[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-94817":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":8,"htmlUrl":8,"language":9,"languages":8,"totalLinesOfCode":8,"stars":10,"forks":11,"watchers":10,"openIssues":12,"contributorsCount":12,"subscribersCount":12,"size":12,"stars1d":12,"stars7d":12,"stars30d":13,"stars90d":12,"forks30d":12,"starsTrendScore":12,"compositeScore":14,"rankGlobal":8,"rankLanguage":8,"license":15,"archived":16,"fork":16,"defaultBranch":17,"hasWiki":18,"hasPages":16,"topics":19,"createdAt":8,"pushedAt":8,"updatedAt":20,"readmeContent":21,"aiSummary":22,"trendingCount":12,"starSnapshotCount":12,"syncStatus":23,"lastSyncTime":24,"discoverSource":25},94817,"codex-oss-agent-kit","thangnqdev\u002Fcodex-oss-agent-kit","thangnqdev",null,"TypeScript",103,95,0,1,43.05,"MIT License",false,"main",true,[],"2026-08-24 04:01:22","# Codex OSS Agent Kit\n\n[![Codex for OSS](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FOpenAI-Codex%20for%20OSS-00A67E?style=for-the-badge&logo=openai)](https:\u002F\u002Fdevelopers.openai.com\u002Fcommunity\u002Fcodex-for-oss)\n[![License: MIT](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FLicense-MIT-yellow.svg?style=for-the-badge)](https:\u002F\u002Fopensource.org\u002Flicenses\u002FMIT)\n[![CI](https:\u002F\u002Fgithub.com\u002Fthangnqdev\u002Fcodex-oss-agent-kit\u002Factions\u002Fworkflows\u002Fci.yml\u002Fbadge.svg)](https:\u002F\u002Fgithub.com\u002Fthangnqdev\u002Fcodex-oss-agent-kit\u002Factions\u002Fworkflows\u002Fci.yml)\n\n> An open-source maintainer toolkit and drop-in GitHub Action for PR review, issue triage, and static secret scanning. Ready to plug into Codex-style maintainer workflows.\n\nThe [OpenAI Codex for Open Source](https:\u002F\u002Fdevelopers.openai.com\u002Fcommunity\u002Fcodex-for-oss) program supports core maintainers of widely used public projects (product access and credits). This repository is **not** an official compliance kit for that program.\n\n---\n\n## Overview\n\n**`codex-oss-agent-kit`** gives maintainers a CLI and a reusable GitHub Action that can:\n\n1. **Review a pull request diff** against the full [`AGENTS.md`](.\u002FAGENTS.md) text via the **OpenAI Responses API** (default model `gpt-5.6`) with a structured JSON schema. The command prints an approval **signal**, score, summary, and `Reviewed lines: N\u002FM`. It does **not** post GitHub inline review comments. The AI verdict is a signal, not the only pass\u002Ffail authority.\n2. **Triage an issue** by classifying category\u002Fcomplexity and recommending labels.\n3. **Audit a source file or unified diff** with static secret\u002Funsafe-pattern checks (`sk-`, `sk-proj-`, `sk-svcacct-`, `ghp_`, `github_pat_`, `eval(`). Unified diffs are scanned on **added (`+`) lines only**. This is a regex scanner, not an OWASP engine or dependency CVE audit.\n\nLive review\u002Ftriage calls use a request timeout, bounded retries on 429\u002F5xx, and structured outputs. Invalid or empty model JSON fails closed (does not auto-approve). Diffs larger than `maxDiffLines` are chunked so every line is reviewed, or the run fail-closes if a single hunk cannot fit. Diff text is treated as **untrusted data**.\n\n`--mock` is for local development only. CI and the drop-in Action never mock-approve when the API key is missing; they print `AI review: SKIPPED`.\n\n---\n\n## Key Features\n\n- **Responses API client**: `gpt-5.6` by default (override via `.codex\u002Fconfig.json` `reviewSettings.model` or `--model`) with timeout, retry, and a JSON schema on the request.\n- **Full `AGENTS.md`**: The reviewer receives the entire file, including numbered quality-gate lines and prose rules.\n- **Config that is actually applied**: `.codex\u002Fconfig.json` is deep-merged; `model`, `maxDiffLines`, and `securityAuditOnPR` change runtime behavior.\n- **Drop-in GitHub Action**: `uses: thangnqdev\u002Fcodex-oss-agent-kit@main` with inputs `openai-api-key`, `model`, `agents-file`, `max-diff-size` and outputs `approved`, `score`, `findings`.\n- **Type-safe core**: TypeScript strict mode. Tests run with Vitest and enforce 80% line\u002Fstatement\u002Fbranch\u002Ffunction coverage.