CodexPortalSAFE

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: codex-portal-release
description: Project-specific development, versioning, and release workflow for /Users/zhujiangyong/Software/codex-portal. Use whenever Codex changes this React/Tauri repository, implements account or configuration features, updates the application version, prepares a release, or is explicitly asked to publish a Codex Portal version.
---

# Codex Portal Development and Release

## Scope

Apply this workflow only inside `/Users/zhujiangyong/Software/codex-portal`.

Treat saved `auth.json` content, tokens, account email addresses, and the local SQLite database as secrets. Never print real credential content, read the user's live `~/.codex/auth.json` merely to inspect its shape, or place credentials in source, fixtures, logs, screenshots, or tool output.

## Start Work

1. Inspect the current branch and worktree with `git status --short` before editing.
2. Preserve all existing user changes and avoid unrelated rewrites.
3. Resolve implementation details from the repository when the requested behavior is sufficiently determined. Ask one concise question only when different interpretations would materially change behavior.
4. Keep React UI changes consistent with the existing compact monochrome desktop design. Organize Rust commands and data access by business module; keep `src-tauri/src/lib.rs` focused on application startup, shared-state initialization, and command registration.

Outside an explicitly authorized release, do not create or switch branches, commit, push, tag, or open a pull request unless the user asks for that Git operation. During a release, perform the necessary Git operations under the release workflow below.

### Commit Scope

Unless the user explicitly requests a limited commit, every authorized commit includes all current workspace changes: tracked modifications and deletions, plus non-ignored untracked files. Inspect the full diff, then use `git add -A` from the repository root. Do not limit the commit to the current task, files edited by Codex, or changes made during the current session. Preserve existing file contents when including other work; inclusion does not authorize unrelated rewrites. This full-workspace default was adopted from the user's explicit correction on 2026-09-10.

### Branch Naming

When branch creation is authorized, name the branch after the current date in the session's timezone: `YYYY-MM-DD` (for example, `2026-09-08`). If that name already exists locally or in known remote refs, use the first available suffix starting at `-2`, then `-3`, and so on: `2026-09-08-2`, `2026-09-08-3`.

Use the date alone, without prefixes such as `feat/`, `feature/`, or `codex/`, and without feature or task names. Keep all existing uncommitted changes on the new branch; creating a branch does not authorize committing or pushing them. Continue using the current branch unless another branch operation is requested.

## Implement Changes

- Keep frontend pages and components in `src/`, shared hooks in `src/hooks/`, utilities in `src/utils/`, and account types in `src/types/`.
- Under `src-tauri/src/`, keep account management in `accounts/`, authentication in `auth/`, session parsing/sync/statistics in `sessions/`, and Codex configuration/version detection in `codex/`. Keep shared runtime state in `state.rs`, database initialization in `db.rs`, common HTTP and timestamp helpers in `http.rs` and `time.rs`, and skill/update management in `skills.rs` and `updates.rs`.
- Keep module dependencies explicit and expose only the types and functions needed by callers. When tests are explicitly requested, keep unit tests with their owning module. During structural refactors, preserve Tauri command names and serialized fields, database migrations, transaction/lock boundaries, scheduler behavior, and credential handling.
- Preserve raw account and authentication data. Apply masking or formatting only at the presentation boundary unless the user explicitly requests a data migration.
- Prefer browser-native APIs and existing dependencies. Do not install packages merely for small parsing, formatting, or state-persistence tasks.
- Persist application-only UI preferences separately from Codex's `config.toml`; do not mix portal preferences into the user's Codex configuration.
- Do not start services, build, package, install dependencies, deploy, modify unrelated configuration, or update documentation without explicit user authorization. Requested project skill and rule updates authorize editing those files.
  An authorized release also covers the required README updates described below.

## No Tests or Browser Calls by Default

For this project, complete the requested edits without creating or running tests, executing validation commands, or invoking browser/computer-use tools. This also applies when creating or updating this project skill. A general request to implement, fix, or finish work does not authorize these actions.

- Do not run unit, integration, end-to-end, or ad hoc assertion tests; type checks; lint or formatting checks; `git diff --check`; skill validators such as `quick_validate.py`; or builds and previews for verification.
- Do not open a browser, call browser automation tools, take screenshots, perform visual or interaction testing, or start a service or create a preview page for those purposes.
- Use only the source reads and ordinary Git status/diff inspection needed to understand and edit the requested files. Do not add a testing or validation phase, delegate one, or ask for permission to run one as a routine completion step.
- Run a particular check only if the user later explicitly requests it, and stay within that request. An explicitly authorized release may use the release workflow below; it does not authorize extra local tests or browser calls.
- Briefly report the edits and state that tests were not run per the project rule. Do not describe omitted tests as a blocker or claim that unrun checks passed.

## Update the Application Ve

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

declared (5 observation(s))

Network

declared (5 observation(s))

Shell

none-observed

Dependencies

not all pinned

Secrets in source

none-found

Findings (8)

icon.icns

import { TextMatch } from '../../utils/sessionSearch';

import { SessionProject } from '../../types/session';

import { formatRelativeTime } from '../../utils/time';

import { formatTokens } from '../../utils/format';

import type { SessionRecord } from '../../types/session';

@radix-ui/react-dialog, @radix-ui/react-slot, @radix-ui/react-tooltip, @tauri-apps/api, @tauri-apps/plugin-autostart, @tauri-apps/plugin-opener, @tauri-apps/plugin-process, @tauri-apps/plugin-updater

Gates applied: no_behavioural_pass, no_license.