Ship-It Stream

Inspiration

Coding streams are fun to watch but hard to play. Chat shouts ideas, nothing comes of them, and viewers drift off. We wanted Codex itself to be the on-stream game mechanic: chat picks the feature, Codex builds it, and the streamer ships it.

What it does

• !ship <idea>: any viewer adds a small change request (copy, theme, component, page, or bugfix) to a queue.
• Safety filter: requests about secrets, tokens, env files, installs, shell or network access, workflows, or prompt injection are blocked before they reach Codex.
• !startvote / !vote N / !endvote: a mod or the broadcaster runs a timed vote with one ballot per viewer. The overlay shows live bars and a countdown.
• Codex builds it: the winning idea goes to codex exec in an isolated sandbox clone. Its JSONL events stream to the overlay's "Codex is coding" ticker.
• Diff gate: limits on file count and line count. Changes to .env, package.json, lockfiles, .github, .git, or next.config, and symlinks or binaries, are rejected.
• GitHub PR: the bot commits, pushes a ship/<id> branch, and opens a PR.
• !approve / !reject: only a mod or the broadcaster can approve. Other viewers get "Moderator or broadcaster only". On approval the bot squash-merges the exact SHA that was reviewed and detects any tampering after review.
• OBS overlay: a transparent 1920×1080 browser source with the queue, vote, build desk (files and +/−), PR link, approval banner, and live activity log, pushed over SSE.

How we built it with Codex

The whole project was built inside one main Codex thread (session ID: 01a18511-89c1-77e2-af2f-4fea85ef1cef). That covers the Twitch EventSub WebSocket client with reconnect and revocation handling, OAuth and Helix chat, the command parser and permissions, the vote engine, the safety classifier and diff gate, the codex exec runner, the gh PR and merge flow, the overlay, and a test suite with an end-to-end simulation. Codex is also the runtime: every round on stream is a live codex exec run against the sandbox repo.

Challenges we ran into

• Making the bot safe to hand to strangers. We used layered defenses: a request denylist, a sandbox clone, a diff gate on file paths and modes, human approval, and merging only the reviewed SHA.
• Keeping all credentials out of chat, logs, the Codex environment, and the overlay. Codex gets an allowlisted environment.
• EventSub WebSocket edge cases: welcome, keepalive, reconnect, revocation, and deduplication.
• A demo-friendly local loop (an HTTP or stdin chat simulator plus DRY_RUN) so anyone can test without Affiliate status or channel points.

Accomplishments we're proud of

A real end-to-end loop on Twitch: chat on kyl3kan3 → vote → Codex → PR #3 → !approve → merged in about 3 minutes.

What we learned

Small, scoped task types and a hard human-approval gate make "chat writes code" both safe and fun to watch.

What's next

• Vercel preview deploys per PR, shown as a QR code or link on the overlay before approval.
• Channel-point redemptions for !ship and votes (once Affiliate).
• An inline diff viewer and animations in the overlay.
• Multi-streamer collab rounds and a leaderboard of viewers who shipped code.

Built With

• codex-cli
• git
• github-cli
• next.js
• node.js
• obs-browser-source
• openai-codex
• server-sent-events
• twitch-eventsub
• twitch-helix-api
• twitch-oauth
• typescript