From 4a0cba4e349f5076ce909bdd95d82b9f0c4a619c Mon Sep 17 00:00:00 2001 From: CodePilot Date: Fri, 17 Jul 2026 07:18:56 +0200 Subject: [PATCH 01/44] Refine public beta iOS docs --- docs/CHANGELOG.md | 1 + docs/INSTALL_IOS.md | 22 ---------------------- docs/RELEASE_CHECKLIST.md | 2 ++ 3 files changed, 3 insertions(+), 22 deletions(-) diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index 00d3e621..f9523814 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -9,6 +9,7 @@ - Documented the Mac, gateway, iPhone, Cloudflare, and troubleshooting paths from a public user perspective. - Added a local TestFlight/App Store metadata draft for maintainer review before any App Store submission. - Added guidance for keeping screenshots, logs, support requests, and public issues free of private names, hosts, tokens, and local paths. +- Kept iOS beta installation docs focused on user setup and moved App Store Connect maintainer checks to the release checklist. ### Recent Product Work diff --git a/docs/INSTALL_IOS.md b/docs/INSTALL_IOS.md index aee06b94..4e8e85c5 100644 --- a/docs/INSTALL_IOS.md +++ b/docs/INSTALL_IOS.md @@ -26,28 +26,6 @@ For the public beta, enter the Cloudflare Tunnel URL. The Mac gateway listens on The gateway URL must include `http://` or `https://`. -## App Store Connect Setup - -The local Fastlane credentials live in the ignored file: - -```sh -ios/CodexPhone/fastlane/.env -``` - -To create an Apple web session for App Store record creation, run from the repo root: - -```sh -scripts/apple-spaceauth.sh -``` - -Paste the generated `FASTLANE_SESSION` into `ios/CodexPhone/fastlane/.env`, then run: - -```sh -scripts/create-app-store-record.sh -``` - -The App Store Connect API key can manage signing resources, but Apple still requires an Apple ID web session for creating a new App Store app record. - ## Notifications The iOS app can register for turn-finished notifications. APNs certificates or keys must be configured in the gateway environment before background notifications can be delivered reliably. diff --git a/docs/RELEASE_CHECKLIST.md b/docs/RELEASE_CHECKLIST.md index 464b5faf..843ad0dc 100644 --- a/docs/RELEASE_CHECKLIST.md +++ b/docs/RELEASE_CHECKLIST.md @@ -7,6 +7,8 @@ - [ ] `scripts/privacy-audit.sh` - [ ] OTA build if iOS app files changed - [ ] Public manifest and IPA return HTTP 200 from the OTA domain +- [ ] App Store Connect/Fastlane credentials stay in ignored local files only +- [ ] App Store Connect record or web-session setup is performed only by an approved maintainer - [ ] TestFlight upload if shipping a beta build - [ ] `docs/APP_STORE_METADATA_DRAFT.md` reviewed before App Store Connect changes - [ ] Public docs checked for personal names, private email addresses, tokens, hostnames, Apple team IDs, and machine-specific paths From 49f8690b19d7971cbcac701baf585c402b5484bd Mon Sep 17 00:00:00 2001 From: CodePilot Date: Fri, 17 Jul 2026 07:18:56 +0200 Subject: [PATCH 02/44] docs: align beta connection copy --- README.md | 4 +-- docs/APP_STORE_METADATA_DRAFT.md | 2 +- docs/CHANGELOG.md | 1 + docs/INSTALL_MAC.md | 2 ++ docs/SCREENSHOTS.md | 58 ++++++++++++-------------------- docs/SUPPORT.md | 40 ++++++++++++++++++++++ docs/index.md | 4 ++- 7 files changed, 70 insertions(+), 41 deletions(-) create mode 100644 docs/SUPPORT.md diff --git a/README.md b/README.md index 2d638302..54c694d4 100644 --- a/README.md +++ b/README.md @@ -15,7 +15,7 @@ Commercial use requires a separate written license. See [LICENSE.md](LICENSE.md) - **CodePilot Mac**: a macOS menu bar app that tracks usage, manages account profiles, and coordinates automatic account switching. - **CodePilot Gateway**: a local Python gateway that exposes threads, jobs, files, usage, notifications, and account controls to trusted clients. - **CodePilot iOS**: an iPhone app that connects to the gateway for remote chat, file uploads, usage status, steering, stopping turns, and notifications. -- **Cloudflare Tunnel support**: optional remote access to the gateway through a user-owned Cloudflare Tunnel. +- **Cloudflare Tunnel support**: public-beta iPhone access to the gateway through a user-owned Cloudflare Tunnel. ## Current Provider Support @@ -45,7 +45,7 @@ The public product name is provider-neutral, but the first implementation remain scripts/install-phone-gateway-agent.sh ``` -5. Optional: configure Cloudflare Tunnel for remote iPhone access. +5. Configure Cloudflare Tunnel for public-beta iPhone access. 6. Install the iOS app and enter the gateway URL plus bearer token. See: diff --git a/docs/APP_STORE_METADATA_DRAFT.md b/docs/APP_STORE_METADATA_DRAFT.md index d8fdddc2..35efc2ad 100644 --- a/docs/APP_STORE_METADATA_DRAFT.md +++ b/docs/APP_STORE_METADATA_DRAFT.md @@ -32,7 +32,7 @@ Codex, coding agent, developer tools, Mac, iPhone, remote coding, AI coding, Tes Install CodePilot on a Mac that already runs Codex CLI, create a saved account profile, start the gateway, connect the iPhone app with the gateway URL and token, and verify thread visibility, file upload, turn control, notifications, and setup recovery messages. -Please include the connection and recovery flow you tested. Remove account names, gateway URLs, tokens, hostnames, local paths, private prompts, screenshots, and logs containing private data before sharing feedback. +Please report whether Cloudflare Tunnel setup, gateway connection, or token entry was the step that failed. Remove account names, gateway URLs, tokens, hostnames, local paths, private prompts, screenshots, and logs containing private data before sharing feedback. ## Support URL diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index f9523814..8cb2451d 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -10,6 +10,7 @@ - Added a local TestFlight/App Store metadata draft for maintainer review before any App Store submission. - Added guidance for keeping screenshots, logs, support requests, and public issues free of private names, hosts, tokens, and local paths. - Kept iOS beta installation docs focused on user setup and moved App Store Connect maintainer checks to the release checklist. +- Aligned public-beta iPhone connection copy around Cloudflare Tunnel while LAN setup remains unsupported. ### Recent Product Work diff --git a/docs/INSTALL_MAC.md b/docs/INSTALL_MAC.md index b9a827cc..07e8994e 100644 --- a/docs/INSTALL_MAC.md +++ b/docs/INSTALL_MAC.md @@ -57,6 +57,8 @@ The gateway listens on: http://127.0.0.1:18790 ``` +That local address is for CodePilot on the Mac and for Cloudflare Tunnel. A physical iPhone cannot reach `127.0.0.1` on the Mac directly. Use Cloudflare remote access for the public beta; LAN-bound gateway access is outside the supported beta path until CodePilot ships explicit firewall and trust guidance. + The bearer token is stored at: ```text diff --git a/docs/SCREENSHOTS.md b/docs/SCREENSHOTS.md index 743aeef0..2797ffa8 100644 --- a/docs/SCREENSHOTS.md +++ b/docs/SCREENSHOTS.md @@ -2,40 +2,24 @@ No public screenshots are committed yet. -Create real screenshots only from sanitized demo data. Run `scripts/privacy-audit.sh` before committing screenshot references, then manually inspect every image because the script cannot read pixels. - -## Demo Data Contract - -Use only these public-safe values while capturing screenshots: - -- Account names: `Work`, `Personal`, `Demo`. -- Gateway host: `codepilot.example.com`. -- Project names: `demo-ios-app`, `demo-gateway`, `demo-docs`. -- Thread names: `Fix onboarding copy`, `Review gateway status`, `Draft beta notes`. -- Upload examples: `sample-log.txt`, `demo-screenshot.png`, `release-notes.md`. - -Do not show real local paths, private repository names, prompts, hostnames, account identifiers, Apple IDs, team IDs, signing details, TestFlight account details, gateway bearer tokens, auth file contents, QR secrets, or live desktop content. - -## Beta Screenshot Manifest - -Capture the initial public beta set with these filenames under `docs/assets/screenshots/`: - -| File | Surface | Required safe state | -| --- | --- | --- | -| `mac-menu-status.png` | Mac menu bar status | Demo account usage only; no personal menu bar extras in frame. | -| `mac-setup-checklist.png` | Mac setup checklist | Ready and optional states visible; no local paths or private account details. | -| `mac-cloudflare-wizard.png` | Cloudflare wizard | Uses `codepilot.example.com`; no tunnel IDs, tokens, or dashboard account data. | -| `ios-connection-cloudflare.png` | iPhone connection setup | Cloudflare mode only for public beta; no Same Network setup path shown. | -| `ios-thread-list.png` | iPhone thread list | Demo thread and project names only. | -| `ios-file-upload.png` | File upload confirmation | Demo filenames only; no document previews with private content. | -| `ios-remote-desktop-permission.png` | Remote Desktop permission state | Pending or approval copy only; no live desktop pixels. | - -## Review Checklist - -Before committing or publishing screenshots: - -- Confirm every image uses the manifest filename and safe state above. -- Inspect the full-resolution image, not only a thumbnail. -- Verify no private names, email addresses, hostnames, local usernames, machine names, paths, tokens, account identifiers, repositories, prompts, Apple identifiers, or private screenshots appear. -- Verify cropped windows do not expose private menu bar items, browser tabs, terminal prompts, desktop files, notifications, or status menus. -- Update README, GitHub Pages, TestFlight, or App Store metadata only after the images pass this review and maintainer approval covers that use. +Use this checklist before adding screenshots to the repository, GitHub Pages, TestFlight, App Store metadata, README, or support docs: + +- Use demo account names only, such as `Work`, `Personal`, or `Demo`. +- Use example hostnames only, such as `codepilot.example.com`. +- Hide gateway bearer tokens and auth details. +- Hide local file paths unless the path is a generic example. +- Hide private thread names, prompts, uploads, and repository names. +- Hide Apple IDs, team IDs, bundle signing details, and TestFlight account details. +- Prefer clean beta flows: setup checklist, gateway status, iPhone connection, thread list, file upload, and remote desktop permission state. + +Recommended beta screenshot set: + +- Mac menu bar status with demo account usage. +- Mac setup checklist showing ready and optional states. +- Cloudflare setup wizard using an example hostname. +- iPhone connection wizard for the public-beta Cloudflare path. +- iPhone thread list with demo thread names. +- File upload confirmation using non-private sample files. +- Remote desktop permission screen without a live private desktop. + +Create real screenshots only from sanitized demo data. diff --git a/docs/SUPPORT.md b/docs/SUPPORT.md new file mode 100644 index 00000000..c5658264 --- /dev/null +++ b/docs/SUPPORT.md @@ -0,0 +1,40 @@ +# Support + +CodePilot beta support is handled through public repository issues and pull requests. + +## Before Opening An Issue + +Check: + +- [Mac installation](INSTALL_MAC.md) +- [iOS installation](INSTALL_IOS.md) +- [Cloudflare setup](CLOUDFLARE_SETUP.md) +- [Troubleshooting](TROUBLESHOOTING.md) +- [Security](SECURITY.md) +- [FAQ](FAQ.md) + +## Helpful Issue Details + +Include: + +- Mac app, gateway, or iOS app area affected. +- What you expected to happen. +- What happened instead. +- Whether Cloudflare setup, gateway connection, or token entry is the failing step. +- The visible recovery message, if one appears. +- Sanitized logs with private values removed. + +## Do Not Share + +Do not include: + +- Codex auth files. +- Gateway bearer tokens. +- Private hostnames or Cloudflare tunnel URLs. +- Personal account names or email addresses. +- Apple account, team, signing, or TestFlight identifiers. +- Screenshots that show private files, paths, accounts, tokens, or hosts. + +## Security Reports + +For issues involving exposed credentials, unsafe gateway access, remote desktop bypass, or uploaded private files, avoid public details. Open a minimal issue that says a security report is available and coordinate disclosure with the maintainers. diff --git a/docs/index.md b/docs/index.md index 37c20572..28a0307f 100644 --- a/docs/index.md +++ b/docs/index.md @@ -6,7 +6,7 @@ The beta is focused on practical workflows for AI coding users: - See active Codex usage and account status from the Mac and iPhone. - Switch saved Codex account profiles after active turns finish. -- Connect the iPhone app to the Mac gateway on the same network or through a user-owned Cloudflare Tunnel. +- Connect the iPhone app to the Mac gateway through a user-owned Cloudflare Tunnel during the public beta. - Upload files, inspect threads, steer or stop turns where supported, and receive turn-finished notifications. - Use remote desktop features only after pairing and macOS permission checks. @@ -29,4 +29,6 @@ CodePilot is source-available for noncommercial use. It is not OSI open source. CodePilot currently targets Codex CLI. Future provider support is not part of the first beta promise. +The public-beta iPhone setup uses Cloudflare Tunnel. Same-network iPhone access is not part of the supported beta path until CodePilot ships explicit LAN-binding, firewall, and trust guidance. + Do not share screenshots, logs, gateway URLs, tokens, account names, hostnames, or local file paths in public issues unless they have been sanitized. From b42cd8944acda206fc2b3491dac1744634a79f4c Mon Sep 17 00:00:00 2001 From: CodePilot Date: Fri, 17 Jul 2026 07:18:56 +0200 Subject: [PATCH 03/44] Add beta privacy policy --- docs/PRIVACY.md | 54 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 54 insertions(+) create mode 100644 docs/PRIVACY.md diff --git a/docs/PRIVACY.md b/docs/PRIVACY.md new file mode 100644 index 00000000..840f9b6d --- /dev/null +++ b/docs/PRIVACY.md @@ -0,0 +1,54 @@ +# Privacy + +CodePilot is a public beta for people who already run Codex CLI on a Mac they control. The current beta does not require a hosted CodePilot account service. + +This page describes the repository beta behavior. App Store privacy labels and any hosted service policy still require maintainer approval before submission. + +## Local Data + +CodePilot works with local coding-agent state on your Mac, including Codex login state, saved account profiles, usage data, gateway settings, uploaded files, thread metadata, and notification state. + +Sensitive local files include: + +- `~/.codex/auth.json` +- `~/.codex/state_5.sqlite` +- `~/.codex-account-switcher/accounts/` +- `~/.codex-account-switcher/phone-gateway-token` +- `~/.codex-account-switcher/phone-gateway.env` +- `~/.codex-account-switcher/phone-uploads/` + +Do not commit these files, include them in public issues, or show them in screenshots. + +## Mac Gateway + +The CodePilot gateway runs on your Mac and requires a bearer token. It exposes CodePilot features to trusted clients, including account status, usage status, thread access, file upload, notification registration, turn controls where supported, and remote desktop features after pairing and macOS permission checks. + +The gateway token, gateway URL, hostnames, thread names, uploaded files, prompts, and local paths should be treated as private. + +## iPhone App + +The iPhone app stores the gateway URL and token locally on the device so it can connect to your Mac gateway. Files selected in the iPhone app are uploaded to the Mac gateway and saved under the CodePilot state directory. + +If notifications are enabled, the app and gateway use Apple Push Notification service infrastructure for turn-finished notification delivery. Notification payloads should remain minimal and must not include auth files, bearer tokens, private prompts, or uploaded file contents. + +## Cloudflare Tunnel + +During the public beta, remote iPhone access uses a user-owned Cloudflare Tunnel. Cloudflare may process connection metadata for tunnel operation according to your Cloudflare account configuration and Cloudflare's own terms and policies. + +CodePilot still requires the gateway bearer token when using Cloudflare Tunnel. Treat temporary TryCloudflare URLs, permanent tunnel hostnames, and the gateway token as private support data. + +## Remote Desktop + +Remote desktop features require pairing and macOS Screen Recording and Accessibility permissions. Do not share screenshots or recordings that show private desktops, files, prompts, credentials, account names, hostnames, or local paths. + +## Support And Issues + +Before opening public issues, remove: + +- Auth files and bearer tokens. +- Private hostnames, tunnel URLs, and local network details. +- Personal names, email addresses, account names, Apple identifiers, and team identifiers. +- Local file paths, private repository names, private prompts, uploaded files, and unsanitized screenshots. +- Logs containing any of the above. + +For security issues involving exposed credentials, unsafe gateway access, remote desktop bypass, or uploaded private files, avoid posting sensitive details publicly. Open a minimal issue saying a security report is available and coordinate disclosure with the maintainers. From b67ed533a5f9181bac6f4468b403e8f755bdadba Mon Sep 17 00:00:00 2001 From: CodePilot Date: Fri, 17 Jul 2026 07:18:56 +0200 Subject: [PATCH 04/44] docs: tighten public beta support copy --- .github/ISSUE_TEMPLATE/bug_report.md | 41 ++++++++++++++++++++++++++++ .github/ISSUE_TEMPLATE/config.yml | 5 ++++ README.md | 2 +- docs/APP_STORE_METADATA_DRAFT.md | 4 +-- docs/SUPPORT.md | 4 ++- 5 files changed, 52 insertions(+), 4 deletions(-) create mode 100644 .github/ISSUE_TEMPLATE/bug_report.md create mode 100644 .github/ISSUE_TEMPLATE/config.yml diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md new file mode 100644 index 00000000..a83bf2c9 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -0,0 +1,41 @@ +--- +name: Bug report +about: Report a CodePilot public beta problem without sharing private data +title: "[Bug]: " +labels: bug, beta +assignees: "" +--- + +## Area + +- [ ] Mac app +- [ ] iPhone app +- [ ] Gateway +- [ ] Cloudflare setup +- [ ] Account switching +- [ ] Remote desktop +- [ ] Documentation + +## What happened? + +Describe the problem and what you expected instead. + +## Steps to reproduce + +1. +2. +3. + +## Setup + +- macOS version: +- iOS version: +- CodePilot build or commit: +- Codex CLI installed: yes/no +- Connection path: Cloudflare Tunnel / other + +## Sanitized logs or screenshots + +Attach only sanitized logs or screenshots. + +Do not include Codex auth files, gateway bearer tokens, private hostnames, tunnel URLs, personal account names, email addresses, Apple identifiers, local file paths, private prompts, uploaded files, repository names, or live desktop contents. diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 00000000..ea76d7ad --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1,5 @@ +blank_issues_enabled: false +contact_links: + - name: Security or privacy-sensitive report + url: https://github.com/codepilotios/codepilot/blob/main/docs/SECURITY.md + about: Do not post secrets, tokens, unsafe gateway access details, remote desktop bypass details, or private files publicly. Use the security guidance first. diff --git a/README.md b/README.md index 54c694d4..1e651363 100644 --- a/README.md +++ b/README.md @@ -79,7 +79,7 @@ See: ## Screenshots -Screenshots will be added before the first public release. +No public screenshots are committed yet. The beta screenshot checklist is tracked in [docs/SCREENSHOTS.md](docs/SCREENSHOTS.md) so public images use demo data and avoid tokens, hostnames, local paths, private prompts, account names, or live desktop content. ## Public Release Status diff --git a/docs/APP_STORE_METADATA_DRAFT.md b/docs/APP_STORE_METADATA_DRAFT.md index 35efc2ad..e582e88c 100644 --- a/docs/APP_STORE_METADATA_DRAFT.md +++ b/docs/APP_STORE_METADATA_DRAFT.md @@ -36,11 +36,11 @@ Please report whether Cloudflare Tunnel setup, gateway connection, or token entr ## Support URL -Use the public repository support documentation and issue tracker once the repository is public. +Requires maintainer approval before TestFlight external testing or App Store submission. Candidate destination: the public support documentation and issue tracker once the repository is public. ## Privacy URL -Use `docs/PRIVACY.md` until a public website URL is approved. +Requires maintainer approval before TestFlight external testing or App Store submission. Candidate destination: the public website privacy page generated from [Privacy](PRIVACY.md). ## Screenshot Requirements diff --git a/docs/SUPPORT.md b/docs/SUPPORT.md index c5658264..b8f733cb 100644 --- a/docs/SUPPORT.md +++ b/docs/SUPPORT.md @@ -15,6 +15,8 @@ Check: ## Helpful Issue Details +Use the repository bug report template when available. + Include: - Mac app, gateway, or iOS app area affected. @@ -37,4 +39,4 @@ Do not include: ## Security Reports -For issues involving exposed credentials, unsafe gateway access, remote desktop bypass, or uploaded private files, avoid public details. Open a minimal issue that says a security report is available and coordinate disclosure with the maintainers. +For issues involving exposed credentials, unsafe gateway access, remote desktop bypass, or uploaded private files, avoid public details. Review [Security](SECURITY.md) first, then open only a minimal issue that says a security report is available if maintainer coordination is needed. From 565fb414deb17109f6ec33377264a396cd0b5a17 Mon Sep 17 00:00:00 2001 From: CodePilot Date: Fri, 17 Jul 2026 07:18:56 +0200 Subject: [PATCH 05/44] docs: add beta feedback guide --- README.md | 1 + docs/BETA_FEEDBACK.md | 35 +++++++++++++++++++++++++++++++++++ docs/CHANGELOG.md | 1 + docs/SUPPORT.md | 2 ++ docs/index.md | 3 +++ 5 files changed, 42 insertions(+) create mode 100644 docs/BETA_FEEDBACK.md diff --git a/README.md b/README.md index 1e651363..fc0c13c8 100644 --- a/README.md +++ b/README.md @@ -54,6 +54,7 @@ See: - [iOS Installation](docs/INSTALL_IOS.md) - [Cloudflare Setup](docs/CLOUDFLARE_SETUP.md) - [FAQ](docs/FAQ.md) +- [Beta Feedback Guide](docs/BETA_FEEDBACK.md) - [Privacy](docs/PRIVACY.md) - [Support](docs/SUPPORT.md) - [Changelog](docs/CHANGELOG.md) diff --git a/docs/BETA_FEEDBACK.md b/docs/BETA_FEEDBACK.md new file mode 100644 index 00000000..25896d5f --- /dev/null +++ b/docs/BETA_FEEDBACK.md @@ -0,0 +1,35 @@ +# Beta Feedback Guide + +CodePilot public beta feedback is most useful when it helps reproduce a real Codex CLI workflow without exposing private data. + +## Best Reports + +Include: + +- The area affected: Mac app, iPhone app, gateway, Cloudflare setup, account switching, remote desktop, file upload, notifications, or docs. +- What you were trying to