My Work auto-refresh silently falls back to `codex exec --ephemeral` and used up my ChatGPT Codex quota (~230 hidden runs in 4 days, with `CLAUDE_MEM_

## Before submitting - [x] I searched [existing issues](https://github.com/thedotmack/claude-mem/issues) and confirmed this is not a duplicate. Related: #5120 (Codex refresh sandbox fix), #5163 (refresh failing every 10 min on Windows), #5164 (refresh model is hard-coded). ### Bug Description Starting with 15.2.0, the scheduled **My Work** refresh runs Codex in the background on my ChatGPT account. I never configured this: `CLAUDE_MEM_PROVIDER` is `claude`, and my settings don't mention Codex or the refresh. When the Claude Code run of a refresh step fails claude-mem's own output validation, the worker retries the step with `codex exec --ephemeral`. Because of `--ephemeral`, nothing appears in `~/.codex/sessions`, the Codex app, or the Codex usage dashboard. All I saw was my Codex quota draining with no sessions anywhere. It also keeps retrying every ~10 minutes after Codex replies "You've hit your usage limit". Impact: every 5-hour Codex window from Oct 27 to Oct 29 was at 100%, and my weekly limit went from 0% to 100% about 1.5 days after its reset. I didn't use Codex myself during that time. Finding the cause took hours, including logging out of all my OpenAI devices. ### Steps to Reproduce 1. Codex CLI installed and logged in with a ChatGPT account (`codex` on `PATH`). 2. claude-mem ≥ 15.2.0 with default settings (`CLAUDE_MEM_WORK_VIEW_AUTO_REFRESH` unset, i.e. `"true"`), `CLAUDE_MEM_PROVIDER=claude`. 3. Use Claude Code normally until a refresh step's Claude Code output fails validation (e.g. a long `narrative`). 4. The worker starts `codex exec --ephemeral ...` (see below), and ChatGPT Codex usage goes up with no visible session. Command line of a run I caught live (paths shortened): ``` codex exec --strict-config -c default_permissions="claude-mem-refresh" \ -c permissions.claude-mem-refresh.filesystem={...} \ -c permissions.claude-mem-refresh.network.enabled=false \ --ephemeral --ignore-user-config --skip-git-repo-check \ -C ~/.claude-mem/work-view -o ~/.claude-mem/work-view/agent-runs/codex- .txt - ``` Parent process: `bun .../claude-mem/15.6.0/scripts/worker-service.cjs --daemon`. ### Expected Behavior - The worker never uses Codex unless I opt in: `CLAUDE_MEM_PROVIDER=claude` should mean Claude only, or Codex fallback should be its own setting, off by default. - A Claude output that fails validation should be retried or trimmed on Claude, not handed to another paid provider. - After Codex returns "You've hit your usage limit", the worker should stop trying Codex until that limit resets. - Background runs that bill a user's account should not run with `--ephemeral`, or should at least be recorded somewhere visible (My Work, the viewer, or a log line with token usage). ### Evidence claude-mem Codex runs per day (count of `Agent run (scheduled) starting on codex` in the worker logs): | Day | Codex runs | Failed with "usage limit" | |---|---|---| | Oct 25 (15.2.0 installed 20:50, first run 21:35) | 1 | 0 | | Oct 26 | 8 | 0 | | Oct 27 | 56 | 34 | | Oct 28 | 104 | 64 | | Oct 29 | 61 | 42 | - 229 of 233 Codex runs started immediately after a `failed on claude-code` validation error. - I compared these runs against CodexBar's saved weekly usage readings (535 readings since Oct 25, every 30 min). Of 153 increases, 150 happened while claude-mem was running Codex, 3 during one Codex run I started myself, and **0 with no Codex run**. - I logged out of all OpenAI devices and watched for 30 minutes: usage stayed at 0%. The next rise (0% → 2%) happened exactly while the worker's `codex exec --ephemeral` was running. Setting `CLAUDE_MEM_WORK_VIEW_AUTO_REFRESH="false"` stopped it. ### Environment - **Claude-mem version**: 15.2.0 (Oct 25) → 15.2.1 → 15.3.0 → 15.6.0 (all affected) - **Claude Code version**: 2.1.312 - **OS**: macOS 27.2 (arm64) - **Platform**: Claude Code CLI; Codex CLI 0.163.0 (npm global via mise), logged in with ChatGPT ### Logs ``` [2026-10-27 01:34:45.638] [WARN ] [WORKER] Agent run (scheduled) failed on claude-code {error=reviews: g_59f8c496f1c6: narrative is 1467 characters; it must be 1–1200. Cut at least 267 characters.} [2026-10-27 01:34:45.638] [INFO ] [WORKER] Agent run (scheduled) starting on codex ... [2026-10-29 01:50:18.467] [INFO ] [WORKER] Agent run (scheduled) starting on codex [2026-10-29 01:51:06.619] [WARN ] [WORKER] Agent run (scheduled) failed on codex {error=codex exec exited 1: ERROR: You've hit your usage limit. Upgrade to Pro (https://chatgpt.com/explore/pro), visit https://chatgpt.com/codex/settings/usage to purchase more c... ``` Most common Claude Code validation failures that trigger the Codex fallback: ``` 130 reviews: narrative is N characters; it must be 1–1200 32 reviews: milestones must be an array of at most 12 13 reviews: summary is N characters; it must be 1–280 10 reviews: milestones[11].text is N characters; it must be 1–200 ``` ### Additional Context Workaround: set `"CLAUDE_MEM_WORK_VIEW_AUTO_REFRESH": "false"` in `~/.claude-mem/settings.json`. The worker re-reads it before each scheduled run, so no restart is needed. This also turns off the Claude-side refresh (see #5164 for a manual-trigger request).