Public alpha: Codex usage limits monitor

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,32 +1,62 @@
 ---
 name: Bug report
-about: Report a bug with bird CLI
+about: Report a reproducible Codex Reset Request or retained Bird CLI problem
 title: '[BUG] '
 labels: bug
 assignees: ''
 ---
 
-**Describe the bug**
-A clear description of what the bug is.
+> For a vulnerability or sensitive conduct report, stop and use the private
+> route in [SECURITY.md](../../SECURITY.md). Never put credentials or private
+> data in a public issue.
 
-**Commands run**
-```bash
-# What command did you run?
-```
+**Safety check**
+
+- [ ] I removed cookies, tokens, authorization headers, browser databases/profile
+  paths, `~/.codex/auth.json`, prompt/source/tool text, raw rollout records, raw
+  network bodies, home-directory paths, and full unredacted output. I did not
+  attach `config.json`, `state.json`, `cursors.json`, `audit.jsonl`, watcher
+  locks, or service logs.
+
+**Component**
+
+`codex-reset-request` / retained `bird` CLI / documentation / other
+
+**Safe summary**
+
+A concise description without account data or private content.
+
+**Safe codes**
+
+Transcribe only the relevant safe codes from `doctor`, `status`, or service
+status. Do not paste complete output.
+
+**Minimal synthetic reproduction**
+
+List commands and synthetic inputs only. Do not attach real rollout files,
+browser data, or raw responses.
 
 **Expected behavior**
+
 What you expected to happen.
 
 **Actual behavior**
-What actually happened. Include full error output.
+
+What happened? Use safe codes; do not include full error output.
 
 **Environment**
-- OS: [e.g. Ubuntu 24.04]
-- Node version: [e.g. v22.22.3]
-- bird version: [e.g. v3.0.0]
-
-**Env file check**
-```bash
-# Run this and confirm auth_token is 40 chars:
-python3 -c "print(len(open(os.path.expanduser('~/.config/bird/env')).read().split('\"')[1]))"
-```
+
+- OS and version:
+- Node version:
+- pnpm version:
+- `codex-reset-request` version:
+- Codex CLI version:
+- retained `bird` version, if relevant:
+- run mode (`dry-run` or `auto`):
+- foreground / launchd / systemd:
+
+**Live activity**
+
+State whether any live X read or write occurred. If a write occurred, state
+only whether it targeted your own post and the final safe status; do not attach
+credentials or raw responses.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Private security or conduct report
+    url: https://github.com/ncihxaonn/codex-reset-request/security/advisories/new
+    about: Use the private reporting route; never disclose credentials or sensitive evidence publicly.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,13 +1,28 @@
 ---
 name: Feature request
-about: Suggest a new feature
+about: Suggest a focused Codex Reset Request feature
 title: '[FEATURE] '
 labels: enhancement
 assignees: ''
 ---
 
-**Describe the feature**
-A clear description of what you'd like to add.
+> For a vulnerability or sensitive conduct report, stop and use the private
+> route in [SECURITY.md](../../SECURITY.md). Never put credentials or private
+> data in a public issue.
 
-**Use case**
-What problem does this solve?
+**Problem and user value**
+
+What local workflow problem would this solve?
+
+**Proposed behavior**
+
+Describe the smallest useful behavior without private account data.
+
+**Threat-model and privacy impact**
+
+Explain any effect on Codex reads, X reads/writes, local state, logs, services,
+or credentials.
+
+Requests for polling, retries after ambiguous writes, bulk/multi-account
+posting, CAPTCHA/stealth/proxy bypass, telemetry, or runtime LLM calls are out
+of scope.

.github/dependabot.yml

@@ -0,0 +1,23 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: '09:00'
+      timezone: Australia/Melbourne
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: deps
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: '09:30'
+      timezone: Australia/Melbourne
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: ci