do. +- What happened instead. +- The visible recovery message or status text. +- Whether the failing step was setup, Cloudflare Tunnel, gateway connection, token entry, thread loading, upload, notification delivery, or turn control. +- macOS version, iOS version, CodePilot build or commit, and Codex CLI version when available. +- Sanitized logs or screenshots only when they make the issue clearer. + +## Useful Workflow Notes + +For AI coding users and existing Codex CLI users, please call out: + +- Whether Codex CLI itself was already working on the Mac before CodePilot setup. +- Whether active turns were running when account switching, gateway restart, steering, or stop-turn actions were attempted. +- Whether the issue happened on the Mac, through the iPhone app, or only through Cloudflare Tunnel. +- Whether refreshing Codex login, restarting the gateway when idle, or retesting the connection changed the result. + +## Do Not Share + +Remove these before opening an issue or attaching screenshots: + +- Codex auth files, gateway bearer tokens, and Cloudflare tunnel URLs. +- Private hostnames, account names, personal names, email addresses, Apple identifiers, and team identifiers. +- Local file paths, private repository names, uploaded files, private prompts, thread names, and live desktop contents. +- Logs containing any of the above. + +For security-sensitive reports, follow [Security](SECURITY.md) and avoid posting exploit details or secrets publicly. diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index 8cb2451d..825b81fd 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -5,6 +5,7 @@ ### Public Beta Preparation - Added public beta docs for GitHub Pages, FAQ, privacy, support, screenshots, and changelog. +- Added a beta feedback guide for Codex CLI users that asks for reproducible setup details without private data. - Clarified that CodePilot currently targets Codex CLI users and remains beta-focused. - Documented the Mac, gateway, iPhone, Cloudflare, and troubleshooting paths from a public user perspective. - Added a local TestFlight/App Store metadata draft for maintainer review before any App Store submission. diff --git a/docs/SUPPORT.md b/docs/SUPPORT.md index b8f733cb..21824818 100644 --- a/docs/SUPPORT.md +++ b/docs/SUPPORT.md @@ -10,6 +10,7 @@ Check: - [iOS installation](INSTALL_IOS.md) - [Cloudflare setup](CLOUDFLARE_SETUP.md) - [Troubleshooting](TROUBLESHOOTING.md) +- [Beta feedback guide](BETA_FEEDBACK.md) - [Security](SECURITY.md) - [FAQ](FAQ.md) @@ -24,6 +25,7 @@ Include: - What happened instead. - Whether Cloudflare setup, gateway connection, or token entry is the failing step. - The visible recovery message, if one appears. +- Whether Codex CLI was already working on the Mac before CodePilot setup. - Sanitized logs with private values removed. ## Do Not Share diff --git a/docs/index.md b/docs/index.md index 28a0307f..865412d1 100644 --- a/docs/index.md +++ b/docs/index.md @@ -19,6 +19,7 @@ CodePilot is source-available for noncommercial use. It is not OSI open source. - [Cloudflare remote access](CLOUDFLARE_SETUP.md) - [Troubleshooting](TROUBLESHOOTING.md) - [FAQ](FAQ.md) +- [Beta feedback guide](BETA_FEEDBACK.md) - [Privacy](PRIVACY.md) - [Support](SUPPORT.md) - [Changelog](CHANGELOG.md) @@ -32,3 +33,5 @@ CodePilot currently targets Codex CLI. Future provider support is not part of th The public-beta iPhone setup uses Cloudflare Tunnel. Same-network iPhone access is not part of the supported beta path until CodePilot ships explicit LAN-binding, firewall, and trust guidance. Do not share screenshots, logs, gateway URLs, tokens, account names, hostnames, or local file paths in public issues unless they have been sanitized. + +For beta reports, include the affected area, the failing step, visible recovery text, and whether Codex CLI was already working on the Mac. See the [beta feedback guide](BETA_FEEDBACK.md). From 2602b1f4156ccab0aae4bd876b8a7c9a5bc5c26d Mon Sep 17 00:00:00 2001 From: CodePilot Date: Fri, 17 Jul 2026 07:18:56 +0200 Subject: [PATCH 06/44] docs: remove private OTA host references --- docs/PRODUCTION_READINESS_IMPLEMENTATION_PLAN.md | 4 +++- .../plans/2026-07-03-total-credit-live-activity.md | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/docs/PRODUCTION_READINESS_IMPLEMENTATION_PLAN.md b/docs/PRODUCTION_READINESS_IMPLEMENTATION_PLAN.md index 596364ba..444e6ea6 100644 --- a/docs/PRODUCTION_READINESS_IMPLEMENTATION_PLAN.md +++ b/docs/PRODUCTION_READINESS_IMPLEMENTATION_PLAN.md @@ -323,7 +323,7 @@ curl -fsS -X POST http://127.0.0.1:8787/codexphone/api/build curl -fsS http://127.0.0.1:8787/codexphone/api/status ``` -Wait until `current.state == "complete"`, then verify the manifest and IPA from the configured OTA domain return HTTP 200. +Wait until `current.state == "complete"`, then verify the manifest and IPA from the approved OTA host, for example `https://ota.example.com`, return HTTP 200. - [ ] **Step 8: Commit** @@ -502,6 +502,8 @@ curl -I https://ota.example.com/codexphone/CodePilot.ipa ``` Expected: HTTP 200 or the exact current generated manifest/IPA paths return HTTP 200. +Use example OTA hostnames in public docs. Keep real OTA hostnames in private +release notes or maintainer-run scripts unless they are approved for publishing. - [ ] **Step 5: Verify GitHub/source package state** diff --git a/docs/superpowers/plans/2026-07-03-total-credit-live-activity.md b/docs/superpowers/plans/2026-07-03-total-credit-live-activity.md index e775675c..5b958a31 100644 --- a/docs/superpowers/plans/2026-07-03-total-credit-live-activity.md +++ b/docs/superpowers/plans/2026-07-03-total-credit-live-activity.md @@ -282,7 +282,7 @@ POST to `http://127.0.0.1:8787/codexphone/api/build`, poll `/codexphone/api/stat - [ ] **Step 4: Verify public OTA artifacts** -Fetch the generated tokenized manifest and IPA URLs from `https://ota.sprenkeling.co`. +Fetch the generated tokenized manifest and IPA URLs from the approved OTA host, for example `https://ota.example.com`. Expected: HTTP 200 for both, manifest bundle identifier `io.codepilot.iOS`, and the widget extension embedded in the IPA. From 486fc9d0c82cdc3ef648f100657404680d06aeda Mon Sep 17 00:00:00 2001 From: CodePilot Date: Fri, 17 Jul 2026 07:18:56 +0200 Subject: [PATCH 07/44] docs: add public-safe beta contribution templates --- .github/ISSUE_TEMPLATE/feature_request.md | 29 +++++++++++++++++++++++ .github/pull_request_template.md | 15 ++++++++++++ docs/CHANGELOG.md | 1 + 3 files changed, 45 insertions(+) create mode 100644 .github/ISSUE_TEMPLATE/feature_request.md create mode 100644 .github/pull_request_template.md diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md new file mode 100644 index 00000000..0029662c --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.md @@ -0,0 +1,29 @@ +--- +name: Feature request +about: Suggest a CodePilot public beta improvement without sharing private data +title: "[Feature]: " +labels: enhancement, beta +assignees: "" +--- + +## Workflow + +What AI coding workflow would this improve? + +## Proposed Improvement + +Describe the behavior you want CodePilot to support. + +## Current Workaround + +Describe what you do today, if anything. + +## Setup Context + +- Mac app, iPhone app, gateway, Cloudflare setup, account switching, remote desktop, notifications, file upload, or docs: +- Codex CLI already working on the Mac: yes/no/not sure +- Connection path: Cloudflare Tunnel / other / not applicable + +## Beta Safety + +Do not include Codex auth files, gateway bearer tokens, private hostnames, tunnel URLs, personal account names, email addresses, Apple identifiers, local file paths, private prompts, uploaded files, repository names, or live desktop contents. diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md new file mode 100644 index 00000000..a374d4bf --- /dev/null +++ b/.github/pull_request_template.md @@ -0,0 +1,15 @@ +## Summary + +Describe the public beta change and the user-facing workflow it affects. + +## Verification + +- [ ] Documentation-only change, or tests/builds run: +- [ ] Public copy remains beta-focused and targets AI coding users or existing Codex CLI users. +- [ ] No pricing, subscription, legal, App Store submission, or privacy-label claim was added without maintainer approval. + +## Privacy Audit + +- [ ] No private names, email addresses, hostnames, local usernames, machine-specific paths, tokens, or private screenshots are included. +- [ ] Screenshots, logs, and examples use demo data only. +- [ ] Support/debugging copy tells users to remove credentials, gateway URLs, account names, local paths, private prompts, and live desktop contents before sharing. diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index 825b81fd..80d7c099 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -4,6 +4,7 @@ ### Public Beta Preparation +- Added public-safe GitHub feature request and pull request templates for beta feedback and contribution review. - Added public beta docs for GitHub Pages, FAQ, privacy, support, screenshots, and changelog. - Added a beta feedback guide for Codex CLI users that asks for reproducible setup details without private data. - Clarified that CodePilot currently targets Codex CLI users and remains beta-focused. From ec4a95004228a7edef7c6d4de2a2acd0a67e7cbd Mon Sep 17 00:00:00 2001 From: CodePilot Date: Fri, 17 Jul 2026 07:18:56 +0200 Subject: [PATCH 08/44] docs: align public beta presence copy --- README.md | 13 ++++++----- docs/CHANGELOG.md | 1 + docs/PUBLIC_PRESENCE_CHECKLIST.md | 38 +++++++++++++++++++++++++++++++ docs/index.md | 1 + 4 files changed, 47 insertions(+), 6 deletions(-) create mode 100644 docs/PUBLIC_PRESENCE_CHECKLIST.md diff --git a/README.md b/README.md index fc0c13c8..186bda7d 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,8 @@ -# CodePilot +# CodePilot Public Beta -CodePilot is a Mac menu bar app and iPhone companion for running coding-agent sessions from a Mac you control. It currently focuses on Codex account switching, usage visibility, remote iPhone access, file uploads, connector status, notifications, and gateway-backed conversation control. +CodePilot is a Mac menu bar app, local gateway, and iPhone companion for AI coding users who already run Codex CLI on a Mac they control. -The project is designed to become provider-neutral over time, including future Claude Code compatibility. +The public beta focuses on Codex account switching, usage visibility, remote iPhone access through a user-owned Cloudflare Tunnel, file uploads, connector status, notifications, and gateway-backed conversation control. The project is designed to become provider-neutral over time, but the first beta is Codex-focused. ## License @@ -59,7 +59,8 @@ See: - [Support](docs/SUPPORT.md) - [Changelog](docs/CHANGELOG.md) - [App Store Metadata Draft](docs/APP_STORE_METADATA_DRAFT.md) -- [Screenshot Plan](metadata/screenshots/README.md) +- [Screenshot Plan](docs/SCREENSHOTS.md) +- [Public Presence Checklist](docs/PUBLIC_PRESENCE_CHECKLIST.md) - [Security](docs/SECURITY.md) - [Architecture](docs/ARCHITECTURE.md) - [Troubleshooting](docs/TROUBLESHOOTING.md) @@ -82,6 +83,6 @@ See: No public screenshots are committed yet. The beta screenshot checklist is tracked in [docs/SCREENSHOTS.md](docs/SCREENSHOTS.md) so public images use demo data and avoid tokens, hostnames, local paths, private prompts, account names, or live desktop content. -## Public Release Status +## Public Beta Status -CodePilot is being prepared for broader publishing. Expect some internal names, bundle identifiers, LaunchAgent labels, and local state paths to still contain legacy Codex-specific names during the first migration phase. +CodePilot is being prepared for broader publishing through beta-first docs, sanitized screenshots, and maintainer-reviewed App Store metadata. Expect some internal names, bundle identifiers, LaunchAgent labels, and local state paths to still contain legacy Codex-specific names during the first migration phase. diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index 80d7c099..b2cecd27 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -6,6 +6,7 @@ - Added public-safe GitHub feature request and pull request templates for beta feedback and contribution review. - Added public beta docs for GitHub Pages, FAQ, privacy, support, screenshots, and changelog. +- Added a public presence checklist for beta positioning, privacy review, support copy, and approval gates. - Added a beta feedback guide for Codex CLI users that asks for reproducible setup details without private data. - Clarified that CodePilot currently targets Codex CLI users and remains beta-focused. - Documented the Mac, gateway, iPhone, Cloudflare, and troubleshooting paths from a public user perspective. diff --git a/docs/PUBLIC_PRESENCE_CHECKLIST.md b/docs/PUBLIC_PRESENCE_CHECKLIST.md new file mode 100644 index 00000000..38a86512 --- /dev/null +++ b/docs/PUBLIC_PRESENCE_CHECKLIST.md @@ -0,0 +1,38 @@ +# Public Presence Checklist + +Use this checklist before updating GitHub Pages, README copy, public docs, screenshots, changelog entries, FAQ, privacy copy, support copy, issue templates, or App Store metadata drafts. + +## Positioning + +- Keep the current release track clearly labeled as a public beta. +- Target AI coding users and existing Codex CLI users. +- Avoid promising production-team readiness, hosted CodePilot accounts, LAN setup, non-Codex providers, pricing, subscriptions, App Store availability, or release dates unless those items have maintainer approval. +- Describe Cloudflare Tunnel as the supported public-beta iPhone access path. + +## Privacy Review + +Before committing public content, check for: + +- Private names, private email addresses, personal account names, Apple identifiers, and team identifiers. +- Hostnames, tunnel URLs, gateway URLs, tokens, auth file contents, and API keys. +- Machine-specific paths, local usernames, private repository names, private prompts, uploaded files, and live desktop contents. +- Screenshots or logs that include any private value above. + +Use demo data such as `Work`, `Personal`, `Demo`, `codepilot.example.com`, and generic sample files. + +## Support Copy + +Public support and feedback copy should ask for: + +- Affected area: Mac app, iPhone app, gateway, Cloudflare setup, account switching, remote desktop, file upload, notifications, or docs. +- Failing step and visible recovery message. +- macOS version, iOS version, CodePilot build or commit, and Codex CLI version when available. +- Sanitized logs or screenshots only when they materially help reproduce the issue. + +## Approval Gates + +Maintainer approval is required before publishing or submitting: + +- App Store privacy labels, age rating, export compliance, pricing, subscriptions, or legal terms. +- TestFlight external testing, App Store review, public launch announcements, paid promotion, or community posts. +- Claims about hosted services, production readiness, non-Codex provider support, or subscription value. diff --git a/docs/index.md b/docs/index.md index 865412d1..37b518b7 100644 --- a/docs/index.md +++ b/docs/index.md @@ -25,6 +25,7 @@ CodePilot is source-available for noncommercial use. It is not OSI open source. - [Changelog](CHANGELOG.md) - [App Store metadata draft](APP_STORE_METADATA_DRAFT.md) - [Screenshot plan](SCREENSHOTS.md) +- [Public presence checklist](PUBLIC_PRESENCE_CHECKLIST.md) ## Beta Limits From 024c438d02d84c7c065da0161d760a75427b2c1e Mon Sep 17 00:00:00 2001 From: CodePilot Date: Fri, 17 Jul 2026 07:18:56 +0200 Subject: [PATCH 09/44] docs: tighten public beta reporting guidance --- .github/ISSUE_TEMPLATE/bug_report.md | 22 +++++++++++++++++++++- .github/ISSUE_TEMPLATE/feature_request.md | 10 ++++++++++ docs/CHANGELOG.md | 1 + docs/PUBLIC_PRESENCE_CHECKLIST.md | 7 +++++++ docs/SCREENSHOTS.md | 4 +++- 5 files changed, 42 insertions(+), 2 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md index a83bf2c9..3c365cce 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.md +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -20,12 +20,32 @@ assignees: "" Describe the problem and what you expected instead. +## Failing step + +Check the closest match: + +- [ ] First-run setup +- [ ] Cloudflare Tunnel setup +- [ ] Gateway start or restart +- [ ] Gateway URL entry +- [ ] Token entry +- [ ] Thread loading +- [ ] File upload +- [ ] Steering or stop-turn control +- [ ] Notification delivery +- [ ] Remote desktop pairing or permission check +- [ ] Documentation + ## Steps to reproduce 1. 2. 3. +## Visible recovery message + +Paste the visible recovery message or status text, with private values removed. + ## Setup - macOS version: @@ -36,6 +56,6 @@ Describe the problem and what you expected instead. ## Sanitized logs or screenshots -Attach only sanitized logs or screenshots. +Attach only sanitized logs or screenshots when they materially help reproduce the issue. Do not include Codex auth files, gateway bearer tokens, private hostnames, tunnel URLs, personal account names, email addresses, Apple identifiers, local file paths, private prompts, uploaded files, repository names, or live desktop contents. diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md index 0029662c..31e200c9 100644 --- a/.github/ISSUE_TEMPLATE/feature_request.md +++ b/.github/ISSUE_TEMPLATE/feature_request.md @@ -10,6 +10,14 @@ assignees: "" What AI coding workflow would this improve? +Who is affected? + +- [ ] Existing Codex CLI users +- [ ] Public beta testers setting up CodePilot for the first time +- [ ] Users monitoring or steering sessions from iPhone +- [ ] Users managing multiple Codex account profiles +- [ ] Documentation or support readers + ## Proposed Improvement Describe the behavior you want CodePilot to support. @@ -26,4 +34,6 @@ Describe what you do today, if anything. ## Beta Safety +Keep requests beta-focused. Do not add pricing, subscription, App Store availability, production-team readiness, hosted account, LAN setup, or non-Codex provider claims unless maintainer approval already exists. + Do not include Codex auth files, gateway bearer tokens, private hostnames, tunnel URLs, personal account names, email addresses, Apple identifiers, local file paths, private prompts, uploaded files, repository names, or live desktop contents. diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index b2cecd27..bc9b5048 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -14,6 +14,7 @@ - Added guidance for keeping screenshots, logs, support requests, and public issues free of private names, hosts, tokens, and local paths. - Kept iOS beta installation docs focused on user setup and moved App Store Connect maintainer checks to the release checklist. - Aligned public-beta iPhone connection copy around Cloudflare Tunnel while LAN setup remains unsupported. +- Tightened beta issue templates and screenshot guidance so public reports ask for recovery context without broad log dumps or private desktop content. ### Recent Product Work diff --git a/docs/PUBLIC_PRESENCE_CHECKLIST.md b/docs/PUBLIC_PRESENCE_CHECKLIST.md index 38a86512..6b4683db 100644 --- a/docs/PUBLIC_PRESENCE_CHECKLIST.md +++ b/docs/PUBLIC_PRESENCE_CHECKLIST.md @@ -20,6 +20,13 @@ Before committing public content, check for: Use demo data such as `Work`, `Personal`, `Demo`, `codepilot.example.com`, and generic sample files. +For screenshot, metadata, issue-template, or support-copy changes, also verify: + +- The copy asks for the failing step and visible recovery text instead of broad log dumps. +- Screenshots use a controlled demo desktop or permission/status screen for remote desktop flows. +- Examples avoid real prompts, private repositories, customer names, local usernames, and machine-specific paths. +- Public wording still says the current iPhone beta path uses Cloudflare Tunnel, not unsupported LAN access. + ## Support Copy Public support and feedback copy should ask for: diff --git a/docs/SCREENSHOTS.md b/docs/SCREENSHOTS.md index 2797ffa8..6426b0dc 100644 --- a/docs/SCREENSHOTS.md +++ b/docs/SCREENSHOTS.md @@ -6,10 +6,12 @@ Use this checklist before adding screenshots to the repository, GitHub Pages, Te - Use demo account names only, such as `Work`, `Personal`, or `Demo`. - Use example hostnames only, such as `codepilot.example.com`. +- Use demo thread names and sample prompts that do not identify a person, company, private repository, customer, host, or unpublished product. - Hide gateway bearer tokens and auth details. - Hide local file paths unless the path is a generic example. - Hide private thread names, prompts, uploads, and repository names. - Hide Apple IDs, team IDs, bundle signing details, and TestFlight account details. +- For remote desktop screenshots, show only a controlled demo desktop or permission/status screen. Do not show an active personal desktop, browser session, terminal, chat, or repository. - Prefer clean beta flows: setup checklist, gateway status, iPhone connection, thread list, file upload, and remote desktop permission state. Recommended beta screenshot set: @@ -22,4 +24,4 @@ Recommended beta screenshot set: - File upload confirmation using non-private sample files. - Remote desktop permission screen without a live private desktop. -Create real screenshots only from sanitized demo data. +Create real screenshots only from sanitized demo data. Run the public presence privacy review before committing screenshots or metadata that references screenshots. From acddad973747a97f0a4a937e8f12cb9f08caa13f Mon Sep 17 00:00:00 2001 From: CodePilot Date: Fri, 17 Jul 2026 07:18:56 +0200 Subject: [PATCH 10/44] docs: align beta support categories --- .github/ISSUE_TEMPLATE/bug_report.md | 2 ++ docs/CHANGELOG.md | 1 + docs/SUPPORT.md | 2 +- 3 files changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md index 3c365cce..16057249 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.md +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -14,6 +14,8 @@ assignees: "" - [ ] Cloudflare setup - [ ] Account switching - [ ] Remote desktop +- [ ] File upload +- [ ] Notifications - [ ] Documentation ## What happened? diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index bc9b5048..ae3da12c 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -15,6 +15,7 @@ - Kept iOS beta installation docs focused on user setup and moved App Store Connect maintainer checks to the release checklist. - Aligned public-beta iPhone connection copy around Cloudflare Tunnel while LAN setup remains unsupported. - Tightened beta issue templates and screenshot guidance so public reports ask for recovery context without broad log dumps or private desktop content. +- Aligned beta support and bug-report categories with promoted file upload, notification, turn-control, and remote desktop workflows. ### Recent Product Work