+
+```yaml
+name: Auto-fix lint errors with Codex CLI
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+
+permissions:
+  contents: write
+
+jobs:
+  lint-fix:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout PR branch
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.head_ref }}
+          # Needed so the push step can write back to the PR branch
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Install Codex CLI
+        run: npm install -g @openai/codex
+
+      - name: Run linter and capture errors
+        id: lint
+        run: |
+          npm run lint 2>&1 | tee lint-output.txt || true
+
+      - name: Auto-fix lint errors with Codex
+        run: |
+          codex exec \
+            --full-auto \
+            --model gpt-5-codex \
+            "Read lint-output.txt for the lint errors in this project. Fix all the lint errors in the source files. Do not modify any test files unless the lint error is in a test file."
+        env:
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+
+      - name: Commit and push fixes
+        run: |
+          git config user.name "codex-bot"
+          git config user.email "codex-bot@users.noreply.github.com"
+          git add -A
+          git diff --cached --quiet || git commit -m "fix: auto-fix lint errors via Codex CLI"
+          git push
+```
+
+## How It Works
+
+1. **Checkout** -- The PR branch is checked out with write access so fixes can be pushed back.
+2. **Lint** -- Your existing lint command runs and its output is captured to a file. The `|| true` prevents the step from failing the workflow (lint errors are expected).
+3. **Codex exec** -- Runs in non-interactive mode with `--full-auto`, which sets:
+   - **Approval policy**: `on-request` (Codex proceeds without interactive prompts for standard file edits)
+   - **Sandbox**: `workspace-write` (Codex can only write files within the checked-out repository directory)
+4. **Commit and push** -- If Codex made any changes, they are committed and pushed to the PR branch.
+
+## Understanding `--full-auto`
+
+The `--full-auto` flag is a convenience shortcut equivalent to:
+
+```bash
+codex exec -a on-request -s workspace-write "task"
+```
+
+| Setting | Value | Meaning |
+|---------|-------|---------|
+| Approval policy (`-a`) | `on-request` | Codex runs autonomously for standard operations; only pauses on sensitive actions |
+| Sandbox (`-s`) | `workspace-write` | Codex can read/write files in the working directory but cannot access the broader filesystem |
+
+This is the recommended combination for CI pipelines because it gives Codex enough freedom to edit source files while preventing it from modifying anything outside the project.
+
+### If You Want Fully Unattended Execution
+
+If you want Codex to never pause for any reason (no approval prompts at all), use explicit flags instead of `--full-auto`:
+
+```bash
+codex exec -a never -s workspace-write "Fix all lint errors"
+```
+
+The `-a never` policy means Codex will never ask for approval, even for potentially sensitive actions. Use this when you are confident in the prompt and the sandbox constraint is sufficient protection.
+
+## Configuring the API Key
+
+Your `OPENAI_API_KEY` stored in GitHub Secrets is passed to Codex through the `env` block on the step:
+
+```yaml
+env:
+  OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+```
+
+To add the secret:
+1. Go to your repository on GitHub.
+2. Navigate to **Settings > Secrets and variables > Actions**.
+3. Click **New repository secret**.
+4. Name: `OPENAI_API_KEY`, Value: your OpenAI API key.
+
+## Optional: Enable Network Access
+
+By default, the `workspace-write` sandbox disables network access. If your lint fix workflow requires installing packages or fetching resources, enable network with a config override:
+
+```yaml
+- name: Auto-fix lint errors with Codex
+  run: |
+    codex exec \
+      --full-auto \
+      -c 'sandbox_workspace_write.network_access=true' \
+      "Fix all lint errors found in lint-output.txt"
+  env:
+    OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+```
+
+## Optional: Use a Config Profile
+
+Instead of passing all flags on the command line, you can create a `.codex/config.toml` in your repo with a CI profile:
+
+```toml
+[profiles.ci]
+model = "gpt-5-codex"
+approval_policy = "never"
+
+[profiles.ci.sandbox_workspace_write]
+network_access = false
+```
+
+Then reference it in the workflow:
+
+```yaml
+- name: Auto-fix lint errors with Codex
+  run: |
+    codex exec --profile ci "Fix all lint errors found in lint-output.txt"
+  env:
+    OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+```
+
+## Troubleshooting
+
+| Problem | Solution |
+|---------|----------|
+| Landlock sandbox error on Ubuntu runner | Update the runner image or, in isolated CI only, use `--dangerously-bypass-approvals-and-sandbox` |
+| Network access denied during fix | Add `-c 'sandbox_workspace_write.network_access=true'` |
+| Codex keeps prompting for approval | Make sure you are using `codex exec` (not bare `codex`), and pass `--full-auto` or `-a never` explicitly |
+| Auth loop / browser auth attempt | Ensure `OPENAI_API_KEY` is set in the `env` block -- Codex uses it automatically and skips browser auth |

package/codex-cli-workspace/iteration-1/eval-1-ci-integration/with_skill/timing.json

