@sciilo.ai/codex-sidecar 0.1.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,2 @@
+Sciilo Codex Sidecar
+Copyright 2026 Sciilo Codex Sidecar contributors

package/README.md

@@ -0,0 +1,332 @@
+# Sciilo Codex Sidecar
+
+The sidecar connects a project on your computer to Sciilo. It runs Codex
+locally in the folder you choose and adds the Sciilo tools needed to create or
+update documents, notes, and diagrams.
+
+Codex is installed automatically with the sidecar. You do not need to download
+or install the Codex CLI, the Codex desktop application, or Visual Studio Code
+separately.
+
+Your project code remains in your local Codex workspace. Sciilo receives only
+the folder name and a fingerprint used to recognize the project; the absolute
+folder path is never sent.
+
+## How Sciilo protects document contents
+
+Sciilo encrypts document contents before they are stored. Markdown bodies,
+diagram sources, notes, and generated document excerpts are sealed with
+authenticated AES-256-GCM encryption. The Sciilo backend stores ciphertext and
+never receives the document data key in readable form, so it cannot open these
+protected fields.
+
+Codex still needs to read and update documents to be useful. When the sidecar
+starts, it creates an ephemeral ECDH P-256 key pair. Its private key is
+non-extractable, remains in process memory, and disappears when the sidecar
+stops. The browser seals the document data key for that running sidecar's
+public key; Sciilo only relays the sealed parcel. A parcel captured from an
+earlier run cannot be opened by a later sidecar process.
+
+Once unlocked, the sidecar decrypts protected fields in memory for the local
+Codex runtime and encrypts content-bearing tool calls before they reach the
+backend. Each encrypted value is bound to its document and field. Altering it,
+or moving it to a different document or field, makes decryption fail instead
+of returning plausible but modified content.
+
+This protection has deliberate boundaries:
+
+- the running sidecar and local Codex process can read plaintext, because they
+  need it to work on the documents;
+- document titles, dates, identifiers, links, and other library metadata remain
+  readable so Sciilo can organize the library without opening the vault;
+- document encryption does not cover project files in the local workspace or
+  arbitrary text shared in prompts and assistant conversations;
+- the document key is not kept in the sidecar configuration file; access is
+  restored through the Sciilo vault, using the account password or the recovery
+  key shown by Sciilo;
+- losing both the password and the recovery key can make encrypted contents
+  unrecoverable: there is no server-side back door.
+
+## Before you begin
+
+You need:
+
+- a Sciilo account and a connection key generated in Sciilo;
+- Node.js 22 or later;
+- either a ChatGPT account with access to Codex or an OpenAI API key.
+
+If you already use Codex on this computer, the sidecar can reuse its local
+session. The existing Codex installation itself is optional.
+
+## Guided installation
+
+You can copy and paste the commands below into a terminal.
+
+### 1. Install Node.js
+
+Download the LTS version from [nodejs.org](https://nodejs.org/), install it,
+then close and reopen your terminal.
+
+Check the installation:
+
+```shell
+node --version
+npm --version
+```
+
+The first command must display `v22` or a higher version number.
+
+### 2. Download and install the sidecar
+
+From this repository's GitHub page:
+
+1. click **Code**, then **Download ZIP**;
+2. extract the downloaded archive;
+3. open a terminal in the extracted folder;
+4. run:
+
+```shell
+chmod +x install.sh
+./install.sh
+```
+
+The installation automatically downloads the Codex version selected for the
+sidecar and the binary matching your computer. Codex remains a private
+dependency: no global `codex` command is required.
+
+You may move or delete the downloaded folder after installation without
+breaking the installed command.
+
+Check that the sidecar is available:
+
+```shell
+sciilo-sidecar --help
+```
+
+> On Windows, use
+> [WSL](https://learn.microsoft.com/windows/wsl/install), because the
+> installation script uses Bash.
+
+### 3. Generate the Sciilo connection key
+
+1. open Sciilo and sign in;
+2. open the Codex assistant page;
+3. click **Connect**, then **Generate a key**;
+4. copy the key immediately: it is displayed only once.
+
+This key starts with `sc_`. It connects this sidecar to your Sciilo account; it
+is not an OpenAI key.
+
+### 4. Configure the sidecar and Codex
+
+You can authenticate Codex with a ChatGPT account, an existing local Codex
+session, or an OpenAI API key.
+
+#### Option A — ChatGPT account or existing Codex session
+
+Run:
+
+```shell
+sciilo-sidecar setup
+```
+
+The program asks for:
+
+- **Application URL**: the HTTPS address of your Sciilo application;
+- **Connection key**: the key copied from Sciilo;
+- **Codex provider**: press Enter to use the Codex configuration;
+- **Model**: press Enter to keep `gpt-5.6-sol`, or enter another model available
+  to your account.
+
+After these questions, the sidecar checks Codex authentication:
+
+- if a Codex session already exists on the computer, it is reused;
+- otherwise, a ChatGPT sign-in page opens in your browser.
+
+The sidecar does not copy credentials from an existing installation. Its
+private Codex runtime and other Codex installations simply use the same local
+credential storage managed by Codex.