.github/pull_request_template.md

@@ -0,0 +1,54 @@
+## Summary
+
+What changed, and why?
+
+## Threat-model impact
+
+Describe any effect on rollout classification, App Server schemas, X
+reads/writes, target selection, consent, deduplication, rate guards, state
+recovery, logs, subprocesses, filesystem paths, or services.
+Write `None` only after checking.
+
+## Verification
+
+- [ ] `pnpm run typecheck`
+- [ ] `pnpm run lint`
+- [ ] `pnpm run test`
+- [ ] `pnpm run build:dist`
+- [ ] `pnpm run verify:no-polling`
+- [ ] `pnpm run verify:no-secrets`
+- [ ] `pnpm run verify:attribution`
+- [ ] Native watcher tests ran without a skip, or CI is expected to provide the
+  required host evidence.
+
+List any additional focused tests.
+
+## Safety invariants
+
+- [ ] Fresh configuration and `setup` remain dry-run by default; `install`
+  selects automatic posting only after current explicit consent and a running
+  service check.
+- [ ] No local OS-notification feature was added.
+- [ ] One logical action can perform at most one X mutation attempt; ambiguous
+  results never retry.
+- [ ] Account, target, consent, configuration, deduplication, lock, and hard rate
+  guards remain fail closed.
+- [ ] No periodic quota/X polling, cron/timer, telemetry, runtime LLM,
+  CAPTCHA/stealth/proxy bypass, or bulk/multi-account behavior was added.
+- [ ] Subprocesses use argv arrays without a shell.
+- [ ] No credentials, private rollout data, prompt/source/tool text, raw response
+  body, browser data, home path, or unredacted output is included.
+
+## Live X activity
+
+- [ ] No live X operation occurred.
+- [ ] A read-only live test occurred; describe only safe metadata below.
+- [ ] One explicitly authorized write to my own test post occurred; record only
+  the final safe status below.
+
+## Documentation and provenance
+
+- [ ] User-facing behavior, privacy/security implications, and compatibility
+  notes are updated where applicable.
+- [ ] Bird syncs update `UPSTREAM.md` and `docs/compatibility.md` and preserve MIT
+  attribution, or this is not a Bird sync.

.github/workflows/ci.yml

@@ -0,0 +1,67 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  CI: 'true'
+  COREPACK_ENABLE_DOWNLOAD_PROMPT: '0'
+  COREPACK_DEFAULT_TO_LATEST: '0'
+
+jobs:
+  verify:
+    name: Node 22 / ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 25
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        node: ['22']
+    steps:
+      - name: Check out full history
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+          persist-credentials: false
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ matrix.node }}
+          package-manager-cache: false
+      - name: Enable pinned pnpm
+        run: corepack enable pnpm
+      - name: Show tool versions
+        run: |
+          node --version
+          pnpm --version
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Typecheck
+        run: pnpm run typecheck
+      - name: Lint
+        run: pnpm run lint
+      - name: Test (native watchers required)
+        env:
+          CRR_REQUIRE_NATIVE_WATCH: '1'
+        run: pnpm run test
+      - name: Build distribution
+        run: pnpm run build:dist
+      - name: Verify no polling
+        run: pnpm run verify:no-polling
+      - name: Verify no secrets
+        run: pnpm run verify:no-secrets
+      - name: Verify attribution
+        run: pnpm run verify:attribution

.github/workflows/codeql.yml

@@ -0,0 +1,42 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: codeql-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: CodeQL / ${{ matrix.language }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [javascript-typescript, actions]
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        with:
+          build-mode: none
+          languages: ${{ matrix.language }}
+          queries: security-extended
+      - name: Analyze
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9

.github/workflows/secret-scan.yml

@@ -0,0 +1,44 @@
+name: Secret scan
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: secret-scan-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  CI: 'true'
+  COREPACK_ENABLE_DOWNLOAD_PROMPT: '0'
+  COREPACK_DEFAULT_TO_LATEST: '0'
+
+jobs:
+  scan:
+    name: Repository and derivative history
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Check out full history
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+          persist-credentials: false
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '22'
+          package-manager-cache: false
+      - name: Enable pinned pnpm
+        run: corepack enable pnpm
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Scan current tree and derivative history
+        run: pnpm run verify:no-secrets

.gitignore

@@ -1,4 +1,5 @@
 node_modules/
+.pnpm-store/
 dist/
 *.log
 .pnpm-debug.log*
@@ -16,6 +17,7 @@ twitter-cli.bin
 bird
 .env
 .*.bun-build
+.tmp/
 *.zip
 *.tar
 *.tar.gz

AGENTS.md

@@ -0,0 +1,17 @@
+# AGENTS.md
+
+- Never commit real Codex rollout files.
+- Never commit browser cookies, auth_token, ct0, or Codex credentials.
+- Never print prompts, source code, tool output, cookies, or auth tokens.
+- Never add periodic quota polling.
+- Never retry an ambiguous X write.
+- One logical action may perform at most one X mutation attempt.
+- Never add CAPTCHA bypass, stealth, fingerprint spoofing, or proxy rotation.
+- Keep all subprocess arguments as arrays; do not invoke through a shell.
+- Preserve all upstream MIT attribution.
+- Update UPSTREAM.md and docs/compatibility.md when syncing Bird.
+- Add tests for every Codex schema or X GraphQL parser change.
+- Run typecheck, lint, tests, build, and security checks before committing.
+- Do not publish an npm package without an explicit instruction.
+- Do not create a private repository.
+- Do not describe the project as official, compliant, safe, or guaranteed.