codexhost update impact audit

codexhost update impact audit

Audit before changing codexhost. Produce a verdict backed by bundle and live-Renderer evidence. Apply a fix only when the user explicitly requests one.

可先运行 npm run audit:codex-desktop 辅助检测；该命令不能替代下面的语义对比、ownership 追踪、真实 Renderer 探测和必要的行为验证，后续步骤仍须继续执行。

Guardrails

• Read the repository AGENTS.md and record git status; preserve unrelated dirty-worktree changes.
• Treat Codex Desktop private DOM, React state, and main-process services as versioned contracts.
• Use semantic attributes, API shape, ownership, and observed relationships as contracts. Bundle hashes, asset names, minified identifiers, localized labels, private CSS classes, credentials, prompts, and full payloads are evidence only.
• Start with a read-only inspection of an existing codexhost-controlled Desktop. Use a controlled launch or mutate Renderer state only when the required boundary cannot otherwise be verified.
• Store only sanitized evidence under ignored .codexhost/update-impact/. Never persist Thread IDs, request IDs, prompts, transcripts, tokens, credentials, URL query/hash values, or full DOM snapshots.
• Do not change production code during an audit. Do not claim a live or routing result unless that exact check ran.

1. Establish the comparison chain

Record the installed executable, Desktop version/build, Chromium version, and app.asar hash. Determine these distinct versions when possible:

• reviewed baseline: the last version whose audit passed;
• direct predecessor: the version immediately before the installed build;
• current: the installed build under review.

Use the reviewed baseline for the compatibility decision. Use a direct predecessor only to localize the newest change. Never silently substitute a much older bundle for either role.

Search, in order, for prior evidence under .codexhost/update-impact/, Sparkle installation caches, compatibility fixtures, and other complete local installations. The official Sparkle appcast may establish release order and download locations, but downloading a full application is optional and must not block the audit when live evidence and a reviewed baseline are available.

Unpack each available app.asar into a temporary directory. After the audit, retain a minimal sanitized baseline at:

.codexhost/update-impact/<version>/
  manifest.json
  app-initial.js
  app-initial.css
  composer-utility-bar.js
  marker-inventory.json
  live-renderer.json

manifest.json should identify version/build, Chromium version, executable path, hashes, audit time, verdict, and which checks actually ran. Do not retain a full application or archive merely for the next comparison.