Merge main and resolve conflicts - integrate CLI auto-shutdown and refactor helpers

.github/codex/configs/mcp-full.toml

@@ -2,8 +2,7 @@
 
 model = "gpt-5-codex"
 approval_policy = "never"
-sandbox_mode = "workspace-write"
-web_search = "live"
+sandbox_policy = "workspace-write"
 
 [sandbox_workspace_write]
 network_access = true

.github/workflows/codex-pr-review-mcp.yml

@@ -48,7 +48,7 @@ jobs:
 
           pr_json="$(gh api "repos/${{ github.repository }}/pulls/${pr_number}")"
           is_fork="$(jq -r '.head.repo.fork' <<<"$pr_json")"
-          if [ "$is_fork" = "true" ]; then
+          if [ "$is_fork" = "true" ] || [ "$is_fork" = "null" ]; then
             echo "Refusing to run Codex on fork PR #${pr_number} to protect secrets." >&2
             exit 1
           fi

README.md

@@ -81,6 +81,8 @@ node dist/cli/index.js env status mcp-filesystem mcp-playwright mcp-desktop-comm
 node dist/cli/index.js env codex-register mcp-filesystem mcp-playwright mcp-desktop-commander --replace
 ```
 
+Non-interactive CLI commands run in one-shot mode by default (the process exits after command completion). Set `CODEX_CLI_AUTO_SHUTDOWN=0` only when you explicitly want to keep the in-process foreground session alive for debugging.
+
 ## Codex for macOS Workflow
 
 ```bash

docs/guides/quick-start.md

@@ -29,6 +29,8 @@ npm run cli -- system start
 
 This command prints a telemetry snapshot and then exits cleanly in one-shot mode.
 
+If you need to keep the foreground process alive for debugging, run with `CODEX_CLI_AUTO_SHUTDOWN=0`.
+
 ## 3. Run a minimal local workflow
 
 ```bash

docs/runbooks/github-codex-action-mcp.md

@@ -12,6 +12,57 @@ Both use `openai/codex-action` with:
 - a Codex home config at `.github/codex/configs/mcp-full.toml`
 - artifact upload enabled for auditability
 
+## How to run
+
+### Codex PR Review workflow
+
+**Automatic triggers:**
+- Runs automatically on PR events: opened, synchronize, reopened, ready_for_review
+- Only runs on non-draft PRs from non-fork branches (fork PRs are blocked to protect secrets)
+
+**Manual trigger:**
+1. Navigate to Actions → "Codex PR Review (MCP-Enhanced)"
+2. Click "Run workflow"
+3. Required input:
+   - `pr_number`: Pull request number to review (e.g., `42`)
+4. Click "Run workflow" button
+
+**Key configuration:**
+- `safety-strategy: unsafe`
+- `sandbox: workspace-write` with `network_access=true`
+- Codex home: `.github/codex/configs/mcp-full.toml`
+- Model: `gpt-5-codex` with `effort: high`
+
+**Outputs:**
+- Artifact: `codex-pr-review-{pr_number}` (retained 14 days)
+- PR comment with review feedback (if Codex produces output)
+- Logs available in workflow run details
+
+### Codex Viral Growth Brief workflow
+
+**Scheduled trigger:**
+- Runs weekly on Mondays at 14:00 UTC (cron: `0 14 * * 1`)
+- To change schedule, edit the `cron:` expression in `.github/workflows/codex-viral-growth-mcp.yml`
+
+**Manual trigger:**
+1. Navigate to Actions → "Codex Viral Growth Brief (MCP-Enhanced)"
+2. Click "Run workflow"
+3. Optional inputs:
+   - `focus`: Focus area for the brief (e.g., "developer adoption", "GitHub visibility", "enterprise GTM") - leave empty for general brief
+   - `post_issue`: Check this to create a GitHub issue with the generated brief (default: unchecked)
+4. Click "Run workflow" button
+
+**Key configuration:**
+- `safety-strategy: unsafe`
+- `sandbox: workspace-write` with `network_access=true`
+- Codex home: `.github/codex/configs/mcp-full.toml`
+- Model: `gpt-5-codex` with `effort: high`
+
+**Outputs:**
+- Artifact: `codex-viral-growth-brief` (retained 14 days)
+- Optional GitHub issue (if `post_issue` input is true)
+- Logs available in workflow run details
+
 ## Why dependencies are installed before Codex
 
 `codex-action` runs Codex with sandboxing. In `workspace-write`, network is often disabled by default unless enabled in config. To avoid flaky runtime installs, workflows pre-install project and MCP dependencies before `Run Codex`.