diff --git a/docs/SUPPORT.md b/docs/SUPPORT.md index 21824818..288fee7a 100644 --- a/docs/SUPPORT.md +++ b/docs/SUPPORT.md @@ -23,7 +23,7 @@ Include: - Mac app, gateway, or iOS app area affected. - What you expected to happen. - What happened instead. -- Whether Cloudflare setup, gateway connection, or token entry is the failing step. +- Whether setup, Cloudflare Tunnel, gateway connection, token entry, thread loading, file upload, notification delivery, turn control, or remote desktop is the failing step. - The visible recovery message, if one appears. - Whether Codex CLI was already working on the Mac before CodePilot setup. - Sanitized logs with private values removed. From 87c5fd7694ea1c923fe51d05dd91555322317380 Mon Sep 17 00:00:00 2001 From: CodePilot Date: Fri, 17 Jul 2026 07:18:56 +0200 Subject: [PATCH 11/44] docs: prepare GitHub Pages beta site --- docs/CHANGELOG.md | 2 ++ docs/_config.yml | 16 ++++++++++++++++ docs/index.md | 15 ++++++++++++--- ops/agents/escalations/presence-maintenance.md | 4 ++++ 4 files changed, 34 insertions(+), 3 deletions(-) create mode 100644 docs/_config.yml diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index ae3da12c..1a0e8f04 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -4,6 +4,8 @@ ### Public Beta Preparation +- Added GitHub Pages configuration and narrowed the generated site to user-facing beta documentation. +- Refined the Pages landing page with beta scope, security guidance, and install prerequisites. - Added public-safe GitHub feature request and pull request templates for beta feedback and contribution review. - Added public beta docs for GitHub Pages, FAQ, privacy, support, screenshots, and changelog. - Added a public presence checklist for beta positioning, privacy review, support copy, and approval gates. diff --git a/docs/_config.yml b/docs/_config.yml new file mode 100644 index 00000000..a1675813 --- /dev/null +++ b/docs/_config.yml @@ -0,0 +1,16 @@ +title: CodePilot Public Beta +description: An iPhone companion and Mac gateway for existing Codex CLI users. +theme: jekyll-theme-minimal +show_downloads: false + +# Keep planning, operations, and submission drafts in the repository without +# publishing them as part of the user-facing GitHub Pages site. +exclude: + - APP_STORE_METADATA_DRAFT.md + - PRODUCTION_READINESS.md + - PRODUCTION_READINESS_IMPLEMENTATION_PLAN.md + - PUBLIC_PRESENCE_CHECKLIST.md + - RELEASE_CHECKLIST.md + - SCREENSHOTS.md + - operations + - superpowers diff --git a/docs/index.md b/docs/index.md index 37b518b7..7701126b 100644 --- a/docs/index.md +++ b/docs/index.md @@ -2,6 +2,8 @@ CodePilot is a Mac menu bar app, local gateway, and iPhone companion for Codex CLI users who want to monitor and steer coding-agent sessions from a Mac they control. +The current release track is a public beta for existing Codex CLI users. It is not intended for production teams or unattended access to an untrusted Mac. + The beta is focused on practical workflows for AI coding users: - See active Codex usage and account status from the Mac and iPhone. @@ -21,11 +23,16 @@ CodePilot is source-available for noncommercial use. It is not OSI open source. - [FAQ](FAQ.md) - [Beta feedback guide](BETA_FEEDBACK.md) - [Privacy](PRIVACY.md) +- [Security](SECURITY.md) - [Support](SUPPORT.md) - [Changelog](CHANGELOG.md) -- [App Store metadata draft](APP_STORE_METADATA_DRAFT.md) -- [Screenshot plan](SCREENSHOTS.md) -- [Public presence checklist](PUBLIC_PRESENCE_CHECKLIST.md) + +## Before You Install + +- Use a Mac you control and keep the gateway bearer token private. +- Review the [privacy](PRIVACY.md) and [security](SECURITY.md) guidance before exposing the gateway through Cloudflare Tunnel. +- Expect beta limitations and recovery work. CodePilot does not replace Codex CLI or provide a hosted CodePilot account service. +- Sanitize logs and screenshots before opening a public issue. ## Beta Limits @@ -36,3 +43,5 @@ The public-beta iPhone setup uses Cloudflare Tunnel. Same-network iPhone access Do not share screenshots, logs, gateway URLs, tokens, account names, hostnames, or local file paths in public issues unless they have been sanitized. For beta reports, include the affected area, the failing step, visible recovery text, and whether Codex CLI was already working on the Mac. See the [beta feedback guide](BETA_FEEDBACK.md). + +CodePilot is source-available for noncommercial use and is not OSI open source. Review the license files in the [public repository](https://github.com/codepilotios/codepilot) before redistribution or commercial use. diff --git a/ops/agents/escalations/presence-maintenance.md b/ops/agents/escalations/presence-maintenance.md index 775c502e..69f2b31a 100644 --- a/ops/agents/escalations/presence-maintenance.md +++ b/ops/agents/escalations/presence-maintenance.md @@ -9,3 +9,7 @@ The following public-publishing decisions are approved: - TestFlight/App Store metadata from `docs/APP_STORE_METADATA_DRAFT.md`. - GitHub Pages source for the repository, preferably the `docs/` folder. - Sanitized screenshot capture before screenshots are committed or used in App Store/TestFlight metadata. + +## Pending Maintainer Action + +After the presence draft is approved and merged, enable GitHub Pages from the `main` branch `docs/` folder and add the resulting site URL to the repository website field. The public repository website field was still unset during the 2026-07-17 presence review. From a726113dda23c767c65a970ad21fad56f84af267 Mon Sep 17 00:00:00 2001 From: CodePilot Date: Fri, 17 Jul 2026 07:18:56 +0200 Subject: [PATCH 12/44] docs: remove private legacy bundle namespace --- docs/CHANGELOG.md | 1 + docs/superpowers/plans/2026-06-27-secure-remote-desktop.md | 2 +- scripts/privacy-audit.sh | 1 + 3 files changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index 1a0e8f04..ea974d63 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -14,6 +14,7 @@ - Documented the Mac, gateway, iPhone, Cloudflare, and troubleshooting paths from a public user perspective. - Added a local TestFlight/App Store metadata draft for maintainer review before any App Store submission. - Added guidance for keeping screenshots, logs, support requests, and public issues free of private names, hosts, tokens, and local paths. +- Removed a legacy personal bundle namespace from a tracked implementation plan and added an audit guard against reintroducing that identifier pattern. - Kept iOS beta installation docs focused on user setup and moved App Store Connect maintainer checks to the release checklist. - Aligned public-beta iPhone connection copy around Cloudflare Tunnel while LAN setup remains unsupported. - Tightened beta issue templates and screenshot guidance so public reports ask for recovery context without broad log dumps or private desktop content. diff --git a/docs/superpowers/plans/2026-06-27-secure-remote-desktop.md b/docs/superpowers/plans/2026-06-27-secure-remote-desktop.md index cd0a48f5..5d487549 100644 --- a/docs/superpowers/plans/2026-06-27-secure-remote-desktop.md +++ b/docs/superpowers/plans/2026-06-27-secure-remote-desktop.md @@ -636,7 +636,7 @@ cd /path/to/ios-release-worktree python3 scripts/dke_ota_build.py build --app codexphone --branch release ``` -Expected: status reaches `complete`; output reports the canonical CodePilot iOS bundle ID; both public manifest and IPA return HTTP 200; the OTA install updates the configured CodePilot app rather than creating another instance. +Expected: status reaches `complete`; output reports the existing configured bundle ID; both public manifest and IPA return HTTP 200; the OTA install updates the configured CodePilot app rather than creating another instance. - [ ] **Step 7: Commit** diff --git a/scripts/privacy-audit.sh b/scripts/privacy-audit.sh index 4885b300..6b66112a 100755 --- a/scripts/privacy-audit.sh +++ b/scripts/privacy-audit.sh @@ -34,6 +34,7 @@ users_dir_pattern="/$(printf %s Users)/[^[:space:]\"']+" generic_private_patterns=( "$users_dir_pattern" '[A-Za-z][A-Za-z0-9._%+-]*@[A-Za-z][A-Za-z0-9.-]*\.[A-Za-z]{2,}' + '(com|io)\.[A-Za-z0-9_-]+\.codexphone' ) audit_files=() From 0289bbb5594bd1d3b535331f501bd52baa283812 Mon Sep 17 00:00:00 2001 From: CodePilot Date: Fri, 17 Jul 2026 07:18:56 +0200 Subject: [PATCH 13/44] fix: use public APNs bundle topic --- Sources/CodexAccountSwitcher/main.swift | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Sources/CodexAccountSwitcher/main.swift b/Sources/CodexAccountSwitcher/main.swift index 0ec4161d..c7c169ea 100644 --- a/Sources/CodexAccountSwitcher/main.swift +++ b/Sources/CodexAccountSwitcher/main.swift @@ -127,7 +127,7 @@ enum CodePilotHostServicesManager { let env = [ "CODEX_PHONE_APNS_CERT_PATH": appDir.appendingPathComponent("apns/codexphone-apns-cert.pem").path, "CODEX_PHONE_APNS_CERT_KEY_PATH": appDir.appendingPathComponent("apns/codexphone-apns-private.key").path, - "CODEX_PHONE_APNS_TOPIC": "com.tony.codexphone" + "CODEX_PHONE_APNS_TOPIC": "io.codepilot.iOS" ] try writeLaunchAgent( label: "io.codepilot.phone-gateway", From 7edc71ad8984b8ae80b722b63dfd79f1d4b493ef Mon Sep 17 00:00:00 2001 From: CodePilot Date: Fri, 17 Jul 2026 07:18:56 +0200 Subject: [PATCH 14/44] docs: clarify public beta reporting readiness --- docs/CHANGELOG.md | 2 ++ docs/PUBLIC_PRESENCE_CHECKLIST.md | 7 +++++++ docs/SECURITY.md | 2 ++ ops/agents/escalations/presence-maintenance.md | 7 ++++++- 4 files changed, 17 insertions(+), 1 deletion(-) diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index ea974d63..220fe187 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -19,6 +19,8 @@ - Aligned public-beta iPhone connection copy around Cloudflare Tunnel while LAN setup remains unsupported. - Tightened beta issue templates and screenshot guidance so public reports ask for recovery context without broad log dumps or private desktop content. - Aligned beta support and bug-report categories with promoted file upload, notification, turn-control, and remote desktop workflows. +- Clarified the current security-reporting limitation so beta users are not directed to share sensitive evidence publicly. +- Added launch checks for the live Pages URL, repository website field, and a private security-reporting channel. ### Recent Product Work diff --git a/docs/PUBLIC_PRESENCE_CHECKLIST.md b/docs/PUBLIC_PRESENCE_CHECKLIST.md index 6b4683db..c321b944 100644 --- a/docs/PUBLIC_PRESENCE_CHECKLIST.md +++ b/docs/PUBLIC_PRESENCE_CHECKLIST.md @@ -43,3 +43,10 @@ Maintainer approval is required before publishing or submitting: - App Store privacy labels, age rating, export compliance, pricing, subscriptions, or legal terms. - TestFlight external testing, App Store review, public launch announcements, paid promotion, or community posts. - Claims about hosted services, production readiness, non-Codex provider support, or subscription value. + +## Publishing Readiness + +- Confirm GitHub Pages is enabled from the approved `main` branch `docs/` source and the site returns successfully. +- Add the live Pages URL to the repository website field and resolve the App Store support and privacy URL drafts to live pages. +- Confirm a private security-reporting channel is enabled and linked from `SECURITY.md` before broader beta promotion. +- Keep sensitive vulnerability details out of public issues, even when asking for private coordination. diff --git a/docs/SECURITY.md b/docs/SECURITY.md index 07f7b718..853da5d2 100644 --- a/docs/SECURITY.md +++ b/docs/SECURITY.md @@ -34,3 +34,5 @@ CodePilot swaps local provider auth files. It waits for active turns to finish b Do not include auth files, bearer tokens, logs containing tokens, or uploaded private files in issue reports. Before sharing logs, search for account names, email addresses, hostnames, tokens, Apple team identifiers, and local file paths. + +CodePilot does not currently publish a private security-reporting channel. Do not put credentials, exploit details, private files, or other sensitive evidence in a public issue. If coordination is necessary, open only a minimal public issue requesting a private reporting path and include no sensitive details. diff --git a/ops/agents/escalations/presence-maintenance.md b/ops/agents/escalations/presence-maintenance.md index 69f2b31a..ceee1f4d 100644 --- a/ops/agents/escalations/presence-maintenance.md +++ b/ops/agents/escalations/presence-maintenance.md @@ -12,4 +12,9 @@ The following public-publishing decisions are approved: ## Pending Maintainer Action -After the presence draft is approved and merged, enable GitHub Pages from the `main` branch `docs/` folder and add the resulting site URL to the repository website field. The public repository website field was still unset during the 2026-07-17 presence review. +The 2026-07-17 public repository review found two launch-readiness settings that require maintainer access: + +1. Enable GitHub Pages from the approved `main` branch `docs/` folder, verify the site, and add its URL to the repository website field. The Pages endpoint and repository website field are currently unset. +2. Enable GitHub private vulnerability reporting, then link the private reporting form from `docs/SECURITY.md` and the security issue-template contact link. Private vulnerability reporting is currently disabled, so public copy must not imply that a secure reporting channel exists. + +These settings should be completed before broader public-beta promotion. No release, App Store, pricing, legal, credential, or external-system change is authorized by this note. From 32bedf9076c18563d2304443f98e498e4fb82613 Mon Sep 17 00:00:00 2001 From: CodePilot Date: Fri, 17 Jul 2026 07:18:56 +0200 Subject: [PATCH 15/44] docs: clarify tunnel privacy boundary --- docs/CHANGELOG.md | 1 + docs/FAQ.md | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index 220fe187..a41bd1ce 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -21,6 +21,7 @@ - Aligned beta support and bug-report categories with promoted file upload, notification, turn-control, and remote desktop workflows. - Clarified the current security-reporting limitation so beta users are not directed to share sensitive evidence publicly. - Added launch checks for the live Pages URL, repository website field, and a private security-reporting channel. +- Clarified that Codex credentials remain on the Mac while Cloudflare processes gateway traffic and connection metadata for the user-owned tunnel. ### Recent Product Work diff --git a/docs/FAQ.md b/docs/FAQ.md index 1329ec66..bcee6166 100644 --- a/docs/FAQ.md +++ b/docs/FAQ.md @@ -22,7 +22,7 @@ Yes for the public beta iPhone setup path. The Mac gateway listens on local loop ## Does CodePilot send my Codex credentials to a hosted service? -No hosted CodePilot service is required for the current beta. Credentials stay on the Mac unless you choose to expose the local gateway through infrastructure you control, such as Cloudflare Tunnel. +No hosted CodePilot service is required for the current beta, and Codex credentials stay on the Mac. When you use Cloudflare Tunnel, gateway traffic and connection metadata pass through Cloudflare under your Cloudflare account configuration; the gateway still requires its bearer token. ## What should I avoid posting in issues? From e3663cc8b098928aa360f25688034f8c01041d6b Mon Sep 17 00:00:00 2001 From: CodePilot Date: Fri, 17 Jul 2026 07:18:56 +0200 Subject: [PATCH 16/44] docs: align beta support with current workflows --- .github/ISSUE_TEMPLATE/bug_report.md | 6 +++++- docs/BETA_FEEDBACK.md | 4 ++-- docs/CHANGELOG.md | 1 + docs/SCREENSHOTS.md | 1 + docs/SUPPORT.md | 3 ++- 5 files changed, 11 insertions(+), 4 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md index 16057249..694e61cd 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.md +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -13,6 +13,8 @@ assignees: "" - [ ] Gateway - [ ] Cloudflare setup - [ ] Account switching +- [ ] Usage status +- [ ] Connector/plugin status - [ ] Remote desktop - [ ] File upload - [ ] Notifications @@ -32,6 +34,7 @@ Check the closest match: - [ ] Gateway URL entry - [ ] Token entry - [ ] Thread loading +- [ ] Usage or connector status - [ ] File upload - [ ] Steering or stop-turn control - [ ] Notification delivery @@ -53,7 +56,8 @@ Paste the visible recovery message or status text, with private values removed. - macOS version: - iOS version: - CodePilot build or commit: -- Codex CLI installed: yes/no +- Codex CLI version (if available): +- Codex CLI already working on this Mac: yes/no - Connection path: Cloudflare Tunnel / other ## Sanitized logs or screenshots diff --git a/docs/BETA_FEEDBACK.md b/docs/BETA_FEEDBACK.md index 25896d5f..68dfdef0 100644 --- a/docs/BETA_FEEDBACK.md +++ b/docs/BETA_FEEDBACK.md @@ -6,11 +6,11 @@ CodePilot public beta feedback is most useful when it helps reproduce a real Cod Include: -- The area affected: Mac app, iPhone app, gateway, Cloudflare setup, account switching, remote desktop, file upload, notifications, or docs. +- The area affected: Mac app, iPhone app, gateway, Cloudflare setup, account switching, usage status, connector/plugin status, remote desktop, file upload, notifications, or docs. - What you were trying to do. - What happened instead. - The visible recovery message or status text. -- Whether the failing step was setup, Cloudflare Tunnel, gateway connection, token entry, thread loading, upload, notification delivery, or turn control. +- Whether the failing step was setup, Cloudflare Tunnel, gateway connection, token entry, thread loading, usage or connector status, upload, notification delivery, turn control, or remote desktop. - macOS version, iOS version, CodePilot build or commit, and Codex CLI version when available. - Sanitized logs or screenshots only when they make the issue clearer. diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index a41bd1ce..78f8e3ef 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -22,6 +22,7 @@ - Clarified the current security-reporting limitation so beta users are not directed to share sensitive evidence publicly. - Added launch checks for the live Pages URL, repository website field, and a private security-reporting channel. - Clarified that Codex credentials remain on the Mac while Cloudflare processes gateway traffic and connection metadata for the user-owned tunnel. +- Aligned support, beta feedback, issue-template, and screenshot guidance with the promoted usage and connector/plugin status workflows. ### Recent Product Work diff --git a/docs/SCREENSHOTS.md b/docs/SCREENSHOTS.md index 6426b0dc..b2d4f733 100644 --- a/docs/SCREENSHOTS.md +++ b/docs/SCREENSHOTS.md @@ -21,6 +21,7 @@ Recommended beta screenshot set: - Cloudflare setup wizard using an example hostname. - iPhone connection wizard for the public-beta Cloudflare path. - iPhone thread list with demo thread names. +- iPhone usage and connector/plugin status with demo account names. - File upload confirmation using non-private sample files. - Remote desktop permission screen without a live private desktop. diff --git a/docs/SUPPORT.md b/docs/SUPPORT.md index 288fee7a..84eb2fa0 100644 --- a/docs/SUPPORT.md +++ b/docs/SUPPORT.md @@ -20,12 +20,13 @@ Use the repository bug report template when available. Include: -- Mac app, gateway, or iOS app area affected. +- The affected area: Mac app, iPhone app, gateway, Cloudflare setup, account switching, usage status, connector/plugin status, remote desktop, file upload, notifications, or docs. - What you expected to happen. - What happened instead. - Whether setup, Cloudflare Tunnel, gateway connection, token entry, thread loading, file upload, notification delivery, turn control, or remote desktop is the failing step. - The visible recovery message, if one appears. - Whether Codex CLI was already working on the Mac before CodePilot setup. +- macOS version, iOS version, CodePilot build or commit, and Codex CLI version when available. - Sanitized logs with private values removed. ## Do Not Share From d82c53db425638c8fa92bf83c64b298fca2685a2 Mon Sep 17 00:00:00 2001 From: CodePilot Date: Fri, 17 Jul 2026 09:11:45 +0200 Subject: [PATCH 17/44] docs: gate remote desktop from public beta --- README.md | 2 ++ docs/CHANGELOG.md | 5 +++-- docs/FAQ.md | 4 ++++ docs/PRIVACY.md | 6 ++++-- docs/PRODUCTION_READINESS.md | 1 + docs/PUBLIC_PRESENCE_CHECKLIST.md | 3 ++- docs/SCREENSHOTS.md | 5 ++--- docs/SECURITY.md | 4 ++++ docs/TROUBLESHOOTING.md | 4 ++-- docs/index.md | 3 ++- ops/agents/escalations/presence-maintenance.md | 1 + 11 files changed, 27 insertions(+), 11 deletions(-) diff --git a/README.md b/README.md index 186bda7d..bc078c46 100644 --- a/README.md +++ b/README.md @@ -86,3 +86,5 @@ No public screenshots are committed yet. The beta screenshot checklist is tracke ## Public Beta Status CodePilot is being prepared for broader publishing through beta-first docs, sanitized screenshots, and maintainer-reviewed App Store metadata. Expect some internal names, bundle identifiers, LaunchAgent labels, and local state paths to still contain legacy Codex-specific names during the first migration phase. + +Remote Desktop is not part of the supported public beta while its device-pairing and session-authorization enforcement is being completed and independently verified. Do not enable or promote it in beta builds yet. diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index 78f8e3ef..3941df72 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -18,14 +18,15 @@ - Kept iOS beta installation docs focused on user setup and moved App Store Connect maintainer checks to the release checklist. - Aligned public-beta iPhone connection copy around Cloudflare Tunnel while LAN setup remains unsupported. - Tightened beta issue templates and screenshot guidance so public reports ask for recovery context without broad log dumps or private desktop content. -- Aligned beta support and bug-report categories with promoted file upload, notification, turn-control, and remote desktop workflows. +- Aligned beta support and bug-report categories with promoted file upload, notification, and turn-control workflows, plus reporting for the gated Remote Desktop work. - Clarified the current security-reporting limitation so beta users are not directed to share sensitive evidence publicly. - Added launch checks for the live Pages URL, repository website field, and a private security-reporting channel. - Clarified that Codex credentials remain on the Mac while Cloudflare processes gateway traffic and connection metadata for the user-owned tunnel. - Aligned support, beta feedback, issue-template, and screenshot guidance with the promoted usage and connector/plugin status workflows. +- Removed Remote Desktop from public-beta promotion while its pairing and session-authorization enforcement remains a release blocker. ### Recent Product Work - Added