@@ -0,0 +1,5 @@
+{
+  "total_tokens": 68449,
+  "duration_ms": 60126,
+  "total_duration_seconds": 60.1
+}

package/codex-cli-workspace/iteration-1/eval-1-ci-integration/without_skill/grading.json

@@ -0,0 +1,58 @@
+{
+  "expectations": [
+    {
+      "text": "Shows npm install -g @openai/codex for global installation",
+      "passed": true,
+      "evidence": "Line 49: 'run: npm install -g @openai/codex'"
+    },
+    {
+      "text": "Uses 'codex exec' for non-interactive CI mode (not bare 'codex')",
+      "passed": false,
+      "evidence": "Line 66: Uses bare 'codex \\' instead of 'codex exec'. The exec subcommand is required for non-interactive CI mode."
+    },
+    {
+      "text": "Uses --full-auto flag and correctly explains it equals -a on-request -s workspace-write",
+      "passed": false,
+      "evidence": "Uses hallucinated '--approval-mode full-auto' flag (correct is --full-auto or --ask-for-approval/-a) and '--sandbox write-only' (correct is -s workspace-write). Also incorrectly describes approval modes as 'suggest', 'auto-edit', 'full-auto' instead of the real ones: 'untrusted', 'on-request', 'never', 'reject'."
+    },
+    {
+      "text": "Shows OPENAI_API_KEY set from ${{ secrets.OPENAI_API_KEY }} in env",
+      "passed": true,
+      "evidence": "Line 64: 'OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}'"
+    },
+    {
+      "text": "Provides a complete GitHub Actions workflow YAML snippet",
+      "passed": true,
+      "evidence": "Lines 16-79: Complete workflow YAML with checkout, node, install, lint, codex, and commit steps"
+    },
+    {
+      "text": "Does not invent non-existent CLI flags or options",
+      "passed": false,
+      "evidence": "Hallucinated flags: '--approval-mode full-auto' (not a real flag), '--sandbox write-only' (not a real flag), '--model o3'. Hallucinated modes: 'suggest', 'auto-edit'. Hallucinated config format: 'codex.json'/'config.json' instead of config.toml."
+    }
+  ],
+  "summary": {
+    "passed": 3,
+    "failed": 3,
+    "total": 6,
+    "pass_rate": 0.5
+  },
+  "claims": [
+    {
+      "claim": "Approval modes are suggest, auto-edit, full-auto",
+      "type": "factual",
+      "verified": false,
+      "evidence": "Real approval modes are: untrusted, on-request, never, reject"
+    },
+    {
+      "claim": "Config file is codex.json or config.json",
+      "type": "factual",
+      "verified": false,
+      "evidence": "Real config file is ~/.codex/config.toml (TOML format, not JSON)"
+    }
+  ],
+  "eval_feedback": {
+    "suggestions": [],
+    "overall": "Baseline shows significant hallucination of CLI flags and config format without the skill"
+  }
+}

package/codex-cli-workspace/iteration-1/eval-1-ci-integration/without_skill/outputs/response.md

