registry / codex-plus-patcher / 0.13.0

codex-plus-patcher@0.13.0

Patch queue tool for building a local Codex Plus.app from an installed Codex.app.

AI Security Review

scanned 17d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. Sensitive primitives are aligned with the package purpose of building/auditing a local patched Codex Plus app and require explicit CLI invocation.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs codex-plus-patcher CLI commands such as apply, dev-sync, launch-dev, audit-plugins, or release mode.

Impact

Creates or launches a patched local Codex Plus.app; no install-time execution, credential exfiltration, persistence, or unconsented AI-agent control-surface mutation identified.

Mechanism

User-invoked local app patching and audit tooling

Rationale

Static inspection shows powerful operations, but they are user-invoked and package-aligned: patching a local app bundle, auditing localhost DevTools, optional GitHub release download, and isolated dev-state sync. No lifecycle execution, hidden exfiltration, persistence, destructive behavior, or unconsented control-surface mutation was found.

Evidence

package.jsonsrc/cli.jssrc/core/patch-engine.jssrc/core/release.jssrc/core/plugin-audit.jssrc/core/dev-mode.jssrc/runtime/host/nativeMain.jssrc/runtime/plugins/mermaidFullscreen.jstarget Codex Plus.app bundleContents/Resources/app.asarContents/Info.plist~/.cache/codex-plus-patcherwork/codex-plus-dev-home

codex-plus-patcher@0.13.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code