Cloudflare setup wizard docs and automation. - Added gateway health, setup, and recovery guidance. -- Added remote desktop, localhost URL opening, file preview, and gateway-backed iPhone control improvements. +- Added Remote Desktop foundations, localhost URL opening, file preview, and gateway-backed iPhone control improvements. Remote Desktop remains gated from the supported public beta pending security verification. diff --git a/docs/FAQ.md b/docs/FAQ.md index bcee6166..1b8a6e70 100644 --- a/docs/FAQ.md +++ b/docs/FAQ.md @@ -20,6 +20,10 @@ Not yet. The name is provider-neutral, but the first beta is Codex-focused. Futu Yes for the public beta iPhone setup path. The Mac gateway listens on local loopback by default, so the iPhone app uses a Cloudflare Tunnel URL until CodePilot provides an explicit LAN-binding mode with firewall and trust guidance. +## Is Remote Desktop included in the public beta? + +No. Remote Desktop remains outside the supported public beta while its device-pairing and session-authorization enforcement is being completed and independently verified. Do not enable it in beta builds yet. + ## Does CodePilot send my Codex credentials to a hosted service? No hosted CodePilot service is required for the current beta, and Codex credentials stay on the Mac. When you use Cloudflare Tunnel, gateway traffic and connection metadata pass through Cloudflare under your Cloudflare account configuration; the gateway still requires its bearer token. diff --git a/docs/PRIVACY.md b/docs/PRIVACY.md index 840f9b6d..1e0c2fb2 100644 --- a/docs/PRIVACY.md +++ b/docs/PRIVACY.md @@ -21,7 +21,7 @@ Do not commit these files, include them in public issues, or show them in screen ## Mac Gateway -The CodePilot gateway runs on your Mac and requires a bearer token. It exposes CodePilot features to trusted clients, including account status, usage status, thread access, file upload, notification registration, turn controls where supported, and remote desktop features after pairing and macOS permission checks. +The CodePilot gateway runs on your Mac and requires a bearer token. It exposes CodePilot features to trusted clients, including account status, usage status, thread access, file upload, notification registration, and turn controls where supported. The gateway token, gateway URL, hostnames, thread names, uploaded files, prompts, and local paths should be treated as private. @@ -39,7 +39,9 @@ CodePilot still requires the gateway bearer token when using Cloudflare Tunnel. ## Remote Desktop -Remote desktop features require pairing and macOS Screen Recording and Accessibility permissions. Do not share screenshots or recordings that show private desktops, files, prompts, credentials, account names, hostnames, or local paths. +Remote Desktop is not part of the supported public beta while its device-pairing and session-authorization enforcement is being completed and independently verified. Do not enable it in beta builds yet. + +Any future Remote Desktop beta must require explicit device pairing plus macOS Screen Recording and Accessibility permissions. Screenshots or recordings must never expose private desktops, files, prompts, credentials, account names, hostnames, or local paths. ## Support And Issues diff --git a/docs/PRODUCTION_READINESS.md b/docs/PRODUCTION_READINESS.md index aa588976..5f9ebde7 100644 --- a/docs/PRODUCTION_READINESS.md +++ b/docs/PRODUCTION_READINESS.md @@ -30,6 +30,7 @@ The remaining gaps are productization gaps: - The Mac and iOS setup flows are not yet one coherent checklist. - Distribution requirements are not fully documented for public beta users. - Browser visual companion clicks from the phone did not reach the event log during planning and need reliability work or explicit fallback text. +- Remote Desktop must remain outside the supported public beta until device-pairing and session-authorization enforcement is complete and independently verified. ## Release Principles diff --git a/docs/PUBLIC_PRESENCE_CHECKLIST.md b/docs/PUBLIC_PRESENCE_CHECKLIST.md index c321b944..dd20e3c7 100644 --- a/docs/PUBLIC_PRESENCE_CHECKLIST.md +++ b/docs/PUBLIC_PRESENCE_CHECKLIST.md @@ -8,6 +8,7 @@ Use this checklist before updating GitHub Pages, README copy, public docs, scree - Target AI coding users and existing Codex CLI users. - Avoid promising production-team readiness, hosted CodePilot accounts, LAN setup, non-Codex providers, pricing, subscriptions, App Store availability, or release dates unless those items have maintainer approval. - Describe Cloudflare Tunnel as the supported public-beta iPhone access path. +- Do not promote features with unresolved security or release blockers. Remote Desktop remains outside the supported public beta until its pairing and session-authorization enforcement is verified. ## Privacy Review @@ -23,7 +24,7 @@ Use demo data such as `Work`, `Personal`, `Demo`, `codepilot.example.com`, and g For screenshot, metadata, issue-template, or support-copy changes, also verify: - The copy asks for the failing step and visible recovery text instead of broad log dumps. -- Screenshots use a controlled demo desktop or permission/status screen for remote desktop flows. +- Remote Desktop screenshots are excluded while the feature remains outside the supported public beta. - Examples avoid real prompts, private repositories, customer names, local usernames, and machine-specific paths. - Public wording still says the current iPhone beta path uses Cloudflare Tunnel, not unsupported LAN access. diff --git a/docs/SCREENSHOTS.md b/docs/SCREENSHOTS.md index b2d4f733..14ecc640 100644 --- a/docs/SCREENSHOTS.md +++ b/docs/SCREENSHOTS.md @@ -11,8 +11,8 @@ Use this checklist before adding screenshots to the repository, GitHub Pages, Te - Hide local file paths unless the path is a generic example. - Hide private thread names, prompts, uploads, and repository names. - Hide Apple IDs, team IDs, bundle signing details, and TestFlight account details. -- For remote desktop screenshots, show only a controlled demo desktop or permission/status screen. Do not show an active personal desktop, browser session, terminal, chat, or repository. -- Prefer clean beta flows: setup checklist, gateway status, iPhone connection, thread list, file upload, and remote desktop permission state. +- Do not capture or publish Remote Desktop screens while that feature remains outside the supported public beta. +- Prefer clean beta flows: setup checklist, gateway status, iPhone connection, thread list, usage status, connector/plugin status, and file upload. Recommended beta screenshot set: @@ -23,6 +23,5 @@ Recommended beta screenshot set: - iPhone thread list with demo thread names. - iPhone usage and connector/plugin status with demo account names. - File upload confirmation using non-private sample files. -- Remote desktop permission screen without a live private desktop. Create real screenshots only from sanitized demo data. Run the public presence privacy review before committing screenshots or metadata that references screenshots. diff --git a/docs/SECURITY.md b/docs/SECURITY.md index 853da5d2..a2050a41 100644 --- a/docs/SECURITY.md +++ b/docs/SECURITY.md @@ -29,6 +29,10 @@ The gateway health response is intentionally public-safe, but it is still operat CodePilot swaps local provider auth files. It waits for active turns to finish before automatic switching, but users should still avoid manually editing auth files while turns are running. +## Remote Desktop + +Remote Desktop is not part of the supported public beta while device-pairing and session-authorization enforcement is being completed and independently verified. Do not enable it in beta builds or expose its routes through a tunnel. + ## Reporting Issues Do not include auth files, bearer tokens, logs containing tokens, or uploaded private files in issue reports. diff --git a/docs/TROUBLESHOOTING.md b/docs/TROUBLESHOOTING.md index 8e278f14..ebbd4465 100644 --- a/docs/TROUBLESHOOTING.md +++ b/docs/TROUBLESHOOTING.md @@ -36,9 +36,9 @@ Use **Force Restart Gateway...** only when the gateway is stuck and interrupting Pull to refresh the thread list. If a live stream was interrupted, open the thread again after the turn finishes so saved messages can reload from the Mac gateway. -## Remote Desktop Controls Do Not Work +## Remote Desktop Is Unavailable -Open the CodePilot setup window on the Mac and confirm Screen Recording and Accessibility permissions are granted. Restart CodePilot after changing macOS privacy permissions. +Remote Desktop is not part of the supported public beta while its device-pairing and session-authorization enforcement is being completed and independently verified. Do not work around this restriction or enable the feature in beta builds. ## Localhost Link Does Not Open diff --git a/docs/index.md b/docs/index.md index 7701126b..ce4844ab 100644 --- a/docs/index.md +++ b/docs/index.md @@ -10,7 +10,6 @@ The beta is focused on practical workflows for AI coding users: - Switch saved Codex account profiles after active turns finish. - Connect the iPhone app to the Mac gateway through a user-owned Cloudflare Tunnel during the public beta. - Upload files, inspect threads, steer or stop turns where supported, and receive turn-finished notifications. -- Use remote desktop features only after pairing and macOS permission checks. CodePilot is source-available for noncommercial use. It is not OSI open source. See the repository license files before redistributing or using it commercially. @@ -40,6 +39,8 @@ CodePilot currently targets Codex CLI. Future provider support is not part of th The public-beta iPhone setup uses Cloudflare Tunnel. Same-network iPhone access is not part of the supported beta path until CodePilot ships explicit LAN-binding, firewall, and trust guidance. +Remote Desktop is not part of the supported public beta while its device-pairing and session-authorization enforcement is being completed and independently verified. Do not enable it in beta builds yet. + Do not share screenshots, logs, gateway URLs, tokens, account names, hostnames, or local file paths in public issues unless they have been sanitized. For beta reports, include the affected area, the failing step, visible recovery text, and whether Codex CLI was already working on the Mac. See the [beta feedback guide](BETA_FEEDBACK.md). diff --git a/ops/agents/escalations/presence-maintenance.md b/ops/agents/escalations/presence-maintenance.md index ceee1f4d..f7ef9975 100644 --- a/ops/agents/escalations/presence-maintenance.md +++ b/ops/agents/escalations/presence-maintenance.md @@ -16,5 +16,6 @@ The 2026-07-17 public repository review found two launch-readiness settings that 1. Enable GitHub Pages from the approved `main` branch `docs/` folder, verify the site, and add its URL to the repository website field. The Pages endpoint and repository website field are currently unset. 2. Enable GitHub private vulnerability reporting, then link the private reporting form from `docs/SECURITY.md` and the security issue-template contact link. Private vulnerability reporting is currently disabled, so public copy must not imply that a secure reporting channel exists. +3. Do not approve broader beta promotion while the critical Remote Desktop authorization blocker in GitHub issue #25 remains open. Review a fully tested fix before allowing the feature into public-beta copy or builds; the presence docs now describe it as unavailable. These settings should be completed before broader public-beta promotion. No release, App Store, pricing, legal, credential, or external-system change is authorized by this note. From be2a0e48fbf805f7eb018d7b42a8d9194cdcc571 Mon Sep 17 00:00:00 2001 From: CodePilot Date: Fri, 17 Jul 2026 11:03:55 +0200 Subject: [PATCH 18/44] docs: align beta App Store metadata --- docs/APP_STORE_METADATA_DRAFT.md | 8 ++++++-- docs/CHANGELOG.md | 2 ++ ios/CodexPhone/fastlane/Fastfile | 2 +- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/docs/APP_STORE_METADATA_DRAFT.md b/docs/APP_STORE_METADATA_DRAFT.md index e582e88c..15e56a9f 100644 --- a/docs/APP_STORE_METADATA_DRAFT.md +++ b/docs/APP_STORE_METADATA_DRAFT.md @@ -12,7 +12,9 @@ Codex companion for your Mac ## Promotional Text -Public beta for Codex CLI users who want iPhone visibility, file uploads, turn control, notifications, and safe gateway-backed access to coding-agent sessions running on their own Mac. +Public beta for Codex CLI users who want iPhone access to thread status, file uploads, turn controls, notifications, and coding-agent sessions on their own Mac. + +Character count: 160 of 170. ## Description @@ -26,7 +28,9 @@ CodePilot handles local coding-agent credentials and gateway access. Review the ## Keywords -Codex, coding agent, developer tools, Mac, iPhone, remote coding, AI coding, TestFlight, gateway, Cloudflare +Codex,coding agent,developer tools,Mac,iPhone,remote coding,AI coding,gateway,Cloudflare + +Character count: 88 of 100. ## What To Test diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index 3941df72..0cd8a705 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -24,6 +24,8 @@ - Clarified that Codex credentials remain on the Mac while Cloudflare processes gateway traffic and connection metadata for the user-owned tunnel. - Aligned support, beta feedback, issue-template, and screenshot guidance with the promoted usage and connector/plugin status workflows. - Removed Remote Desktop from public-beta promotion while its pairing and session-authorization enforcement remains a release blocker. +- Removed Remote Desktop from the default TestFlight beta description and aligned that metadata with the supported thread, usage, account, upload, turn-control, and notification workflows. +- Shortened the App Store promotional text and keyword draft to fit their submission field limits while preserving the Codex CLI beta positioning. ### Recent Product Work diff --git a/ios/CodexPhone/fastlane/Fastfile b/ios/CodexPhone/fastlane/Fastfile index a5e9cc63..56af5c5f 100644 --- a/ios/CodexPhone/fastlane/Fastfile +++ b/ios/CodexPhone/fastlane/Fastfile @@ -52,7 +52,7 @@ platform :ios do def codex_phone_beta_description ENV.fetch( "BETA_APP_DESCRIPTION", - "CodePilot connects an iPhone to your own Mac gateway for remote coding sessions, thread management, usage status, file upload, file previews, and local Mac web links. Remote Desktop is not included in this beta." + "CodePilot is a public beta for Codex CLI users who want iPhone access to coding-agent threads, usage and account status, file uploads, turn controls, and notifications through a gateway on their own Mac." ) end From 0d091d9e2f75a3071b79676553b31f7d0393f7b7 Mon Sep 17 00:00:00 2001 From: CodePilot Date: Fri, 17 Jul 2026 11:49:15 +0200 Subject: [PATCH 19/44] docs: clarify public beta access and feedback --- README.md | 9 +++++++++ docs/APP_STORE_METADATA_DRAFT.md | 4 ++-- docs/CHANGELOG.md | 3 +++ docs/FAQ.md | 6 ++++++ docs/SUPPORT.md | 3 +++ docs/index.md | 13 +++++++++++++ 6 files changed, 36 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index bc078c46..225d2767 100644 --- a/README.md +++ b/README.md @@ -30,6 +30,8 @@ The public product name is provider-neutral, but the first implementation remain ## Quick Start +The Mac app currently builds from source. The iPhone companion requires access to an approved beta build; this repository does not yet promise a public TestFlight invitation or App Store download. + 1. Install Codex on the Mac that will run CodePilot. 2. Build the Mac app: @@ -66,6 +68,13 @@ See: - [Troubleshooting](docs/TROUBLESHOOTING.md) - [Release Checklist](docs/RELEASE_CHECKLIST.md) +## Beta Feedback + +- [Report a beta bug](https://github.com/codepilotios/codepilot/issues/new?template=bug_report.md) +- [Request a beta improvement](https://github.com/codepilotios/codepilot/issues/new?template=feature_request.md) + +Remove gateway URLs, tokens, hostnames, account names, local paths, private prompts, uploaded files, and unsanitized screenshots before submitting. For security-sensitive findings, read the [security reporting guidance](docs/SECURITY.md) first and do not post sensitive evidence publicly. + ## Features - Manual account profile capture and switching. diff --git a/docs/APP_STORE_METADATA_DRAFT.md b/docs/APP_STORE_METADATA_DRAFT.md index 15e56a9f..2dd7f4ae 100644 --- a/docs/APP_STORE_METADATA_DRAFT.md +++ b/docs/APP_STORE_METADATA_DRAFT.md @@ -40,11 +40,11 @@ Please report whether Cloudflare Tunnel setup, gateway connection, or token entr ## Support URL -Requires maintainer approval before TestFlight external testing or App Store submission. Candidate destination: the public support documentation and issue tracker once the repository is public. +Requires maintainer approval before TestFlight external testing or App Store submission. Candidate destination after GitHub Pages is enabled and verified: `https://codepilotios.github.io/codepilot/SUPPORT.html`. ## Privacy URL -Requires maintainer approval before TestFlight external testing or App Store submission. Candidate destination: the public website privacy page generated from [Privacy](PRIVACY.md). +Requires maintainer approval before TestFlight external testing or App Store submission. Candidate destination after GitHub Pages is enabled and verified: `https://codepilotios.github.io/codepilot/PRIVACY.html`, generated from [Privacy](PRIVACY.md). ## Screenshot Requirements diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index 0cd8a705..66123ee1 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -26,6 +26,9 @@ - Removed Remote Desktop from public-beta promotion while its pairing and session-authorization enforcement remains a release blocker. - Removed Remote Desktop from the default TestFlight beta description and aligned that metadata with the supported thread, usage, account, upload, turn-control, and notification workflows. - Shortened the App Store promotional text and keyword draft to fit their submission field limits while preserving the Codex CLI beta positioning. +- Clarified that the Mac app builds from source while iPhone access still requires an approved beta build, without implying public TestFlight or App Store availability. +- Added direct privacy-safe bug and feature-request paths to the README, Pages landing page, FAQ, and support copy. +- Added concrete draft support and privacy URLs that remain gated on GitHub Pages enablement and maintainer verification. ### Recent Product Work diff --git a/docs/FAQ.md b/docs/FAQ.md index 1b8a6e70..0823ffe9 100644 --- a/docs/FAQ.md +++ b/docs/FAQ.md @@ -4,6 +4,10 @@ CodePilot is for AI coding users who already run Codex CLI on a Mac and want an iPhone companion for visibility, file uploads, turn control, usage status, and account switching. +## How do I access the beta? + +The Mac app currently builds from source using the repository installation guide. The iPhone companion requires access to an approved beta build; CodePilot does not yet advertise a public TestFlight invitation or App Store download. + ## Is CodePilot ready for production teams? No. The current release track is a public beta. Use it on a trusted Mac, expect rough edges, and review the security and privacy docs before exposing the gateway outside your local network. @@ -32,6 +36,8 @@ No hosted CodePilot service is required for the current beta, and Codex credenti Do not post auth files, gateway tokens, private hostnames, personal account names, local file paths, private screenshots, Apple identifiers, or logs that contain any of those values. +Use the repository templates to [report a beta bug](https://github.com/codepilotios/codepilot/issues/new?template=bug_report.md) or [request a beta improvement](https://github.com/codepilotios/codepilot/issues/new?template=feature_request.md). Read the [security guidance](SECURITY.md) before reporting a sensitive finding. + ## Is commercial use allowed? Not without a separate written license. See the repository license, commercial license, and notice files. diff --git a/docs/SUPPORT.md b/docs/SUPPORT.md index 84eb2fa0..cd971211 100644 --- a/docs/SUPPORT.md +++ b/docs/SUPPORT.md @@ -2,6 +2,9 @@ CodePilot beta support is handled through public repository issues and pull requests. +- [Report a beta bug](https://github.com/codepilotios/codepilot/issues/new?template=bug_report.md) +- [Request a beta improvement](https://github.com/codepilotios/codepilot/issues/new?template=feature_request.md) + ## Before Opening An Issue Check: diff --git a/docs/index.md b/docs/index.md index ce4844ab..13d824fb 100644 --- a/docs/index.md +++ b/docs/index.md @@ -11,6 +11,12 @@ The beta is focused on practical workflows for AI coding users: - Connect the iPhone app to the Mac gateway through a user-owned Cloudflare Tunnel during the public beta. - Upload files, inspect threads, steer or stop turns where supported, and receive turn-finished notifications. +## Beta Access + +The Mac app currently builds from source. The iPhone companion requires access to an approved beta build; CodePilot does not yet advertise a public TestFlight invitation or App Store download. + +Start with the [Mac installation guide](INSTALL_MAC.md). If you already have an approved iPhone beta build, continue with the [iOS installation guide](INSTALL_IOS.md). + CodePilot is source-available for noncommercial use. It is not OSI open source. See the repository license files before redistributing or using it commercially. ## Start Here @@ -26,6 +32,13 @@ CodePilot is source-available for noncommercial use. It is not OSI open source. - [Support](SUPPORT.md) - [Changelog](CHANGELOG.md) +## Share Beta Feedback + +- [Report a beta bug](https://github.com/codepilotios/codepilot/issues/new?template=bug_report.md) +- [Request a beta improvement](https://github.com/codepilotios/codepilot/issues/new?template=feature_request.md) + +Use the structured templates so reports include the failing step and visible recovery message. Remove private values before submitting, and follow the [security guidance](SECURITY.md) for sensitive findings. + ## Before You Install - Use a Mac you control and keep the gateway bearer token private. From 4cfd081ffd8e4fd1779b80b3ddba015e1c873e03 Mon Sep 17 00:00:00 2001 From: CodePilot Date: Fri, 17 Jul 2026 14:14:48 +0200 Subject: [PATCH 20/44] docs: complete beta setup prerequisites --- README.md | 19 +++++++++++++------ docs/CHANGELOG.md | 1 + docs/FAQ.md | 2 +- docs/INSTALL_IOS.md | 2 ++ docs/INSTALL_MAC.md | 8 ++++++++ docs/index.md | 2 +- 6 files changed, 26 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index 225d2767..fe191a95 100644 --- a/README.md +++ b/README.md @@ -30,25 +30,32 @@ The public product name is provider-neutral, but the first implementation remain ## Quick Start -The Mac app currently builds from source. The iPhone companion requires access to an approved beta build; this repository does not yet promise a public TestFlight invitation or App Store download. +The Mac app currently builds from source on macOS 13 or later. The iPhone companion requires iOS 17 or later and access to an approved beta build; this repository does not yet promise a public TestFlight invitation or App Store download. 