\n\n---\n\n## Quick Start\n\n### From a clone (development)\n\n```bash\nnpm install\nnpm run build\nnode bin\u002Fcodex-oss.js --help\n```\n\n`npm install` runs a `prepare` hook that builds `dist\u002F` when TypeScript is available. `npm start` is `node bin\u002Fcodex-oss.js` and requires that build.\n\n### After publish\n\n```bash\nnpm install -g codex-oss-agent-kit\ncodex-oss --help\n```\n\n### Environment Setup\n\nLive review\u002Ftriage requires a key:\n\n```bash\nexport OPENAI_API_KEY=\"sk-...\"\n```\n\nAlternatively pass `--api-key`. Without a key, pass `--mock` for a local dry-run or the CLI exits non-zero. Audit is static and does not need a key.\n\n---\n\n## CLI Usage\n\nGlobal flags: `--mock`, `--api-key \u003Ckey>`, `--config \u003Cpath>`, `--model \u003Cid>`, `--max-diff-lines \u003Cn>`, `--format text|json`.\n\n`--diff` (review) and `--file` (audit) are required and must be readable. Missing or unreadable paths exit non-zero. A rejected review, an over-limit hunk, or a failed audit (high\u002Fcritical findings on added lines) also exits non-zero.\n\n### 1. Review a Pull Request \u002F Diff\n\n```bash\ncodex-oss --mock review --diff path\u002Fto\u002Ffeature.diff --agents AGENTS.md\ncodex-oss review --diff path\u002Fto\u002Ffeature.diff --agents AGENTS.md\n```\n\n### 2. Triage an Issue\n\n```bash\ncodex-oss --mock triage --title \"Bug: App crashes on launch\" --body \"Steps to reproduce...\"\n```\n\n### 3. Security Audit Code Files\n\n```bash\ncodex-oss audit --file src\u002Fcore\u002Fcodex-client.ts\n```\n\n---\n\n## Drop-in GitHub Action\n\n```yaml\nname: PR review\non: pull_request\njobs:\n  review:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n        with:\n          fetch-depth: 0\n      - uses: thangnqdev\u002Fcodex-oss-agent-kit@main\n        with:\n          openai-api-key: ${{ secrets.OPENAI_API_KEY }}\n          model: gpt-5.6\n          agents-file: AGENTS.md\n          max-diff-size: '1000'\n```\n\nIf `openai-api-key` is empty (typical for fork PRs, where repository secrets are not available), the Action prints `AI review: SKIPPED` and sets `approved=false`. That is not a mock pass.\n\n---\n\n## Architecture\n\n```\n                       ┌────────────────────────────────┐\n                       │    CLI \u002F Action (src\u002Fcli)      │\n                       └───────────────┬────────────────┘\n                                       │\n            ┌──────────────────────────┼──────────────────────────┐\n            ▼                          ▼                          ▼\n   ┌─────────────────┐       ┌──────────────────┐       ┌──────────────────┐\n   │   PR Analyzer   │       │  Issue Triager   │       │ Security Auditor │\n   └────────┬────────┘       └────────┬─────────┘       │ (+ lines of diffs)│\n            │                         │                 └──────────────────┘\n            └─────────────────────────┼──────────────────────────┘\n                                      ▼\n                        ┌──────────────────────────┐\n                        │       CodexClient        │\n                        │   OpenAI Responses API   │\n                        └──────────────────────────┘\n```\n\nThe library entry (`src\u002Findex.ts`) exports core + types only. The CLI is the `codex-oss` bin.\n\n---\n\n## Repository readiness \u002F quality checklist for Codex workflows\n\nThis is a **self-imposed readiness checklist** for running Codex-style maintainer workflows in this repo. It is **not** an official OpenAI “Codex for OSS compliance” standard.\n\n| Check | Status | Details |\n|---|---|---|\n| **OSI approved license** | MIT License | Redistributable open source |\n| **Agent instructions** | `AGENTS.md` | Full file is sent to the reviewer |\n| **Automated workflows** | GitHub Actions | CI, drop-in PR review Action, security scan over `src\u002F**` |\n| **Community docs** | Present | `CONTRIBUTING.md`, `CODE_OF_CONDUCT.md`, `SECURITY.md` |\n| **Quality & coverage** | Vitest | 80% coverage floor enforced in `npm test` |\n\n---\n\n## License\n\nDistributed under the MIT License. See [`LICENSE`](.\u002FLICENSE) for details.\n","这是一个面向开源项目维护者的轻量级AI辅助工具包，提供PR代码审查、Issue分类与敏感信息静态扫描三大核心功能。它基于OpenAI Responses API（默认gpt-5.6）实现结构化JSON输出的AI评审信号，支持本地CLI调用和即插即用的GitHub Action；采用严格TypeScript类型定义，内置超时重试、diff分块处理、安全正则扫描（如sk-、ghp_等密钥模式），并以AGENTS.md为评审依据。适用于中小型开源项目在CI中快速引入可审计、可配置的AI辅助维护流程，不替代人工决策，仅输出审批信号与结构化结果。",2,"2026-08-16 02:30:11","CREATED_QUERY"]