+
+#### Option B — OpenAI API key
+
+This option uses your OpenAI Platform organization's usage-based billing.
+Create a key on the [API keys](https://platform.openai.com/api-keys) page and
+make sure its project can use the `gpt-5.6-sol` model.
+
+An API key is not dedicated to a single model: it identifies an OpenAI project.
+Model access and billing depend on that project.
+
+To keep the key out of your terminal history, enter it silently:
+
+```shell
+read -s -p "OpenAI API key: " SCIILO_CODEX_API_KEY
+echo
+export SCIILO_CODEX_API_KEY
+sciilo-sidecar setup
+unset SCIILO_CODEX_API_KEY
+```
+
+The sidecar temporarily passes the key to Codex credential storage and does
+not keep a copy in its own configuration.
+
+If a ChatGPT or Codex session is already active, it is reused first. To
+deliberately change accounts or authentication methods, sign out through the
+Codex installation that currently manages that session, then run the setup
+again.
+
+ChatGPT sign-in uses the permissions of your subscription or workspace. An API
+key uses your OpenAI Platform organization's usage-based billing. See the
+[official Codex authentication documentation](https://learn.chatgpt.com/docs/codex/auth)
+for details.
+
+The sidecar configuration is stored in
+`~/.config/sciilo-sidecar/config.json`, with permissions restricted to your
+user account. One configuration works for every project on the computer.
+
+### 5. Start the sidecar in a project
+
+Open a terminal in the project folder:
+
+```shell
+cd /path/to/my-project
+sciilo-sidecar
+```
+
+The current folder becomes the Codex workspace and selects the corresponding
+project in Sciilo. Keep this terminal open while using the sidecar. Press
+`Ctrl+C` to stop it.
+
+To select a folder without changing directories:
+
+```shell
+sciilo-sidecar --workspace /path/to/my-project
+```
+
+## Everyday use
+
+Display the configuration and Codex sign-in status:
+
+```shell
+sciilo-sidecar status
+```
+
+Open another project:
+
+```shell
+cd /path/to/another-project
+sciilo-sidecar
+```
+
+Only one sidecar may use a connection key at a time. If two processes connect
+with the same key, Sciilo revokes it to prevent them from continuously
+replacing each other.
+
+## Updating
+
+Download and extract the new repository version, then run:
+
+```shell
+./install.sh
+```
+
+The sidecar and its private Codex runtime are replaced together. Your Sciilo
+configuration and local Codex session are preserved.
+
+## Uninstalling
+
+Remove the sidecar and its private Codex runtime:
+
+```shell
+npm uninstall --global @sciilo.ai/codex-sidecar
+```
+
+This command does not remove the configuration stored in
+`~/.config/sciilo-sidecar/` or the local session managed by Codex.
+
+## Security and privacy
+
+- Never share your Sciilo connection key or OpenAI API key.
+- No OpenAI key is embedded in the distributed package.
+- The sidecar configuration file is created with permissions restricted to
+  your user account (`0600`).
+- A remote Sciilo connection must use HTTPS. HTTP is accepted only for
+  `localhost`.
+- The absolute workspace path remains on your computer. The sidecar sends only
+  the folder name and a stable SHA-256 fingerprint.
+- Codex asks for the required approvals before protected operations, according
+  to your Codex configuration.
+- The Codex runtime is pinned to a version tested with the sidecar and changes
+  only when you update the sidecar.
+
+## Troubleshooting
+
+### `node: command not found` or a version below 22
+
+Install the current LTS version from [nodejs.org](https://nodejs.org/), reopen
+the terminal, and run `node --version` again.
+
+### `sciilo-sidecar: command not found`
+
+Run `./install.sh` again. At the end, the installer displays either the command
+path or the line you need to add to your `PATH`.
+
+### A global `codex` command cannot be found
+
+This is expected: the Codex runtime supplied with the sidecar is private and
+does not need to be in your `PATH`. Use:
+
+```shell
+sciilo-sidecar status
+```
+
+### The Codex runtime is missing or damaged
+
+Download the repository again and run:
+
+```shell
+./install.sh
+```
+
+The installer automatically downloads the Codex package for your platform.
+
+### Permission error during installation
+
+Do not use `sudo`. Install Node.js for your user account, reopen the terminal,
+and run `./install.sh` again.
+
+### Codex is not authenticated
+
+Run:
+
+```shell
+sciilo-sidecar setup
+```
+
+To use an API key, repeat the commands from option B without writing the key
+directly on the command line.
+
+### The Sciilo key is rejected or revoked
+
+Stop every sidecar with `Ctrl+C`, generate a new key in Sciilo, then run:
+
+```shell
+sciilo-sidecar setup
+```
+
+### The sidecar does not connect
+
+Check:
+
+```shell
+node --version
+sciilo-sidecar status
+```
+
+Also make sure the Sciilo address starts with `https://`, except for a local
+installation on `localhost`.
+
+## License
+
+Sciilo Codex Sidecar is licensed under the
+[Apache License 2.0](./LICENSE). See [NOTICE](./NOTICE) for attribution
+information.