1. Install Codex on the Mac that will run CodePilot. -2. Build the Mac app: +2. Clone this repository: + + ```sh + git clone https://github.com/codepilotios/codepilot.git + cd codepilot + ``` + +3. Build the Mac app: ```sh scripts/build-app.sh open "build/CodePilot.app" ``` -3. Use the menu bar app to add account profiles. -4. Install and start the gateway from the app setup screen or the helper script: +4. Use the menu bar app to add account profiles. +5. Install and start the gateway from the app setup screen or the helper script: ```sh scripts/install-phone-gateway-agent.sh ``` -5. Configure Cloudflare Tunnel for public-beta iPhone access. -6. Install the iOS app and enter the gateway URL plus bearer token. +6. Configure Cloudflare Tunnel for public-beta iPhone access. +7. If you have an approved iPhone beta build, install it and enter the gateway URL plus bearer token. See: diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index 66123ee1..0c6b6a0b 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -29,6 +29,7 @@ - Clarified that the Mac app builds from source while iPhone access still requires an approved beta build, without implying public TestFlight or App Store availability. - Added direct privacy-safe bug and feature-request paths to the README, Pages landing page, FAQ, and support copy. - Added concrete draft support and privacy URLs that remain gated on GitHub Pages enablement and maintainer verification. +- Added the missing repository checkout step and documented the supported macOS 13 and iOS 17 minimums for beta setup. ### Recent Product Work diff --git a/docs/FAQ.md b/docs/FAQ.md index 0823ffe9..6f7d1a95 100644 --- a/docs/FAQ.md +++ b/docs/FAQ.md @@ -6,7 +6,7 @@ CodePilot is for AI coding users who already run Codex CLI on a Mac and want an ## How do I access the beta? -The Mac app currently builds from source using the repository installation guide. The iPhone companion requires access to an approved beta build; CodePilot does not yet advertise a public TestFlight invitation or App Store download. +The Mac app currently builds from source on macOS 13 or later using the repository installation guide. The iPhone companion requires iOS 17 or later and access to an approved beta build; CodePilot does not yet advertise a public TestFlight invitation or App Store download. ## Is CodePilot ready for production teams? diff --git a/docs/INSTALL_IOS.md b/docs/INSTALL_IOS.md index 4e8e85c5..085a169e 100644 --- a/docs/INSTALL_IOS.md +++ b/docs/INSTALL_IOS.md @@ -4,6 +4,8 @@ CodePilot iOS connects to a Mac running the CodePilot gateway. ## Requirements +- An iPhone running iOS 17 or later. +- Access to an approved CodePilot beta build. - A Mac running the CodePilot gateway. - A reachable gateway URL. - The gateway bearer token from the Mac. diff --git a/docs/INSTALL_MAC.md b/docs/INSTALL_MAC.md index 07e8994e..c9aaf580 100644 --- a/docs/INSTALL_MAC.md +++ b/docs/INSTALL_MAC.md @@ -5,12 +5,20 @@ CodePilot Mac is a menu bar app. It currently builds from source with SwiftPM. ## Requirements - macOS 13 or later. +- Git. - Xcode command line tools. - Codex installed and available as `codex`. - A local Codex login at `~/.codex/auth.json`. Successful setup means the menu bar app shows `CodePilot`, at least one account profile exists, and the setup window marks the gateway token and gateway as ready. +## Get The Source + +```sh +git clone https://github.com/codepilotios/codepilot.git +cd codepilot +``` + ## Build ```sh diff --git a/docs/index.md b/docs/index.md index 13d824fb..82ead723 100644 --- a/docs/index.md +++ b/docs/index.md @@ -13,7 +13,7 @@ The beta is focused on practical workflows for AI coding users: ## Beta Access -The Mac app currently builds from source. The iPhone companion requires access to an approved beta build; CodePilot does not yet advertise a public TestFlight invitation or App Store download. +The Mac app currently builds from source on macOS 13 or later. The iPhone companion requires iOS 17 or later and access to an approved beta build; CodePilot does not yet advertise a public TestFlight invitation or App Store download. Start with the [Mac installation guide](INSTALL_MAC.md). If you already have an approved iPhone beta build, continue with the [iOS installation guide](INSTALL_IOS.md). From bc69a117db92290de593fe49aad8b161230dd2cf Mon Sep 17 00:00:00 2001 From: CodePilot Date: Fri, 17 Jul 2026 15:07:45 +0200 Subject: [PATCH 21/44] docs: clarify remote desktop beta reporting --- .github/ISSUE_TEMPLATE/bug_report.md | 6 ++++-- .github/ISSUE_TEMPLATE/feature_request.md | 2 +- docs/BETA_FEEDBACK.md | 6 ++++-- docs/CHANGELOG.md | 1 + docs/PUBLIC_PRESENCE_CHECKLIST.md | 2 +- docs/SUPPORT.md | 7 +++++-- 6 files changed, 16 insertions(+), 8 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md index 694e61cd..917675d6 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.md +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -15,7 +15,7 @@ assignees: "" - [ ] Account switching - [ ] Usage status - [ ] Connector/plugin status -- [ ] Remote desktop +- [ ] Remote Desktop availability guard (feature appeared or could be enabled) - [ ] File upload - [ ] Notifications - [ ] Documentation @@ -38,7 +38,7 @@ Check the closest match: - [ ] File upload - [ ] Steering or stop-turn control - [ ] Notification delivery -- [ ] Remote desktop pairing or permission check +- [ ] Remote Desktop appeared or could be enabled - [ ] Documentation ## Steps to reproduce @@ -65,3 +65,5 @@ Paste the visible recovery message or status text, with private values removed. Attach only sanitized logs or screenshots when they materially help reproduce the issue. Do not include Codex auth files, gateway bearer tokens, private hostnames, tunnel URLs, personal account names, email addresses, Apple identifiers, local file paths, private prompts, uploaded files, repository names, or live desktop contents. + +Remote Desktop is outside the supported public beta. Report only if it appears or can be enabled; do not test its routes or attach desktop captures. diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md index 31e200c9..1d08b1c2 100644 --- a/.github/ISSUE_TEMPLATE/feature_request.md +++ b/.github/ISSUE_TEMPLATE/feature_request.md @@ -28,7 +28,7 @@ Describe what you do today, if anything. ## Setup Context -- Mac app, iPhone app, gateway, Cloudflare setup, account switching, remote desktop, notifications, file upload, or docs: +- Mac app, iPhone app, gateway, Cloudflare setup, account switching, notifications, file upload, or docs: - Codex CLI already working on the Mac: yes/no/not sure - Connection path: Cloudflare Tunnel / other / not applicable diff --git a/docs/BETA_FEEDBACK.md b/docs/BETA_FEEDBACK.md index 68dfdef0..c252b999 100644 --- a/docs/BETA_FEEDBACK.md +++ b/docs/BETA_FEEDBACK.md @@ -6,11 +6,11 @@ CodePilot public beta feedback is most useful when it helps reproduce a real Cod Include: -- The area affected: Mac app, iPhone app, gateway, Cloudflare setup, account switching, usage status, connector/plugin status, remote desktop, file upload, notifications, or docs. +- The area affected: Mac app, iPhone app, gateway, Cloudflare setup, account switching, usage status, connector/plugin status, file upload, notifications, docs, or the Remote Desktop availability guard. - What you were trying to do. - What happened instead. - The visible recovery message or status text. -- Whether the failing step was setup, Cloudflare Tunnel, gateway connection, token entry, thread loading, usage or connector status, upload, notification delivery, turn control, or remote desktop. +- Whether the failing step was setup, Cloudflare Tunnel, gateway connection, token entry, thread loading, usage or connector status, upload, notification delivery, turn control, or an unavailable feature appearing unexpectedly. - macOS version, iOS version, CodePilot build or commit, and Codex CLI version when available. - Sanitized logs or screenshots only when they make the issue clearer. @@ -33,3 +33,5 @@ Remove these before opening an issue or attaching screenshots: - Logs containing any of the above. For security-sensitive reports, follow [Security](SECURITY.md) and avoid posting exploit details or secrets publicly. + +Remote Desktop is outside the supported public beta. Report only if it appears or can be enabled; do not test its routes or share desktop captures. diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index 0c6b6a0b..9228256b 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -30,6 +30,7 @@ - Added direct privacy-safe bug and feature-request paths to the README, Pages landing page, FAQ, and support copy. - Added concrete draft support and privacy URLs that remain gated on GitHub Pages enablement and maintainer verification. - Added the missing repository checkout step and documented the supported macOS 13 and iOS 17 minimums for beta setup. +- Reframed Remote Desktop support categories as availability-guard reports so the gated feature is not presented as a supported beta workflow. ### Recent Product Work diff --git a/docs/PUBLIC_PRESENCE_CHECKLIST.md b/docs/PUBLIC_PRESENCE_CHECKLIST.md index dd20e3c7..1773398a 100644 --- a/docs/PUBLIC_PRESENCE_CHECKLIST.md +++ b/docs/PUBLIC_PRESENCE_CHECKLIST.md @@ -32,7 +32,7 @@ For screenshot, metadata, issue-template, or support-copy changes, also verify: Public support and feedback copy should ask for: -- Affected area: Mac app, iPhone app, gateway, Cloudflare setup, account switching, remote desktop, file upload, notifications, or docs. +- Affected area: Mac app, iPhone app, gateway, Cloudflare setup, account switching, file upload, notifications, docs, or the Remote Desktop availability guard. - Failing step and visible recovery message. - macOS version, iOS version, CodePilot build or commit, and Codex CLI version when available. - Sanitized logs or screenshots only when they materially help reproduce the issue. diff --git a/docs/SUPPORT.md b/docs/SUPPORT.md index cd971211..b5e3482a 100644 --- a/docs/SUPPORT.md +++ b/docs/SUPPORT.md @@ -23,10 +23,10 @@ Use the repository bug report template when available. Include: -- The affected area: Mac app, iPhone app, gateway, Cloudflare setup, account switching, usage status, connector/plugin status, remote desktop, file upload, notifications, or docs. +- The affected area: Mac app, iPhone app, gateway, Cloudflare setup, account switching, usage status, connector/plugin status, file upload, notifications, docs, or the Remote Desktop availability guard. - What you expected to happen. - What happened instead. -- Whether setup, Cloudflare Tunnel, gateway connection, token entry, thread loading, file upload, notification delivery, turn control, or remote desktop is the failing step. +- Whether setup, Cloudflare Tunnel, gateway connection, token entry, thread loading, file upload, notification delivery, turn control, or an unavailable feature appearing unexpectedly is the failing step. - The visible recovery message, if one appears. - Whether Codex CLI was already working on the Mac before CodePilot setup. - macOS version, iOS version, CodePilot build or commit, and Codex CLI version when available. @@ -42,6 +42,9 @@ Do not include: - Personal account names or email addresses. - Apple account, team, signing, or TestFlight identifiers. - Screenshots that show private files, paths, accounts, tokens, or hosts. +- Desktop captures from the unavailable Remote Desktop feature. + +Remote Desktop is outside the supported public beta. Report only if it appears or can be enabled; do not test its routes. ## Security Reports From 5b66d947bd25b8a45d4e655eb9c2d786eeecbb6b Mon Sep 17 00:00:00 2001 From: CodePilot Date: Fri, 17 Jul 2026 16:00:28 +0200 Subject: [PATCH 22/44] docs: disclose beta data handling details --- docs/CHANGELOG.md | 1 + docs/PRIVACY.md | 12 +++++++++--- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index 9228256b..628f09e4 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -31,6 +31,7 @@ - Added concrete draft support and privacy URLs that remain gated on GitHub Pages enablement and maintainer verification. - Added the missing repository checkout step and documented the supported macOS 13 and iOS 17 minimums for beta setup. - Reframed Remote Desktop support categories as availability-guard reports so the gated feature is not presented as a supported beta workflow. +- Expanded the beta privacy draft to disclose Cloudflare data transit, notification and Live Activity payload contents, and the lack of automatic upload cleanup. ### Recent Product Work diff --git a/docs/PRIVACY.md b/docs/PRIVACY.md index 1e0c2fb2..17b46a64 100644 --- a/docs/PRIVACY.md +++ b/docs/PRIVACY.md @@ -16,9 +16,13 @@ Sensitive local files include: - `~/.codex-account-switcher/phone-gateway-token` - `~/.codex-account-switcher/phone-gateway.env` - `~/.codex-account-switcher/phone-uploads/` +- `~/.codex-account-switcher/phone-notification-devices.json` +- `~/.codex-account-switcher/phone-live-activities.json` Do not commit these files, include them in public issues, or show them in screenshots. +Uploaded files remain under the CodePilot state directory after a turn finishes. The current beta does not automatically remove them; delete uploads from the Mac when they are no longer needed. + ## Mac Gateway The CodePilot gateway runs on your Mac and requires a bearer token. It exposes CodePilot features to trusted clients, including account status, usage status, thread access, file upload, notification registration, and turn controls where supported. @@ -29,13 +33,15 @@ The gateway token, gateway URL, hostnames, thread names, uploaded files, prompts The iPhone app stores the gateway URL and token locally on the device so it can connect to your Mac gateway. Files selected in the iPhone app are uploaded to the Mac gateway and saved under the CodePilot state directory. -If notifications are enabled, the app and gateway use Apple Push Notification service infrastructure for turn-finished notification delivery. Notification payloads should remain minimal and must not include auth files, bearer tokens, private prompts, or uploaded file contents. +If notifications are enabled, the app registers a device token with the Mac gateway and the gateway stores that token locally. Turn-finished payloads sent through Apple Push Notification service can include a thread title, a short failure summary, and internal thread and job identifiers. Live Activity updates can include aggregate account-usage status, counts, and refresh timing. These values may be visible on the device according to its notification settings, so use non-sensitive thread titles and disable CodePilot notifications or Live Activities in iOS settings if that disclosure is not acceptable. + +Notification payloads do not intentionally include auth files, gateway bearer tokens, private prompt text, or uploaded file contents. A failure summary can still reproduce text from an underlying error, so treat notification previews as potentially sensitive during the beta. ## Cloudflare Tunnel -During the public beta, remote iPhone access uses a user-owned Cloudflare Tunnel. Cloudflare may process connection metadata for tunnel operation according to your Cloudflare account configuration and Cloudflare's own terms and policies. +During the public beta, remote iPhone access uses a user-owned Cloudflare Tunnel. Gateway requests and responses pass through Cloudflare, including thread data, prompts, turn output, usage and account status, and uploaded file contents when those features are used. Cloudflare also processes connection metadata for tunnel operation according to your Cloudflare account configuration and Cloudflare's own terms and policies. -CodePilot still requires the gateway bearer token when using Cloudflare Tunnel. Treat temporary TryCloudflare URLs, permanent tunnel hostnames, and the gateway token as private support data. +Use an HTTPS tunnel URL. CodePilot still requires the gateway bearer token when using Cloudflare Tunnel. Treat temporary TryCloudflare URLs, permanent tunnel hostnames, and the gateway token as private support data. ## Remote Desktop From 67fed7063dc888de84f93afae0be18ed1ee75549 Mon Sep 17 00:00:00 2001 From: CodePilot Date: Fri, 17 Jul 2026 18:35:38 +0200 Subject: [PATCH 23/44] docs: clarify beta external data flows --- docs/APP_STORE_METADATA_DRAFT.md | 2 +- docs/CHANGELOG.md | 1 + docs/FAQ.md | 4 ++++ docs/PRIVACY.md | 12 ++++++++++++ 4 files changed, 18 insertions(+), 1 deletion(-) diff --git a/docs/APP_STORE_METADATA_DRAFT.md b/docs/APP_STORE_METADATA_DRAFT.md index 2dd7f4ae..60076067 100644 --- a/docs/APP_STORE_METADATA_DRAFT.md +++ b/docs/APP_STORE_METADATA_DRAFT.md @@ -24,7 +24,7 @@ Use the iPhone app to check active account status, follow threads, upload files, The beta is focused on setup clarity, connection reliability, privacy-safe diagnostics, and practical remote workflows for existing Codex CLI users. Some internals still use Codex-specific names while the public CodePilot product surface is prepared for broader provider support later. -CodePilot handles local coding-agent credentials and gateway access. Review the privacy, security, install, and support docs before exposing the gateway outside your local network. +CodePilot handles local coding-agent credentials and gateway access. Coding prompts and selected attachments are still processed through Codex and OpenAI according to the user's Codex account and configuration. Review the privacy, security, install, and support docs before exposing the gateway outside your local network. ## Keywords diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index 628f09e4..c1d6ebc0 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -32,6 +32,7 @@ - Added the missing repository checkout step and documented the supported macOS 13 and iOS 17 minimums for beta setup. - Reframed Remote Desktop support categories as availability-guard reports so the gated feature is not presented as a supported beta workflow. - Expanded the beta privacy draft to disclose Cloudflare data transit, notification and Live Activity payload contents, and the lack of automatic upload cleanup. +- Clarified that the local gateway does not make Codex workflows offline: prompts, conversation context, and selected attachments can still be processed by OpenAI, while Cloudflare and Apple process data only for the enabled tunnel and notification workflows. ### Recent Product Work diff --git a/docs/FAQ.md b/docs/FAQ.md index 6f7d1a95..69ae4d0a 100644 --- a/docs/FAQ.md +++ b/docs/FAQ.md @@ -32,6 +32,10 @@ No. Remote Desktop remains outside the supported public beta while its device-pa No hosted CodePilot service is required for the current beta, and Codex credentials stay on the Mac. When you use Cloudflare Tunnel, gateway traffic and connection metadata pass through Cloudflare under your Cloudflare account configuration; the gateway still requires its bearer token. +## Does all coding data stay on my Mac? + +No. CodePilot runs its gateway on your Mac, but Codex is still an online coding service. Prompts, conversation context, and selected attachments can be sent to OpenAI through Codex according to your Codex account and configuration. Cloudflare processes gateway traffic when you use the supported remote iPhone path, and Apple processes notification or Live Activity data when those features are enabled. See [Privacy](PRIVACY.md) for the beta data-flow summary. + ## What should I avoid posting in issues? Do not post auth files, gateway tokens, private hostnames, personal account names, local file paths, private screenshots, Apple identifiers, or logs that contain any of those values. diff --git a/docs/PRIVACY.md b/docs/PRIVACY.md index 17b46a64..6a51b1a4 100644 --- a/docs/PRIVACY.md +++ b/docs/PRIVACY.md @@ -4,6 +4,8 @@ CodePilot is a public beta for people who already run Codex CLI on a Mac they co This page describes the repository beta behavior. App Store privacy labels and any hosted service policy still require maintainer approval before submission. +CodePilot is not an offline coding tool. When you start or continue a Codex turn, the gateway passes your prompt and selected attachments to Codex on the Mac. Codex can send that content, conversation context, and related service metadata to OpenAI according to your Codex account, configuration, and the policies that apply to that service. CodePilot does not replace or change those provider terms, retention rules, or account controls. + ## Local Data CodePilot works with local coding-agent state on your Mac, including Codex login state, saved account profiles, usage data, gateway settings, uploaded files, thread metadata, and notification state. @@ -43,6 +45,16 @@ During the public beta, remote iPhone access uses a user-owned Cloudflare Tunnel Use an HTTPS tunnel URL. CodePilot still requires the gateway bearer token when using Cloudflare Tunnel. Treat temporary TryCloudflare URLs, permanent tunnel hostnames, and the gateway token as private support data. +## External Services + +The repository beta does not require a CodePilot-operated analytics or account service, but supported workflows can involve other services: + +- Codex and OpenAI process coding prompts, conversation context, and selected attachments when you use coding-agent features. +- Cloudflare processes tunneled gateway traffic and connection metadata when you use the supported remote iPhone path. +- Apple Push Notification service processes device tokens and notification or Live Activity payloads when those features are enabled. + +Review the settings and policies for each service you enable. Disabling notifications stops new CodePilot notification and Live Activity delivery, but it does not remove data already retained by Codex, OpenAI, Cloudflare, Apple, or the local Mac state. + ## Remote Desktop Remote Desktop is not part of the supported public beta while its device-pairing and session-authorization enforcement is being completed and independently verified. Do not enable it in beta builds yet. From 20c49a3651900ee588f0c60fce1d60b596dad18f Mon Sep 17 00:00:00 2001 From: CodePilot Date: Fri, 17 Jul 2026 19:38:38 +0200 Subject: [PATCH 24/44] docs: harden beta screenshot capture brief --- docs/CHANGELOG.md | 1 + docs/SCREENSHOTS.md | 23 +++++++++++++++++++++++ 2 files changed, 24 insertions(+) diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index c1d6ebc0..08d0abb3 