Codex 状态浮窗 performs no network requests and stores no task content. It reads Codex task metadata locally to derive a status light and quota percentage.

The monitor:

• opens the Codex SQLite database in read-only, query-only mode;
• accepts rollout files only when they resolve inside $CODEX_HOME/sessions/;
• accepts regular .jsonl files only;
• never reads auth.json, API keys, browser data, or unrelated files;
• expires cached weekly quota at its reset time;
• stores only presentation preferences, window position, the last acknowledged completion timestamp, cached quota metadata, and observed status in NSUserDefaults.

Please open a GitHub security advisory for vulnerabilities. Avoid public Issues when a report contains private paths, task text, credentials, or other sensitive material.

Include the affected version, macOS version, a minimal reproduction, and sanitized logs. Do not attach a real Codex rollout file.