Codex Session Auditor

Inspiration## Inspiration

Teams shipping code with Codex have no visibility into which parts of a change were AI-decided versus human-directed, or which files carry real risk, before that code gets merged. We wanted a tool that turns a Codex session into something a reviewer can actually trust — not just a summary, but an audit.

What it does

Codex Session Auditor reads a local Codex session transcript, reconstructs every file diff, sends each decision to GPT-5.6 for classification (autonomous, directed, corrected, or stuck), scores every touched file for risk, and estimates time saved versus manual coding. The result is an interactive report you can view locally, export as a self-contained HTML file, or deploy live to a public URL — all from one CLI.

How we built it

Built entirely with Codex running GPT-5.6, across a structured sequence of build phases — from monorepo scaffolding through a GPT-5.6-powered classification engine, a SQLite persistence layer, a React/Vite dashboard, and finally npm publishing and Vercel deployment.

Challenges we ran into

The biggest challenge was a wrong initial assumption: we first assumed Codex exposed a remote API to fetch a session transcript by ID. It doesn't — Codex sessions are stored locally as JSONL rollout files. We had Codex investigate the real file structure directly, discovered file edits are embedded inside custom_tool_call entries calling tools.apply_patch(...), and rewrote the parser to match reality instead of our assumption. We also debugged a Vercel deployment API error (a missing projectSettings field) and an ESM/CommonJS packaging mismatch that broke the global npm install — both fixed by reading the actual error output rather than guessing.

What we learned

That the fastest way to get a working tool from Codex is to have it investigate real data structures before writing code against them, rather than building on assumptions. Every real bug we hit was solved faster by asking Codex to print raw evidence first, then fix based on what it found.

What's next for Codex Session Auditor

Publishing @codex-session-auditor/core as its own reusable package, adding a hosted multi-user version, and expanding risk scoring with configurable rules per team/org.

What it does

How we built it

Challenges we ran into

Accomplishments that we're proud of

What we learned

What's next for Codex Session Auditor

Built With

• chalk
• ci/cd:
• github
• inquirer.js
• jsdiff-(diff-reconstruction)-ai-classification:-openai-api-(gpt-5.6)
• language/runtime:-node.js-20-lts
• node-worker-threads-for-parallelized-batch-processing-persistence:-sqlite-via-better-sqlite3-(wal-mode-for-concurrency-safety)-web-dashboard:-react
• ora-session-parsing:-zod-(schema-validation)
• playwright-(dashboard-e2e)-quality:-eslint
• prettier
• recharts-deployment:-vercel-(free-tier)
• shadcn/ui
• tailwind-css
• typescript-(strict-mode)-cli:-commander.js
• via-direct-rest-api-calls-testing:-vitest-(unit-+-integration)
• vite-(vite-plugin-singlefile-for-self-contained-builds)