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -33,6 +33,7 @@ - Reframed Remote Desktop support categories as availability-guard reports so the gated feature is not presented as a supported beta workflow. - Expanded the beta privacy draft to disclose Cloudflare data transit, notification and Live Activity payload contents, and the lack of automatic upload cleanup. - Clarified that the local gateway does not make Codex workflows offline: prompts, conversation context, and selected attachments can still be processed by OpenAI, while Cloudflare and Apple process data only for the enabled tunnel and notification workflows. +- Added a consistent fictional-data capture brief and full-resolution acceptance checklist for the approved public beta screenshot set. ### Recent Product Work diff --git a/docs/SCREENSHOTS.md b/docs/SCREENSHOTS.md index 14ecc640..b0f367df 100644 --- a/docs/SCREENSHOTS.md +++ b/docs/SCREENSHOTS.md @@ -24,4 +24,27 @@ Recommended beta screenshot set: - iPhone usage and connector/plugin status with demo account names. - File upload confirmation using non-private sample files. +## Demo Capture Brief + +Use one consistent fictional workspace across the set so the screens tell a coherent beta story: + +- Account names: `Work`, `Personal`, and `Demo`. +- Gateway hostname: `codepilot.example.com`. +- Thread names: `Review parser tests`, `Improve setup copy`, and `Triage upload error`. +- Sample files: `sample-diff.txt` and `wireframe.png`, created only for the capture session. +- Connector/plugin names: use built-in product labels or clearly fictional demo labels; do not show connected personal services. + +Capture only the app or simulator window. Exclude the desktop, menu bar extras outside CodePilot, browser history, notifications from other apps, device names, and unrelated windows. Keep the same appearance mode and demo state across related Mac and iPhone images. + +## Acceptance Checklist + +Before committing or attaching an image: + +- Inspect the full-resolution image, including status bars, window chrome, menus, background edges, and reflections or overlays. +- Confirm every visible account, hostname, thread, file, repository, prompt, connector, and notification matches the fictional capture brief. +- Confirm no bearer token, auth value, QR payload, local path, Apple identifier, device name, personal service, or private desktop content is visible. +- Confirm Remote Desktop is absent from the entire set while it remains outside the supported public beta. +- Write concise alt text that explains the beta workflow without repeating private or hidden values. +- Run `scripts/privacy-audit.sh` after adding the image files and their surrounding copy. + Create real screenshots only from sanitized demo data. Run the public presence privacy review before committing screenshots or metadata that references screenshots. From 451873378bfab2815b523fb2e9dc76ab647c69a6 Mon Sep 17 00:00:00 2001 From: CodePilot Date: Fri, 17 Jul 2026 22:32:06 +0200 Subject: [PATCH 25/44] docs: map public beta data flow --- README.md | 2 +- docs/CHANGELOG.md | 1 + docs/PRIVACY.md | 12 ++++++++++++ docs/index.md | 2 +- 4 files changed, 15 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index fe191a95..5ce24901 100644 --- a/README.md +++ b/README.md @@ -64,7 +64,7 @@ See: - [Cloudflare Setup](docs/CLOUDFLARE_SETUP.md) - [FAQ](docs/FAQ.md) - [Beta Feedback Guide](docs/BETA_FEEDBACK.md) -- [Privacy](docs/PRIVACY.md) +- [Privacy and beta data flow](docs/PRIVACY.md#beta-data-flow-at-a-glance) - [Support](docs/SUPPORT.md) - [Changelog](docs/CHANGELOG.md) - [App Store Metadata Draft](docs/APP_STORE_METADATA_DRAFT.md) diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index 08d0abb3..d13a3d2a 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -34,6 +34,7 @@ - Expanded the beta privacy draft to disclose Cloudflare data transit, notification and Live Activity payload contents, and the lack of automatic upload cleanup. - Clarified that the local gateway does not make Codex workflows offline: prompts, conversation context, and selected attachments can still be processed by OpenAI, while Cloudflare and Apple process data only for the enabled tunnel and notification workflows. - Added a consistent fictional-data capture brief and full-resolution acceptance checklist for the approved public beta screenshot set. +- Added a public beta data-flow map showing what stays on the Mac and what can be processed by Codex, OpenAI, Cloudflare, or Apple. ### Recent Product Work diff --git a/docs/PRIVACY.md b/docs/PRIVACY.md index 6a51b1a4..27c8746d 100644 --- a/docs/PRIVACY.md +++ b/docs/PRIVACY.md @@ -6,6 +6,18 @@ This page describes the repository beta behavior. App Store privacy labels and a CodePilot is not an offline coding tool. When you start or continue a Codex turn, the gateway passes your prompt and selected attachments to Codex on the Mac. Codex can send that content, conversation context, and related service metadata to OpenAI according to your Codex account, configuration, and the policies that apply to that service. CodePilot does not replace or change those provider terms, retention rules, or account controls. +## Beta Data Flow At A Glance + +| When you use | What stays on the Mac | What can leave the Mac | +| --- | --- | --- | +| Account and usage status | Codex login state, saved account profiles, and cached usage data | Codex and OpenAI can process account and usage requests made by the local Codex setup. | +| A Codex turn | Gateway state, thread metadata, and local Codex state | Prompts, conversation context, selected attachments, and related service metadata can be sent to Codex and OpenAI. | +| The iPhone companion | Gateway settings, uploaded files, and the gateway's copy of notification state | Gateway requests and responses pass through the user-owned Cloudflare Tunnel. | +| File upload | The uploaded file is saved under the CodePilot state directory | The file passes through Cloudflare when uploaded from iPhone and can be sent to Codex and OpenAI when selected for a turn. | +| Notifications or Live Activities | The gateway stores registered device and activity tokens | Apple can process device tokens and the notification or Live Activity payload described below. | + +CodePilot does not operate an account, analytics, or relay service for the current repository beta. This does not remove the data handling performed by Codex, OpenAI, Cloudflare, or Apple when you enable workflows that use those services. + ## Local Data CodePilot works with local coding-agent state on your Mac, including Codex login state, saved account profiles, usage data, gateway settings, uploaded files, thread metadata, and notification state. diff --git a/docs/index.md b/docs/index.md index 82ead723..480fcc6d 100644 --- a/docs/index.md +++ b/docs/index.md @@ -27,7 +27,7 @@ CodePilot is source-available for noncommercial use. It is not OSI open source. - [Troubleshooting](TROUBLESHOOTING.md) - [FAQ](FAQ.md) - [Beta feedback guide](BETA_FEEDBACK.md) -- [Privacy](PRIVACY.md) +- [Privacy and beta data flow](PRIVACY.md#beta-data-flow-at-a-glance) - [Security](SECURITY.md) - [Support](SUPPORT.md) - [Changelog](CHANGELOG.md) From d2d3caa237e1a6fd9919bf64d4670feb22d645db Mon Sep 17 00:00:00 2001 From: CodePilot Date: Fri, 17 Jul 2026 23:20:50 +0200 Subject: [PATCH 26/44] docs: document account reset credits --- README.md | 2 +- docs/CHANGELOG.md | 1 + docs/index.md | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 5ce24901..7831b771 100644 --- a/README.md +++ b/README.md @@ -86,7 +86,7 @@ Remove gateway URLs, tokens, hostnames, account names, local paths, private prom - Manual account profile capture and switching. - Automatic switching only after active turns are finished. -- 5-hour and weekly usage status across accounts. +- 5-hour and weekly usage status, reset timing, and available reset credits per account. - Global iOS credit progress indicator. - iOS remote chat and file upload. - Conversation steering and stop-turn controls where supported. diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index d13a3d2a..a29de77e 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -38,6 +38,7 @@ ### Recent Product Work +- Added per-account Codex usage reset timing and available reset-credit controls on Mac and iPhone. - Added Cloudflare setup wizard docs and automation. - Added gateway health, setup, and recovery guidance. - Added Remote Desktop foundations, localhost URL opening, file preview, and gateway-backed iPhone control improvements. Remote Desktop remains gated from the supported public beta pending security verification. diff --git a/docs/index.md b/docs/index.md index 480fcc6d..c3779df0 100644 --- a/docs/index.md +++ b/docs/index.md @@ -6,7 +6,7 @@ The current release track is a public beta for existing Codex CLI users. It is n The beta is focused on practical workflows for AI coding users: -- See active Codex usage and account status from the Mac and iPhone. +- See active Codex usage, reset timing, available reset credits, and account status from the Mac and iPhone. - Switch saved Codex account profiles after active turns finish. - Connect the iPhone app to the Mac gateway through a user-owned Cloudflare Tunnel during the public beta. - Upload files, inspect threads, steer or stop turns where supported, and receive turn-finished notifications. From 5b7050988af1027f94b9e51cdbb7ccada90edc21 Mon Sep 17 00:00:00 2001 From: CodePilot Date: Sat, 18 Jul 2026 00:09:02 +0200 Subject: [PATCH 27/44] docs: clarify beta operating expectations --- README.md | 2 ++ docs/CHANGELOG.md | 2 ++ docs/FAQ.md | 12 ++++++++++++ docs/INSTALL_IOS.md | 4 ++++ docs/index.md | 1 + ops/agents/escalations/presence-maintenance.md | 2 +- 6 files changed, 22 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 7831b771..ff613c1d 100644 --- a/README.md +++ b/README.md @@ -57,6 +57,8 @@ The Mac app currently builds from source on macOS 13 or later. The iPhone compan 6. Configure Cloudflare Tunnel for public-beta iPhone access. 7. If you have an approved iPhone beta build, install it and enter the gateway URL plus bearer token. +Keep the Mac awake and online, with the CodePilot gateway and Cloudflare Tunnel running, while using the iPhone companion. The current beta has no hosted relay that can reach an offline Mac. + See: - [Mac Installation](docs/INSTALL_MAC.md) diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index a29de77e..b3206998 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -35,6 +35,8 @@ - Clarified that the local gateway does not make Codex workflows offline: prompts, conversation context, and selected attachments can still be processed by OpenAI, while Cloudflare and Apple process data only for the enabled tunnel and notification workflows. - Added a consistent fictional-data capture brief and full-resolution acceptance checklist for the approved public beta screenshot set. - Added a public beta data-flow map showing what stays on the Mac and what can be processed by Codex, OpenAI, Cloudflare, or Apple. +- Clarified that iPhone access depends on an awake, online Mac running the gateway and Cloudflare Tunnel, with no hosted relay or remote wake promise in the current beta. +- Added FAQ and installation guidance for upload retention and safe account switching during active turns. ### Recent Product Work diff --git a/docs/FAQ.md b/docs/FAQ.md index 69ae4d0a..2cef0dd9 100644 --- a/docs/FAQ.md +++ b/docs/FAQ.md @@ -24,6 +24,18 @@ Not yet. The name is provider-neutral, but the first beta is Codex-focused. Futu Yes for the public beta iPhone setup path. The Mac gateway listens on local loopback by default, so the iPhone app uses a Cloudflare Tunnel URL until CodePilot provides an explicit LAN-binding mode with firewall and trust guidance. +## Does my Mac need to stay awake and online? + +Yes. The CodePilot gateway, Codex CLI, and Cloudflare Tunnel run from your Mac. The iPhone companion cannot reach sessions while that Mac is asleep, offline, or no longer running the gateway or tunnel. The current beta does not provide a hosted relay or wake the Mac remotely. + +## What happens to files I upload from iPhone? + +Uploads pass through your Cloudflare Tunnel and are saved under the CodePilot state directory on the Mac. They are not removed automatically after a turn. Delete files you no longer need, and remember that a selected attachment can be sent to Codex and OpenAI when you use it in a turn. See [Privacy](PRIVACY.md) for the full beta data flow. + +## Can CodePilot switch accounts while a turn is running? + +Automatic switching waits for active turns to finish. Avoid manually changing Codex auth files while turns are running; use CodePilot's account controls so a new profile is applied safely to later turns. + ## Is Remote Desktop included in the public beta? No. Remote Desktop remains outside the supported public beta while its device-pairing and session-authorization enforcement is being completed and independently verified. Do not enable it in beta builds yet. diff --git a/docs/INSTALL_IOS.md b/docs/INSTALL_IOS.md index 085a169e..b07755f0 100644 --- a/docs/INSTALL_IOS.md +++ b/docs/INSTALL_IOS.md @@ -24,6 +24,8 @@ Success means the app shows the active account from the Mac gateway. The app stores these values locally on the device. +The Mac must remain awake and online, and both the CodePilot gateway and Cloudflare Tunnel must keep running, for the iPhone app to stay connected. The current beta does not provide a hosted relay or remote wake feature. + For the public beta, enter the Cloudflare Tunnel URL. The Mac gateway listens on `127.0.0.1:18790` by default, which is only reachable from the Mac itself. Same Network setup is disabled until CodePilot provides an explicit LAN-binding mode with firewall and trust guidance. The gateway URL must include `http://` or `https://`. @@ -35,3 +37,5 @@ The iOS app can register for turn-finished notifications. APNs certificates or k ## File Uploads Files selected in the iOS app are uploaded to the Mac gateway and saved under the CodePilot state directory. Image attachments can be passed into Codex turns when supported by the current runner. + +Uploads are not removed automatically after a turn. Delete files you no longer need from the Mac, and review the [privacy data-flow summary](PRIVACY.md#beta-data-flow-at-a-glance) before sharing sensitive attachments. diff --git a/docs/index.md b/docs/index.md index c3779df0..27668211 100644 --- a/docs/index.md +++ b/docs/index.md @@ -42,6 +42,7 @@ Use the structured templates so reports include the failing step and visible rec ## Before You Install - Use a Mac you control and keep the gateway bearer token private. +- Keep that Mac awake and online, with the CodePilot gateway and Cloudflare Tunnel running, while using the iPhone companion. - Review the [privacy](PRIVACY.md) and [security](SECURITY.md) guidance before exposing the gateway through Cloudflare Tunnel. - Expect beta limitations and recovery work. CodePilot does not replace Codex CLI or provide a hosted CodePilot account service. - Sanitize logs and screenshots before opening a public issue. diff --git a/ops/agents/escalations/presence-maintenance.md b/ops/agents/escalations/presence-maintenance.md index f7ef9975..7ba34f3e 100644 --- a/ops/agents/escalations/presence-maintenance.md +++ b/ops/agents/escalations/presence-maintenance.md @@ -12,7 +12,7 @@ The following public-publishing decisions are approved: ## Pending Maintainer Action -The 2026-07-17 public repository review found two launch-readiness settings that require maintainer access: +Reverified on 2026-07-18. The public repository review found two launch-readiness settings that require maintainer access and one unresolved release blocker: 1. Enable GitHub Pages from the approved `main` branch `docs/` folder, verify the site, and add its URL to the repository website field. The Pages endpoint and repository website field are currently unset. 2. Enable GitHub private vulnerability reporting, then link the private reporting form from `docs/SECURITY.md` and the security issue-template contact link. Private vulnerability reporting is currently disabled, so public copy must not imply that a secure reporting channel exists. From 879501e723222686719d68f6abc70a7f562ee250 Mon Sep 17 00:00:00 2001 From: CodePilot Date: Sat, 18 Jul 2026 06:03:50 +0200 Subject: [PATCH 28/44] docs: clarify optional notification delivery --- README.md | 4 ++-- docs/APP_STORE_METADATA_DRAFT.md | 8 ++++---- docs/CHANGELOG.md | 1 + docs/FAQ.md | 4 ++++ docs/PRIVACY.md | 2 +- docs/index.md | 2 +- 6 files changed, 13 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index ff613c1d..7aa28c10 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ CodePilot is a Mac menu bar app, local gateway, and iPhone companion for AI coding users who already run Codex CLI on a Mac they control. -The public beta focuses on Codex account switching, usage visibility, remote iPhone access through a user-owned Cloudflare Tunnel, file uploads, connector status, notifications, and gateway-backed conversation control. The project is designed to become provider-neutral over time, but the first beta is Codex-focused. +The public beta focuses on Codex account switching, usage visibility, remote iPhone access through a user-owned Cloudflare Tunnel, file uploads, connector status, optional notifications, and gateway-backed conversation control. The project is designed to become provider-neutral over time, but the first beta is Codex-focused. ## License @@ -94,7 +94,7 @@ Remove gateway URLs, tokens, hostnames, account names, local paths, private prom - Conversation steering and stop-turn controls where supported. - Thread pinning, renaming, deletion, and project grouping. - Connector/plugin status visibility. -- Turn-finished notifications. +- Turn-finished notifications when APNs is configured for the gateway. - Gateway-backed auth refresh flows. ## Screenshots diff --git a/docs/APP_STORE_METADATA_DRAFT.md b/docs/APP_STORE_METADATA_DRAFT.md index 60076067..ef18e106 100644 --- a/docs/APP_STORE_METADATA_DRAFT.md +++ b/docs/APP_STORE_METADATA_DRAFT.md @@ -12,15 +12,15 @@ Codex companion for your Mac ## Promotional Text -Public beta for Codex CLI users who want iPhone access to thread status, file uploads, turn controls, notifications, and coding-agent sessions on their own Mac. +Public beta for Codex CLI users who want iPhone access to thread status, file uploads, turn controls, and coding-agent sessions on their own Mac. -Character count: 160 of 170. +Character count: 145 of 170. ## Description CodePilot is a Mac menu bar app, local gateway, and iPhone companion for AI coding users who already run Codex CLI on a Mac. -Use the iPhone app to check active account status, follow threads, upload files, steer or stop supported turns, receive turn-finished notifications, and connect through your own Cloudflare Tunnel setup. The Mac stays in your control, and the current beta does not require a hosted CodePilot account service. +Use the iPhone app to check active account status, follow threads, upload files, steer or stop supported turns, receive optional turn-finished notifications, and connect through your own Cloudflare Tunnel setup. The Mac stays in your control, and the current beta does not require a hosted CodePilot account service. The beta is focused on setup clarity, connection reliability, privacy-safe diagnostics, and practical remote workflows for existing Codex CLI users. Some internals still use Codex-specific names while the public CodePilot product surface is prepared for broader provider support later. @@ -34,7 +34,7 @@ Character count: 88 of 100. ## What To Test -Install CodePilot on a Mac that already runs Codex CLI, create a saved account profile, start the gateway, connect the iPhone app with the gateway URL and token, and verify thread visibility, file upload, turn control, notifications, and setup recovery messages. +Install CodePilot on a Mac that already runs Codex CLI, create a saved account profile, start the gateway, connect the iPhone app with the gateway URL and token, and verify thread visibility, file upload, turn control, and setup recovery messages. If APNs is configured for the gateway, also verify turn-finished notifications. Please report whether Cloudflare Tunnel setup, gateway connection, or token entry was the step that failed. Remove account names, gateway URLs, tokens, hostnames, local paths, private prompts, screenshots, and logs containing private data before sharing feedback. diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index b3206998..e7148bc4 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -37,6 +37,7 @@ - Added a public beta data-flow map showing what stays on the Mac and what can be processed by Codex, OpenAI, Cloudflare, or Apple. - Clarified that iPhone access depends on an awake, online Mac running the gateway and Cloudflare Tunnel, with no hosted relay or remote wake promise in the current beta. - Added FAQ and installation guidance for upload retention and safe account switching during active turns. +- Clarified that notifications are optional, require gateway APNs configuration for background delivery, and use iOS controls separate from Live Activities. ### Recent Product Work diff --git a/docs/FAQ.md b/docs/FAQ.md index 2cef0dd9..c44030ca 100644 --- a/docs/FAQ.md +++ b/docs/FAQ.md @@ -36,6 +36,10 @@ Uploads pass through your Cloudflare Tunnel and are saved under the CodePilot st Automatic switching waits for active turns to finish. Avoid manually changing Codex auth files while turns are running; use CodePilot's account controls so a new profile is applied safely to later turns. +## Are notifications required? + +No. Turn-finished notifications and Live Activities are optional. Background delivery requires APNs to be configured for the gateway, and notification permission and Live Activities are separate iOS controls. + ## Is Remote Desktop included in the public beta? No. Remote Desktop remains outside the supported public beta while its device-pairing and session-authorization enforcement is being completed and independently verified. Do not enable it in beta builds yet. diff --git a/docs/PRIVACY.md b/docs/PRIVACY.md index 27c8746d..f35e36c7 100644 --- a/docs/PRIVACY.md +++ b/docs/PRIVACY.md @@ -65,7 +65,7 @@ The repository beta does not require a CodePilot-operated analytics or account s - Cloudflare processes tunneled gateway traffic and connection metadata when you use the supported remote iPhone path. - Apple Push Notification service processes device tokens and notification or Live Activity payloads when those features are enabled. -Review the settings and policies for each service you enable. Disabling notifications stops new CodePilot notification and Live Activity delivery, but it does not remove data already retained by Codex, OpenAI, Cloudflare, Apple, or the local Mac state. +Review the settings and policies for each service you enable. Notification permission and Live Activities are separate iOS controls; turn off each feature separately if you do not want its content displayed. These changes do not remove data already retained by Codex, OpenAI, Cloudflare, Apple, or the local Mac state. ## Remote Desktop diff --git a/docs/index.md b/docs/index.md index 27668211..c677b861 100644 --- a/docs/index.md +++ b/docs/index.md @@ -9,7 +9,7 @@ The beta is focused on practical workflows for AI coding users: - See active Codex usage, reset timing, available reset credits, and account status from the Mac and iPhone. - Switch saved Codex account profiles after active turns finish. - Connect the iPhone app to the Mac gateway through a user-owned Cloudflare Tunnel during the public beta. -- Upload files, inspect threads, steer or stop turns where supported, and receive turn-finished notifications. +- Upload files, inspect threads, steer or stop turns where supported, and receive turn-finished notifications when APNs is configured for the gateway. ## Beta Access From 4d7c4126bd2ca3bf37de7ba44531835a129cfb25 Mon Sep 17 00:00:00 2001 From: CodePilot Date: Sat, 18 Jul 2026 06:52:09 +0200 Subject: [PATCH 29/44] docs: track public repository settings --- ops/agents/escalations/presence-maintenance.