@@ -0,0 +1,151 @@
+# Setting Up OpenAI Codex CLI in GitHub Actions for Auto-Fixing Lint Errors
+
+## Overview
+
+OpenAI Codex CLI is a terminal-based AI coding agent. You can integrate it into a GitHub Actions workflow to automatically fix lint errors on pull requests using its `full-auto` approval mode and `write-only` sandbox policy.
+
+## Key Concepts
+
+- **`full-auto` mode**: Codex CLI automatically approves all actions (file reads, writes, and command execution) without human confirmation. Set via `--approval-mode full-auto`.
+- **`write-only` sandbox** (also called `workspace-write`): Restricts file writes to the current working directory (the repo workspace). Network access and writes outside the workspace are blocked. Set via `--sandbox write-only`.
+
+## GitHub Actions Workflow
+
+Create `.github/workflows/codex-lint-fix.yml`:
+
+```yaml
+name: Codex Auto-Fix Lint Errors
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  lint-fix:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout PR branch
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.head_ref }}
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Install OpenAI Codex CLI
+        run: npm install -g @openai/codex
+
+      - name: Run linter and capture errors
+        id: lint
+        continue-on-error: true
+        run: |
+          npx eslint . --format json > lint-results.json 2>&1 || true
+          if [ -s lint-results.json ]; then
+            echo "has_errors=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_errors=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Auto-fix lint errors with Codex CLI
+        if: steps.lint.outputs.has_errors == 'true'
+        env:
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+        run: |
+          codex \
+            --approval-mode full-auto \
+            --sandbox write-only \
+            "Read the lint errors in lint-results.json and fix all the reported ESLint errors and warnings in the source files. Do not change any logic, only fix lint issues."
+
+      - name: Commit and push fixes
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add -A
+          git diff --cached --quiet && echo "No changes to commit" && exit 0
+          git commit -m "fix: auto-fix lint errors via Codex CLI"
+          git push
+```
+
+## Configuration Breakdown
+
+### Authentication
+
+The `OPENAI_API_KEY` secret must be configured in your repository:
+
+1. Go to your repo on GitHub.
+2. Navigate to **Settings > Secrets and variables > Actions**.
+3. Click **New repository secret**.
+4. Name: `OPENAI_API_KEY`, Value: your OpenAI API key.
+
+The workflow references it as `${{ secrets.OPENAI_API_KEY }}` and passes it to the Codex CLI step via the `env` block.
+
+### Approval Mode
+
+`--approval-mode full-auto` tells Codex CLI to execute all suggested changes without waiting for human approval. This is required in CI where there is no interactive terminal.
+
+The three approval modes are:
+- `suggest` (default) -- requires approval for everything
+- `auto-edit` -- auto-approves file edits but asks before running commands
+- `full-auto` -- auto-approves all actions including command execution
+
+### Sandbox Policy
+
+`--sandbox write-only` (workspace-write) restricts Codex to:
+- Reading any file in the workspace
+- Writing only to files within the current working directory
+- No network access from spawned commands
+- No writes outside the repo checkout directory
+
+This provides a safety boundary so Codex cannot modify system files or exfiltrate data, even in `full-auto` mode.
+
+### Alternative: Using a Codex Config File
+
+Instead of passing flags on the command line, you can create a `codex.json` or use the `~/.codex/config.json` approach. In CI, you can write it inline:
+
+```yaml
+      - name: Configure Codex CLI
+        run: |
+          mkdir -p ~/.codex
+          cat > ~/.codex/config.json << 'EOF'
+          {
+            "approvalMode": "full-auto",
+            "sandbox": "write-only",
+            "model": "o4-mini"
+          }
+          EOF
+```
+
+### Model Selection
+
+By default, Codex CLI uses `o4-mini`. You can specify a different model:
+
+```bash
+codex --model o3 --approval-mode full-auto --sandbox write-only "Fix lint errors..."
+```
+
+## Security Considerations
+
+1. **Never hardcode your API key** in the workflow file. Always use GitHub Secrets.
+2. **`write-only` sandbox** is recommended for CI to prevent unintended network calls or file access outside the workspace.
+3. **Review the generated commits**. Even though Codex runs automatically, the changes are pushed to the PR branch where reviewers can inspect them.
+4. **Limit permissions**. The workflow uses `contents: write` and `pull-requests: write` which are the minimum needed to push commits and interact with the PR.
+5. **Cost control**. Each Codex invocation calls the OpenAI API. Consider adding conditions to skip the step if there are no lint errors, as shown in the workflow above.
+
+## Troubleshooting
+
+- **"codex: command not found"**: Make sure the install step uses `npm install -g @openai/codex` and that the Node.js version is 20 or higher.
+- **Authentication errors**: Verify the `OPENAI_API_KEY` secret is set correctly and the key is valid.
+- **Push failures**: Ensure the checkout step uses `token: ${{ secrets.GITHUB_TOKEN }}` and the workflow has `contents: write` permission.
+- **No changes committed**: If Codex cannot fix certain lint errors, the `git diff --cached --quiet` check will skip the commit gracefully.

package/codex-cli-workspace/iteration-1/eval-1-ci-integration/without_skill/timing.json

@@ -0,0 +1,5 @@
+{
+  "total_tokens": 64960,
+  "duration_ms": 44585,
+  "total_duration_seconds": 44.6
+}

package/codex-cli-workspace/iteration-1/eval-2-mcp-server-config/eval_metadata.json

@@ -0,0 +1,13 @@
+{
+  "eval_id": 2,
+  "eval_name": "mcp-server-config",
+  "prompt": "How do I add a custom MCP server to codex CLI? I have a Python-based MCP server that needs a GITHUB_TOKEN env var. Also want to run codex itself as an MCP server for other agents to consume.",
+  "assertions": [
+    {"id": "correct-config-location", "text": "Points to ~/.codex/config.toml for MCP server configuration"},
+    {"id": "mcp-servers-toml-syntax", "text": "Shows [mcp_servers.name] TOML section with command, args fields"},
+    {"id": "env-var-dollar-pattern", "text": "Shows $GITHUB_TOKEN or $ENV_VAR pattern for environment variable references"},
+    {"id": "codex-as-mcp-server", "text": "Shows 'codex mcp' command for running codex as an MCP server"},
+    {"id": "python-command-correct", "text": "Uses correct Python command (python/python3) in the MCP server command field"},
+    {"id": "no-hallucinated-config", "text": "Does not invent non-existent config keys or MCP server fields"}
+  ]
+}