This small project currently supports only the latest revision on the default branch. It is an unofficial utility that depends on unstable Codex internal API surfaces.

.runtime/ contains reusable account credentials and local quota state. The application keeps this directory project-local by design, restricts runtime directories to mode 0700, and writes credential/config/cache files atomically with mode 0600.

Do not upload an archive of the whole working directory. Git ignore rules, the optional pre-commit hook, and CI reduce accidental publication, but they cannot protect against commands such as zip -r run on the checkout. This source-only project should be published from reviewed, tracked Git files. The guard does not OCR images and does not remove data from earlier Git commits. Review binary assets manually, and remember that deleting a sensitive file from the current tree does not delete it from repository history.

add and activate-window create short-lived Codex homes below .runtime/tmp/codex-homes/. They are deleted after use; stale inactive homes older than one hour are pruned on later runs. A process crash or power loss can temporarily leave one behind, so the entire .runtime/ tree must still be treated as secret.

Only the explicit switch command replaces the main Codex auth.json.

Authenticated direct quota requests require HTTPS. Redirects are accepted only when scheme, hostname, and effective port remain the same. Cross-origin, port-changing, and HTTPS-to-HTTP redirects are rejected before a redirected request can carry the Authorization header.

Please use GitHub's private vulnerability reporting feature when it is enabled for this repository. Otherwise, contact the maintainer privately and do not put credentials, complete auth files, or working tokens in a public issue.