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ops/agents/escalations/presence-maintenance.md b/ops/agents/escalations/presence-maintenance.md index 7ba34f3e..5d775d06 100644 --- a/ops/agents/escalations/presence-maintenance.md +++ b/ops/agents/escalations/presence-maintenance.md @@ -14,6 +14,8 @@ The following public-publishing decisions are approved: Reverified on 2026-07-18. The public repository review found two launch-readiness settings that require maintainer access and one unresolved release blocker: +Repository-setting follow-up is tracked in GitHub issue #27. + 1. Enable GitHub Pages from the approved `main` branch `docs/` folder, verify the site, and add its URL to the repository website field. The Pages endpoint and repository website field are currently unset. 2. Enable GitHub private vulnerability reporting, then link the private reporting form from `docs/SECURITY.md` and the security issue-template contact link. Private vulnerability reporting is currently disabled, so public copy must not imply that a secure reporting channel exists. 3. Do not approve broader beta promotion while the critical Remote Desktop authorization blocker in GitHub issue #25 remains open. Review a fully tested fix before allowing the feature into public-beta copy or builds; the presence docs now describe it as unavailable. From 1b681f5365e0c0dadbcfe7c927d43d8be5e5a437 Mon Sep 17 00:00:00 2001 From: CodePilot Date: Sat, 18 Jul 2026 07:45:15 +0200 Subject: [PATCH 30/44] docs: keep public beta provider claims scoped --- README.md | 2 +- docs/APP_STORE_METADATA_DRAFT.md | 6 +++--- docs/CHANGELOG.md | 1 + 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 7aa28c10..a1e10639 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ CodePilot is a Mac menu bar app, local gateway, and iPhone companion for AI coding users who already run Codex CLI on a Mac they control. -The public beta focuses on Codex account switching, usage visibility, remote iPhone access through a user-owned Cloudflare Tunnel, file uploads, connector status, optional notifications, and gateway-backed conversation control. The project is designed to become provider-neutral over time, but the first beta is Codex-focused. +The public beta focuses on Codex account switching, usage visibility, remote iPhone access through a user-owned Cloudflare Tunnel, file uploads, connector status, optional notifications, and gateway-backed conversation control. The current beta is Codex-focused; support for other coding agents is not part of the beta promise. ## License diff --git a/docs/APP_STORE_METADATA_DRAFT.md b/docs/APP_STORE_METADATA_DRAFT.md index ef18e106..ca9be36d 100644 --- a/docs/APP_STORE_METADATA_DRAFT.md +++ b/docs/APP_STORE_METADATA_DRAFT.md @@ -12,9 +12,9 @@ Codex companion for your Mac ## Promotional Text -Public beta for Codex CLI users who want iPhone access to thread status, file uploads, turn controls, and coding-agent sessions on their own Mac. +Public beta for Codex CLI users: check usage and threads, upload files, and steer coding sessions running on a Mac you control. -Character count: 145 of 170. +Character count: 127 of 170. ## Description @@ -22,7 +22,7 @@ CodePilot is a Mac menu bar app, local gateway, and iPhone companion for AI codi Use the iPhone app to check active account status, follow threads, upload files, steer or stop supported turns, receive optional turn-finished notifications, and connect through your own Cloudflare Tunnel setup. The Mac stays in your control, and the current beta does not require a hosted CodePilot account service. -The beta is focused on setup clarity, connection reliability, privacy-safe diagnostics, and practical remote workflows for existing Codex CLI users. Some internals still use Codex-specific names while the public CodePilot product surface is prepared for broader provider support later. +The beta is focused on setup clarity, connection reliability, privacy-safe diagnostics, and practical remote workflows for existing Codex CLI users. Some internals still use legacy Codex-specific names, and support for other coding agents is not part of the current beta. CodePilot handles local coding-agent credentials and gateway access. Coding prompts and selected attachments are still processed through Codex and OpenAI according to the user's Codex account and configuration. Review the privacy, security, install, and support docs before exposing the gateway outside your local network. diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index e7148bc4..14956444 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -38,6 +38,7 @@ - Clarified that iPhone access depends on an awake, online Mac running the gateway and Cloudflare Tunnel, with no hosted relay or remote wake promise in the current beta. - Added FAQ and installation guidance for upload retention and safe account switching during active turns. - Clarified that notifications are optional, require gateway APNs configuration for background delivery, and use iOS controls separate from Live Activities. +- Removed implied future-provider promises from public copy and focused the App Store promotional draft on current Codex CLI beta workflows. ### Recent Product Work From e92754b15efac5198b6c73455e8cd2a62f913938 Mon Sep 17 00:00:00 2001 From: CodePilot Date: Sat, 18 Jul 2026 08:50:03 +0200 Subject: [PATCH 31/44] docs: align repository beta summary --- docs/CHANGELOG.md | 1 + docs/PUBLIC_PRESENCE_CHECKLIST.md | 1 + ops/agents/escalations/presence-maintenance.md | 7 ++++--- 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index 14956444..68ae6e4a 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -39,6 +39,7 @@ - Added FAQ and installation guidance for upload retention and safe account switching during active turns. - Clarified that notifications are optional, require gateway APNs configuration for background delivery, and use iOS controls separate from Live Activities. - Removed implied future-provider promises from public copy and focused the App Store promotional draft on current Codex CLI beta workflows. +- Added beta-focused repository description guidance so the GitHub header matches the approved audience and release status. ### Recent Product Work diff --git a/docs/PUBLIC_PRESENCE_CHECKLIST.md b/docs/PUBLIC_PRESENCE_CHECKLIST.md index 1773398a..0425b394 100644 --- a/docs/PUBLIC_PRESENCE_CHECKLIST.md +++ b/docs/PUBLIC_PRESENCE_CHECKLIST.md @@ -49,5 +49,6 @@ Maintainer approval is required before publishing or submitting: - Confirm GitHub Pages is enabled from the approved `main` branch `docs/` source and the site returns successfully. - Add the live Pages URL to the repository website field and resolve the App Store support and privacy URL drafts to live pages. +- Keep the repository description beta-focused and specific to the current audience. Recommended copy: `Public beta Mac and iPhone companion for Codex CLI workflows.` - Confirm a private security-reporting channel is enabled and linked from `SECURITY.md` before broader beta promotion. - Keep sensitive vulnerability details out of public issues, even when asking for private coordination. diff --git a/ops/agents/escalations/presence-maintenance.md b/ops/agents/escalations/presence-maintenance.md index 5d775d06..4bbac6d0 100644 --- a/ops/agents/escalations/presence-maintenance.md +++ b/ops/agents/escalations/presence-maintenance.md @@ -12,12 +12,13 @@ The following public-publishing decisions are approved: ## Pending Maintainer Action -Reverified on 2026-07-18. The public repository review found two launch-readiness settings that require maintainer access and one unresolved release blocker: +Reverified on 2026-07-18. The public repository review found three launch-readiness settings that require maintainer access and one unresolved release blocker: Repository-setting follow-up is tracked in GitHub issue #27. 1. Enable GitHub Pages from the approved `main` branch `docs/` folder, verify the site, and add its URL to the repository website field. The Pages endpoint and repository website field are currently unset. -2. Enable GitHub private vulnerability reporting, then link the private reporting form from `docs/SECURITY.md` and the security issue-template contact link. Private vulnerability reporting is currently disabled, so public copy must not imply that a secure reporting channel exists. -3. Do not approve broader beta promotion while the critical Remote Desktop authorization blocker in GitHub issue #25 remains open. Review a fully tested fix before allowing the feature into public-beta copy or builds; the presence docs now describe it as unavailable. +2. Update the repository description so the public header identifies the current release as a beta. Recommended copy: `Public beta Mac and iPhone companion for Codex CLI workflows.` +3. Enable GitHub private vulnerability reporting, then link the private reporting form from `docs/SECURITY.md` and the security issue-template contact link. Private vulnerability reporting is currently disabled, so public copy must not imply that a secure reporting channel exists. +4. Do not approve broader beta promotion while the critical Remote Desktop authorization blocker in GitHub issue #25 remains open. Review a fully tested fix before allowing the feature into public-beta copy or builds; the presence docs now describe it as unavailable. These settings should be completed before broader public-beta promotion. No release, App Store, pricing, legal, credential, or external-system change is authorized by this note. From 3e16d694758ff5a22f11096f1a2d58d566ea69b8 Mon Sep 17 00:00:00 2001 From: CodePilot Date: Sat, 18 Jul 2026 09:46:03 +0200 Subject: [PATCH 32/44] docs: add beta upload and notification recovery --- docs/CHANGELOG.md | 2 ++ docs/FAQ.md | 4 ++++ docs/INSTALL_IOS.md | 4 ++++ docs/TROUBLESHOOTING.md | 19 +++++++++++++++++++ 4 files changed, 29 insertions(+) diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index 68ae6e4a..6ae24a13 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -40,6 +40,8 @@ - Clarified that notifications are optional, require gateway APNs configuration for background delivery, and use iOS controls separate from Live Activities. - Removed implied future-provider promises from public copy and focused the App Store promotional draft on current Codex CLI beta workflows. - Added beta-focused repository description guidance so the GitHub header matches the approved audience and release status. +- Documented the iPhone attachment count and size limits so beta users can recover from rejected uploads without sharing private files. +- Added notification and file-upload recovery checklists to the public iPhone, FAQ, and troubleshooting guidance. ### Recent Product Work diff --git a/docs/FAQ.md b/docs/FAQ.md index c44030ca..c4d5b78d 100644 --- a/docs/FAQ.md +++ b/docs/FAQ.md @@ -32,6 +32,8 @@ Yes. The CodePilot gateway, Codex CLI, and Cloudflare Tunnel run from your Mac. Uploads pass through your Cloudflare Tunnel and are saved under the CodePilot state directory on the Mac. They are not removed automatically after a turn. Delete files you no longer need, and remember that a selected attachment can be sent to Codex and OpenAI when you use it in a turn. See [Privacy](PRIVACY.md) for the full beta data flow. +One turn can include up to eight attachments, with a 25 MB limit per file and a 50 MB combined limit. These are request limits, not an automatic cleanup policy. + ## Can CodePilot switch accounts while a turn is running? Automatic switching waits for active turns to finish. Avoid manually changing Codex auth files while turns are running; use CodePilot's account controls so a new profile is applied safely to later turns. @@ -40,6 +42,8 @@ Automatic switching waits for active turns to finish. Avoid manually changing Co No. Turn-finished notifications and Live Activities are optional. Background delivery requires APNs to be configured for the gateway, and notification permission and Live Activities are separate iOS controls. +If notifications do not arrive, confirm notification permission is enabled for CodePilot, the Mac gateway and Cloudflare Tunnel are still reachable, and APNs is configured for the gateway. See [Troubleshooting](TROUBLESHOOTING.md#turn-finished-notifications-do-not-arrive). + ## Is Remote Desktop included in the public beta? No. Remote Desktop remains outside the supported public beta while its device-pairing and session-authorization enforcement is being completed and independently verified. Do not enable it in beta builds yet. diff --git a/docs/INSTALL_IOS.md b/docs/INSTALL_IOS.md index b07755f0..8dd78b17 100644 --- a/docs/INSTALL_IOS.md +++ b/docs/INSTALL_IOS.md @@ -34,8 +34,12 @@ The gateway URL must include `http://` or `https://`. The iOS app can register for turn-finished notifications. APNs certificates or keys must be configured in the gateway environment before background notifications can be delivered reliably. +Notification permission and Live Activities are separate iOS settings. Enable only the features you want, and see [Troubleshooting](TROUBLESHOOTING.md#turn-finished-notifications-do-not-arrive) if a completed turn does not produce a notification. + ## File Uploads Files selected in the iOS app are uploaded to the Mac gateway and saved under the CodePilot state directory. Image attachments can be passed into Codex turns when supported by the current runner. +One turn can include up to eight attachments, with a 25 MB limit per file and a 50 MB combined limit. If an upload is rejected, reduce the number or size of the selected files and retry. + Uploads are not removed automatically after a turn. Delete files you no longer need from the Mac, and review the [privacy data-flow summary](PRIVACY.md#beta-data-flow-at-a-glance) before sharing sensitive attachments. diff --git a/docs/TROUBLESHOOTING.md b/docs/TROUBLESHOOTING.md index ebbd4465..3ac6cb25 100644 --- a/docs/TROUBLESHOOTING.md +++ b/docs/TROUBLESHOOTING.md @@ -36,6 +36,25 @@ Use **Force Restart Gateway...** only when the gateway is stuck and interrupting Pull to refresh the thread list. If a live stream was interrupted, open the thread again after the turn finishes so saved messages can reload from the Mac gateway. +## File Upload Is Rejected + +Confirm the iPhone can still load threads from the Mac gateway, then retry with a smaller selection. One turn can include up to eight attachments, with a 25 MB limit per file and a 50 MB combined limit. + +Uploads that succeed remain under the CodePilot state directory on the Mac until you delete them. Do not attach the original private file or an unsanitized gateway response to a public issue. If the same sanitized sample file still fails, report the visible recovery message and the file's approximate size and type. + +## Turn-Finished Notifications Do Not Arrive + +Check each part of the optional notification path: + +1. In iOS Settings, confirm notifications are allowed for CodePilot. +2. Confirm the Mac is awake and online and that the CodePilot gateway and Cloudflare Tunnel are running. +3. Confirm the iPhone can still load threads using the saved gateway URL and token. +4. For background delivery, confirm APNs is configured in the gateway environment. + +Live Activities use a separate iOS control. Enabling notifications does not automatically enable Live Activities, and disabling one does not disable the other. + +If delivery still fails, report whether it fails only in the background or also while CodePilot is open. Share only sanitized recovery text; notification registration details and device tokens are private. + ## Remote Desktop Is Unavailable Remote Desktop is not part of the supported public beta while its device-pairing and session-authorization enforcement is being completed and independently verified. Do not work around this restriction or enable the feature in beta builds. From e49f189e37436b5ae7c448ea473ca9c88cfe67d7 Mon Sep 17 00:00:00 2001 From: CodePilot Date: Sat, 18 Jul 2026 10:38:15 +0200 Subject: [PATCH 33/44] docs: flag public terms approval gap --- ops/agents/escalations/presence-maintenance.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ops/agents/escalations/presence-maintenance.md b/ops/agents/escalations/presence-maintenance.md index 4bbac6d0..feb4f469 100644 --- a/ops/agents/escalations/presence-maintenance.md +++ b/ops/agents/escalations/presence-maintenance.md @@ -12,7 +12,7 @@ The following public-publishing decisions are approved: ## Pending Maintainer Action -Reverified on 2026-07-18. The public repository review found three launch-readiness settings that require maintainer access and one unresolved release blocker: +Reverified on 2026-07-18. The public repository review found three launch-readiness settings that require maintainer access, one legal-content decision, and one unresolved release blocker: Repository-setting follow-up is tracked in GitHub issue #27. @@ -20,5 +20,6 @@ Repository-setting follow-up is tracked in GitHub issue #27. 2. Update the repository description so the public header identifies the current release as a beta. Recommended copy: `Public beta Mac and iPhone companion for Codex CLI workflows.` 3. Enable GitHub private vulnerability reporting, then link the private reporting form from `docs/SECURITY.md` and the security issue-template contact link. Private vulnerability reporting is currently disabled, so public copy must not imply that a secure reporting channel exists. 4. Do not approve broader beta promotion while the critical Remote Desktop authorization blocker in GitHub issue #25 remains open. Review a fully tested fix before allowing the feature into public-beta copy or builds; the presence docs now describe it as unavailable. +5. Decide whether the source-distributed beta needs standalone public terms in addition to the repository license files, and approve any legal text before it is added. The launch plan lists terms as a Presence Agent deliverable, but the existing approval covers privacy copy and App Store metadata only. These settings should be completed before broader public-beta promotion. No release, App Store, pricing, legal, credential, or external-system change is authorized by this note. From 00a41b1f9c04bd31fa16096f0cd1a9e1c976882c Mon Sep 17 00:00:00 2001 From: CodePilot Date: Sat, 18 Jul 2026 11:38:34 +0200 Subject: [PATCH 34/44] docs: align public metadata URLs --- docs/CHANGELOG.md | 1 + ios/CodexPhone/fastlane/Fastfile | 4 ++-- scripts/privacy-audit.sh | 6 ++++++ 3 files changed, 9 insertions(+), 2 deletions(-) diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index 6ae24a13..54cd51f8 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -42,6 +42,7 @@ - Added beta-focused repository description guidance so the GitHub header matches the approved audience and release status. - Documented the iPhone attachment count and size limits so beta users can recover from rejected uploads without sharing private files. - Added notification and file-upload recovery checklists to the public iPhone, FAQ, and troubleshooting guidance. +- Aligned Fastlane's default privacy and marketing URLs with the canonical lowercase public repository path and the prepared GitHub Pages privacy page. ### Recent Product Work diff --git a/ios/CodexPhone/fastlane/Fastfile b/ios/CodexPhone/fastlane/Fastfile index 56af5c5f..4c46f03b 100644 --- a/ios/CodexPhone/fastlane/Fastfile +++ b/ios/CodexPhone/fastlane/Fastfile @@ -82,8 +82,8 @@ platform :ios do "default" => { feedback_email: codex_phone_feedback_email, description: codex_phone_beta_description, - privacy_policy_url: ENV.fetch("APP_PRIVACY_POLICY_URL"), - marketing_url: ENV.fetch("APP_MARKETING_URL", "https://github.com/codepilotios/CodePilot") + privacy_policy_url: ENV.fetch("APP_PRIVACY_POLICY_URL", "https://codepilotios.github.io/codepilot/PRIVACY.html"), + marketing_url: ENV.fetch("APP_MARKETING_URL", "https://github.com/codepilotios/codepilot") } } end diff --git a/scripts/privacy-audit.sh b/scripts/privacy-audit.sh index 6b66112a..0a602d81 100755 --- a/scripts/privacy-audit.sh +++ b/scripts/privacy-audit.sh @@ -66,4 +66,10 @@ if LC_ALL=C grep -nI -E "$secret_pattern" -- "${audit_files[@]}"; then exit 1 fi +noncanonical_public_url_pattern='https://(codepilotios\.github\.io|github\.com/codepilotios)/CodePilot' +if git grep -n -I -E "$noncanonical_public_url_pattern" -- "${audit_files[@]}"; then + echo "privacy audit failed: tracked files contain noncanonical public CodePilot URLs" >&2 + exit 1 +fi + echo "privacy audit passed" From af7ceec6ebf054fd37fe14debb5fc322dd54e434 Mon Sep 17 00:00:00 2001 From: CodePilot Date: Sat, 18 Jul 2026 12:36:27 +0200 Subject: [PATCH 35/44] docs: add safe beta update guidance --- docs/CHANGELOG.md | 1 + docs/FAQ.md | 6 ++++++ docs/INSTALL_MAC.md | 15 +++++++++++++++ 3 files changed, 22 insertions(+) diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index 54cd51f8..a90a87b4 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -43,6 +43,7 @@ - Documented the iPhone attachment count and size limits so beta users can recover from rejected uploads without sharing private files. - Added notification and file-upload recovery checklists to the public iPhone, FAQ, and troubleshooting guidance. - Aligned Fastlane's default privacy and marketing URLs with the canonical lowercase public repository path and the prepared GitHub Pages privacy