codex-pr-review

Codex PR Review

A Claude Code skill that reviews pull requests using a dual-family AI pipeline — OpenAI Codex (gpt-5.3-codex) and Claude Opus run in parallel — with every LLM finding independently verified against source code by the other family before being posted. A deterministic floor (lint + typecheck + tests on changed lines) anchors the LLM panel in real tool exit codes.

What It Does

When you run /codex-pr-review, the skill:

1. Detects the PR from your current branch (or takes a PR number/URL).
2. Builds an AST-aware plan + manifest of files, symbols, and per-chunk neighbors so the reviewers don't false-flag forward references.
3. Runs the deterministic floor (lint / typecheck / tests on changed lines) in parallel with the LLM fan-out.
4. For each chunk, runs Codex and Claude in parallel against identical prompts and a structured output schema.
5. For every LLM finding, runs the other family's grounded verifier (Claude — Opus 4.7 by default, override with --model-verifier claude-haiku-4-5 — for Codex findings; Codex CLI for Claude findings). Refuted findings are dropped; inconclusive findings are escalated to Opus then posted with [unconfirmed].
6. Synthesizes the merged finding list (deduplicate, label agreement, generate suggested fix per finding, compute v2 verdict).
7. Validates locations deterministically — drops findings whose (file, line) does not resolve in the diff (with a maintainability exception for unchanged-but-related lines).
8. Posts a single PR comment with three sections: Resolved since last review / Findings / Persisting from prior review.

Findings are filtered by a configurable confidence threshold (default 0.8) so you only see issues the panel is genuinely certain about.

Requirements

• Claude Code CLI installed (also serves as the Claude reviewer + verifier)
• Codex CLI installed (npm install -g @openai/codex) and authenticated via OAuth (codex login)
• GitHub CLI (gh) installed and authenticated
• jq installed
• Node.js ≥ 18 (used by the AST-aware chunker for Python / TypeScript / Go)

Installation

git clone https://github.com/johnpsasser/codex-pr-review.git
cd codex-pr-review
./install.sh

Then restart Claude Code.

Usage

/codex-pr-review                              # Auto-detect PR for current branch
/codex-pr-review 123                          # Review PR #123
/codex-pr-review --threshold 0.6              # Lower confidence threshold
/codex-pr-review --mode followup              # Force follow-up-after-fixes mode
/codex-pr-review --mode delta                 # Review only commits since the prior review
/codex-pr-review --chunker ast                # Force AST-aware chunking
/codex-pr-review --no-verify                  # Skip the cross-family verifier (debug only)
/codex-pr-review --no-deterministic           # Skip the lint/typecheck/test floor

Arguments

Argument	Default	Description
PR_NUMBER or PR_URL	auto-detect	PR to review
--mode	auto	auto, initial, followup, or delta
--threshold	0.8	Confidence threshold (post-verifier)
--model-codex (alias --model)	gpt-5.3-codex	Codex reviewer model
--model-claude	claude-opus-4-7	Claude reviewer + synthesizer model
--model-verifier	claude-opus-4-7	Default cross-family verifier (override with claude-haiku-4-5 for cheaper, more deferential verification)
--chunker	auto	auto, ast, or hunk
--review-rules	(auto)	Path to override REVIEW.md / CLAUDE.md discovery
--chunk-size	3000	Lines per chunk
--max-parallel	4	Concurrent slots; each slot runs Codex + Claude in parallel
--max-diff-lines	0	Safety truncation cap (0 = unlimited; chunking handles any size)
--no-verify	off	Skip the cross-family verifier (debug only)
--no-deterministic	off	Skip the deterministic floor

Output Format (v2 §4.7)

## Codex PR Review v2 — Iteration 2 (follow-up)

**Verdict:** needs-changes (confidence 0.86)

### Resolved since last review (2)
- ~~`api/handler.go:142` — race condition on session map~~
- ~~`tests/test_auth.py:55` — assertion always true~~

### Findings (3)

#### [both] [P3] `api/handler.go:88` — unchecked nil deref
> Both Codex and Claude flagged this. Verifier confirmed against source.
>
> The `session` returned by `getSession` is dereferenced without nil-check at line 91.
>
> **Suggested fix:** add `if session == nil { return errSessionExpired }` immediately after the assignment.

#### [deterministic] [P2] `api/handler.go:142` — golangci-lint: ineffassign
> Variable `result` assigned but never used.
>
> **Suggested fix:** remove the assignment or use the value.