page. +- Added a safe source-build update path that preserves active turns and separates Mac updates from approved iPhone beta distribution. ### Recent Product Work diff --git a/docs/FAQ.md b/docs/FAQ.md index c4d5b78d..5a72ba4b 100644 --- a/docs/FAQ.md +++ b/docs/FAQ.md @@ -8,6 +8,12 @@ CodePilot is for AI coding users who already run Codex CLI on a Mac and want an The Mac app currently builds from source on macOS 13 or later using the repository installation guide. The iPhone companion requires iOS 17 or later and access to an approved beta build; CodePilot does not yet advertise a public TestFlight invitation or App Store download. +## How do I update the beta? + +For the Mac source build, finish active turns, pull the latest approved branch, rebuild the app, and rerun the menu bar and gateway installers. The gateway installer waits rather than interrupting an active phone turn. Follow the [Mac update steps](INSTALL_MAC.md#update-a-source-build) and review the [changelog](CHANGELOG.md) for setup changes. + +Install iPhone updates only through the approved beta distribution channel you already use. This repository does not advertise a public TestFlight invitation or App Store download yet. + ## Is CodePilot ready for production teams? No. The current release track is a public beta. Use it on a trusted Mac, expect rough edges, and review the security and privacy docs before exposing the gateway outside your local network. diff --git a/docs/INSTALL_MAC.md b/docs/INSTALL_MAC.md index c9aaf580..f794b5c1 100644 --- a/docs/INSTALL_MAC.md +++ b/docs/INSTALL_MAC.md @@ -26,6 +26,21 @@ scripts/build-app.sh open "build/CodePilot.app" ``` +## Update A Source Build + +Finish active turns, then update the checkout and rebuild: + +```sh +git pull --ff-only +scripts/build-app.sh +scripts/install-switcher-agent.sh +scripts/install-phone-gateway-agent.sh +``` + +The gateway installer defers its restart if it detects an active phone turn. If that happens, let the turn finish and run the gateway installer again. Do not force a restart just to apply a routine update. + +If the update changes setup requirements, review the latest [changelog](CHANGELOG.md) and rerun the relevant setup step before reconnecting the iPhone app. + ## Start At Login The existing helper installs a LaunchAgent for the menu bar app: From 1cfafe8819372652ac1796ee4a0a31d167415626 Mon Sep 17 00:00:00 2001 From: CodePilot Date: Sat, 18 Jul 2026 14:18:50 +0200 Subject: [PATCH 36/44] docs: disclose localhost preview data flow --- .github/ISSUE_TEMPLATE/bug_report.md | 4 +++- README.md | 3 ++- docs/APP_STORE_METADATA_DRAFT.md | 6 +++--- docs/BETA_FEEDBACK.md | 5 +++-- docs/CHANGELOG.md | 1 + docs/FAQ.md | 6 ++++++ docs/PRIVACY.md | 7 +++++++ docs/PUBLIC_PRESENCE_CHECKLIST.md | 2 +- docs/SCREENSHOTS.md | 2 ++ docs/SECURITY.md | 6 ++++++ docs/SUPPORT.md | 5 +++-- docs/index.md | 1 + 12 files changed, 38 insertions(+), 10 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md index 917675d6..58d000db 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.md +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -17,6 +17,7 @@ assignees: "" - [ ] Connector/plugin status - [ ] Remote Desktop availability guard (feature appeared or could be enabled) - [ ] File upload +- [ ] Localhost link opening - [ ] Notifications - [ ] Documentation @@ -36,6 +37,7 @@ Check the closest match: - [ ] Thread loading - [ ] Usage or connector status - [ ] File upload +- [ ] Localhost link opening - [ ] Steering or stop-turn control - [ ] Notification delivery - [ ] Remote Desktop appeared or could be enabled @@ -64,6 +66,6 @@ Paste the visible recovery message or status text, with private values removed. Attach only sanitized logs or screenshots when they materially help reproduce the issue. -Do not include Codex auth files, gateway bearer tokens, private hostnames, tunnel URLs, personal account names, email addresses, Apple identifiers, local file paths, private prompts, uploaded files, repository names, or live desktop contents. +Do not include Codex auth files, gateway bearer tokens, private hostnames, tunnel URLs, localhost or local-web session URLs, local page contents, personal account names, email addresses, Apple identifiers, local file paths, private prompts, uploaded files, repository names, or live desktop contents. Remote Desktop is outside the supported public beta. Report only if it appears or can be enabled; do not test its routes or attach desktop captures. diff --git a/README.md b/README.md index a1e10639..648bf420 100644 --- a/README.md +++ b/README.md @@ -82,7 +82,7 @@ See: - [Report a beta bug](https://github.com/codepilotios/codepilot/issues/new?template=bug_report.md) - [Request a beta improvement](https://github.com/codepilotios/codepilot/issues/new?template=feature_request.md) -Remove gateway URLs, tokens, hostnames, account names, local paths, private prompts, uploaded files, and unsanitized screenshots before submitting. For security-sensitive findings, read the [security reporting guidance](docs/SECURITY.md) first and do not post sensitive evidence publicly. +Remove gateway URLs, tokens, hostnames, localhost or local-web session URLs, local page contents, account names, local paths, private prompts, uploaded files, and unsanitized screenshots before submitting. For security-sensitive findings, read the [security reporting guidance](docs/SECURITY.md) first and do not post sensitive evidence publicly. ## Features @@ -92,6 +92,7 @@ Remove gateway URLs, tokens, hostnames, account names, local paths, private prom - Global iOS credit progress indicator. - iOS remote chat and file upload. - Conversation steering and stop-turn controls where supported. +- In-app opening of `localhost`, `127.0.0.1`, and `::1` web links through the authenticated Mac gateway. - Thread pinning, renaming, deletion, and project grouping. - Connector/plugin status visibility. - Turn-finished notifications when APNs is configured for the gateway. diff --git a/docs/APP_STORE_METADATA_DRAFT.md b/docs/APP_STORE_METADATA_DRAFT.md index ca9be36d..3593fa60 100644 --- a/docs/APP_STORE_METADATA_DRAFT.md +++ b/docs/APP_STORE_METADATA_DRAFT.md @@ -20,7 +20,7 @@ Character count: 127 of 170. CodePilot is a Mac menu bar app, local gateway, and iPhone companion for AI coding users who already run Codex CLI on a Mac. -Use the iPhone app to check active account status, follow threads, upload files, steer or stop supported turns, receive optional turn-finished notifications, and connect through your own Cloudflare Tunnel setup. The Mac stays in your control, and the current beta does not require a hosted CodePilot account service. +Use the iPhone app to check active account status, follow threads, upload files, open loopback web previews, steer or stop supported turns, receive optional turn-finished notifications, and connect through your own Cloudflare Tunnel setup. The Mac stays in your control, and the current beta does not require a hosted CodePilot account service. The beta is focused on setup clarity, connection reliability, privacy-safe diagnostics, and practical remote workflows for existing Codex CLI users. Some internals still use legacy Codex-specific names, and support for other coding agents is not part of the current beta. @@ -34,9 +34,9 @@ Character count: 88 of 100. ## What To Test -Install CodePilot on a Mac that already runs Codex CLI, create a saved account profile, start the gateway, connect the iPhone app with the gateway URL and token, and verify thread visibility, file upload, turn control, and setup recovery messages. If APNs is configured for the gateway, also verify turn-finished notifications. +Install CodePilot on a Mac that already runs Codex CLI, create a saved account profile, start the gateway, connect the iPhone app with the gateway URL and token, and verify thread visibility, file upload, turn control, and setup recovery messages. Open a purpose-built demo page from a loopback link and confirm it appears in the in-app browser without exposing development data. If APNs is configured for the gateway, also verify turn-finished notifications. -Please report whether Cloudflare Tunnel setup, gateway connection, or token entry was the step that failed. Remove account names, gateway URLs, tokens, hostnames, local paths, private prompts, screenshots, and logs containing private data before sharing feedback. +Please report whether Cloudflare Tunnel setup, gateway connection, token entry, or localhost link opening was the step that failed. Remove account names, gateway URLs, tokens, hostnames, localhost or local-web session URLs, local page contents, local paths, private prompts, screenshots, and logs containing private data before sharing feedback. ## Support URL diff --git a/docs/BETA_FEEDBACK.md b/docs/BETA_FEEDBACK.md index c252b999..dfeeb01f 100644 --- a/docs/BETA_FEEDBACK.md +++ b/docs/BETA_FEEDBACK.md @@ -6,11 +6,11 @@ CodePilot public beta feedback is most useful when it helps reproduce a real Cod Include: -- The area affected: Mac app, iPhone app, gateway, Cloudflare setup, account switching, usage status, connector/plugin status, file upload, notifications, docs, or the Remote Desktop availability guard. +- The area affected: Mac app, iPhone app, gateway, Cloudflare setup, account switching, usage status, connector/plugin status, file upload, localhost link opening, notifications, docs, or the Remote Desktop availability guard. - What you were trying to do. - What happened instead. - The visible recovery message or status text. -- Whether the failing step was setup, Cloudflare Tunnel, gateway connection, token entry, thread loading, usage or connector status, upload, notification delivery, turn control, or an unavailable feature appearing unexpectedly. +- Whether the failing step was setup, Cloudflare Tunnel, gateway connection, token entry, thread loading, usage or connector status, upload, localhost link opening, notification delivery, turn control, or an unavailable feature appearing unexpectedly. - macOS version, iOS version, CodePilot build or commit, and Codex CLI version when available. - Sanitized logs or screenshots only when they make the issue clearer. @@ -30,6 +30,7 @@ Remove these before opening an issue or attaching screenshots: - Codex auth files, gateway bearer tokens, and Cloudflare tunnel URLs. - Private hostnames, account names, personal names, email addresses, Apple identifiers, and team identifiers. - Local file paths, private repository names, uploaded files, private prompts, thread names, and live desktop contents. +- Localhost or local-web session URLs, local page contents, and local web screenshots. - Logs containing any of the above. For security-sensitive reports, follow [Security](SECURITY.md) and avoid posting exploit details or secrets publicly. diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index a90a87b4..2d1043aa 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -44,6 +44,7 @@ - Added notification and file-upload recovery checklists to the public iPhone, FAQ, and troubleshooting guidance. - Aligned Fastlane's default privacy and marketing URLs with the canonical lowercase public repository path and the prepared GitHub Pages privacy page. - Added a safe source-build update path that preserves active turns and separates Mac updates from approved iPhone beta distribution. +- Documented localhost link opening as a supported beta workflow, including its loopback-only gateway boundary, Cloudflare data flow, privacy guidance, and public-safe reporting and screenshot rules. ### Recent Product Work diff --git a/docs/FAQ.md b/docs/FAQ.md index 5a72ba4b..2d819e18 100644 --- a/docs/FAQ.md +++ b/docs/FAQ.md @@ -40,6 +40,12 @@ Uploads pass through your Cloudflare Tunnel and are saved under the CodePilot st One turn can include up to eight attachments, with a 25 MB limit per file and a 50 MB combined limit. These are request limits, not an automatic cleanup policy. +## Can I open a localhost link from the iPhone app? + +Yes. When Codex output contains an `http` or `https` link for `localhost`, `127.0.0.1`, or `::1`, CodePilot can open it in an in-app browser through the authenticated Mac gateway. The web server must be running on the Mac, and the short-lived local-web session must still be active. + +The page content passes through the Mac gateway and your Cloudflare Tunnel to the iPhone. Treat local dashboards, query strings, and page contents as private, and do not include them in public screenshots or issue reports. CodePilot does not use this workflow to proxy non-loopback websites. + ## Can CodePilot switch accounts while a turn is running? Automatic switching waits for active turns to finish. Avoid manually changing Codex auth files while turns are running; use CodePilot's account controls so a new profile is applied safely to later turns. diff --git a/docs/PRIVACY.md b/docs/PRIVACY.md index f35e36c7..f808dfac 100644 --- a/docs/PRIVACY.md +++ b/docs/PRIVACY.md @@ -14,6 +14,7 @@ CodePilot is not an offline coding tool. When you start or continue a Codex turn | A Codex turn | Gateway state, thread metadata, and local Codex state | Prompts, conversation context, selected attachments, and related service metadata can be sent to Codex and OpenAI. | | The iPhone companion | Gateway settings, uploaded files, and the gateway's copy of notification state | Gateway requests and responses pass through the user-owned Cloudflare Tunnel. | | File upload | The uploaded file is saved under the CodePilot state directory | The file passes through Cloudflare when uploaded from iPhone and can be sent to Codex and OpenAI when selected for a turn. | +| A loopback web link | The local web server and short-lived proxy-session state remain on the Mac | Requested page content, URL paths, and query strings pass through the gateway and Cloudflare Tunnel to the iPhone. | | Notifications or Live Activities | The gateway stores registered device and activity tokens | Apple can process device tokens and the notification or Live Activity payload described below. | CodePilot does not operate an account, analytics, or relay service for the current repository beta. This does not remove the data handling performed by Codex, OpenAI, Cloudflare, or Apple when you enable workflows that use those services. @@ -57,6 +58,12 @@ During the public beta, remote iPhone access uses a user-owned Cloudflare Tunnel Use an HTTPS tunnel URL. CodePilot still requires the gateway bearer token when using Cloudflare Tunnel. Treat temporary TryCloudflare URLs, permanent tunnel hostnames, and the gateway token as private support data. +## Loopback Web Links + +When the iPhone app opens an `http` or `https` link to `localhost`, `127.0.0.1`, or `::1`, the authenticated Mac gateway creates a short-lived proxy session and requests that page from the Mac. Page bodies, URL paths, and query strings then pass through the gateway and the user-owned Cloudflare Tunnel to the iPhone. Local dashboards can contain source code, logs, filenames, prompts, or development data even when the link itself looks generic. + +The local-web workflow accepts only loopback hosts; it is not a general website proxy. Session identifiers expire, response sizes are bounded, and the gateway bearer token is not placed in the proxied page URL. These limits reduce exposure but do not make page contents public-safe. Close sensitive local pages when finished and remove local-web URLs, contents, and screenshots from public reports. + ## External Services The repository beta does not require a CodePilot-operated analytics or account service, but supported workflows can involve other services: diff --git a/docs/PUBLIC_PRESENCE_CHECKLIST.md b/docs/PUBLIC_PRESENCE_CHECKLIST.md index 0425b394..eeffaa99 100644 --- a/docs/PUBLIC_PRESENCE_CHECKLIST.md +++ b/docs/PUBLIC_PRESENCE_CHECKLIST.md @@ -32,7 +32,7 @@ For screenshot, metadata, issue-template, or support-copy changes, also verify: Public support and feedback copy should ask for: -- Affected area: Mac app, iPhone app, gateway, Cloudflare setup, account switching, file upload, notifications, docs, or the Remote Desktop availability guard. +- Affected area: Mac app, iPhone app, gateway, Cloudflare setup, account switching, file upload, localhost link opening, notifications, docs, or the Remote Desktop availability guard. - Failing step and visible recovery message. - macOS version, iOS version, CodePilot build or commit, and Codex CLI version when available. - Sanitized logs or screenshots only when they materially help reproduce the issue. diff --git a/docs/SCREENSHOTS.md b/docs/SCREENSHOTS.md index b0f367df..641bd1fc 100644 --- a/docs/SCREENSHOTS.md +++ b/docs/SCREENSHOTS.md @@ -23,6 +23,7 @@ Recommended beta screenshot set: - iPhone thread list with demo thread names. - iPhone usage and connector/plugin status with demo account names. - File upload confirmation using non-private sample files. +- In-app local web preview from a purpose-built demo page with no source code, logs, paths, query values, or development data. ## Demo Capture Brief @@ -44,6 +45,7 @@ Before committing or attaching an image: - Confirm every visible account, hostname, thread, file, repository, prompt, connector, and notification matches the fictional capture brief. - Confirm no bearer token, auth value, QR payload, local path, Apple identifier, device name, personal service, or private desktop content is visible. - Confirm Remote Desktop is absent from the entire set while it remains outside the supported public beta. +- Confirm any local web preview uses only the purpose-built demo page and reveals no local URL, session URL, source code, logs, paths, or query values. - Write concise alt text that explains the beta workflow without repeating private or hidden values. - Run `scripts/privacy-audit.sh` after adding the image files and their surrounding copy. diff --git a/docs/SECURITY.md b/docs/SECURITY.md index a2050a41..9bd409c4 100644 --- a/docs/SECURITY.md +++ b/docs/SECURITY.md @@ -29,6 +29,12 @@ The gateway health response is intentionally public-safe, but it is still operat CodePilot swaps local provider auth files. It waits for active turns to finish before automatic switching, but users should still avoid manually editing auth files while turns are running. +## Loopback Web Links + +CodePilot can proxy `http` and `https` links for `localhost`, `127.0.0.1`, and `::1` through an authenticated, short-lived gateway session. Non-loopback targets are rejected. Treat local page contents, URL paths, and query strings as private because they pass through the gateway and Cloudflare Tunnel to the iPhone. + +Do not open local admin panels or dashboards containing credentials through this workflow. Do not share local-web session URLs, page contents, or screenshots in public issues. + ## Remote Desktop Remote Desktop is not part of the supported public beta while device-pairing and session-authorization enforcement is being completed and independently verified. Do not enable it in beta builds or expose its routes through a tunnel. diff --git a/docs/SUPPORT.md b/docs/SUPPORT.md index b5e3482a..0e71342a 100644 --- a/docs/SUPPORT.md +++ b/docs/SUPPORT.md @@ -23,10 +23,10 @@ Use the repository bug report template when available. Include: -- The affected area: Mac app, iPhone app, gateway, Cloudflare setup, account switching, usage status, connector/plugin status, file upload, notifications, docs, or the Remote Desktop availability guard. +- The affected area: Mac app, iPhone app, gateway, Cloudflare setup, account switching, usage status, connector/plugin status, file upload, localhost link opening, notifications, docs, or the Remote Desktop availability guard. - What you expected to happen. - What happened instead. -- Whether setup, Cloudflare Tunnel, gateway connection, token entry, thread loading, file upload, notification delivery, turn control, or an unavailable feature appearing unexpectedly is the failing step. +- Whether setup, Cloudflare Tunnel, gateway connection, token entry, thread loading, file upload, localhost link opening, notification delivery, turn control, or an unavailable feature appearing unexpectedly is the failing step. - The visible recovery message, if one appears. - Whether Codex CLI was already working on the Mac before CodePilot setup. - macOS version, iOS version, CodePilot build or commit, and Codex CLI version when available. @@ -39,6 +39,7 @@ Do not include: - Codex auth files. - Gateway bearer tokens. - Private hostnames or Cloudflare tunnel URLs. +- Localhost URLs, local-web session URLs, or private page contents. - Personal account names or email addresses. - Apple account, team, signing, or TestFlight identifiers. - Screenshots that show private files, paths, accounts, tokens, or hosts. diff --git a/docs/index.md b/docs/index.md index c677b861..8301ae12 100644 --- a/docs/index.md +++ b/docs/index.md @@ -10,6 +10,7 @@ The beta is focused on practical workflows for AI coding users: - Switch saved Codex account profiles after active turns finish. - Connect the iPhone app to the Mac gateway through a user-owned Cloudflare Tunnel during the public beta. - Upload files, inspect threads, steer or stop turns where supported, and receive turn-finished notifications when APNs is configured for the gateway. +- Open loopback web links from Codex output in the iPhone app through the authenticated Mac gateway. ## Beta Access From 610aaaa0aed1d5308e99783e389a7a90d6ad0485 Mon Sep 17 00:00:00 2001 From: CodePilot Date: Sat, 18 Jul 2026 17:12:44 +0200 Subject: [PATCH 37/44] docs: avoid future provider promise --- docs/CHANGELOG.md | 1 + docs/FAQ.md | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index 2d1043aa..c88f2b42 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -45,6 +45,7 @@ - Aligned Fastlane's default privacy and marketing URLs with the canonical lowercase public repository path and the prepared GitHub Pages privacy page. - Added a safe source-build update path that preserves active turns and separates Mac updates from approved iPhone beta distribution. - Documented localhost link opening as a supported beta workflow, including its loopback-only gateway boundary, Cloudflare data flow, privacy guidance, and public-safe reporting and screenshot rules. +- Removed the FAQ's implied future-provider promise and stated that the current beta supports Codex CLI only. ### Recent Product Work diff --git a/docs/FAQ.md b/docs/FAQ.md index 2d819e18..083ed829 100644 --- a/docs/FAQ.md +++ b/docs/FAQ.md @@ -24,7 +24,7 @@ No. CodePilot uses Codex on your Mac. The iPhone app talks to the CodePilot gate ## Does it support Claude Code or other coding agents? -Not yet. The name is provider-neutral, but the first beta is Codex-focused. Future provider work should wait until the Codex setup, gateway, and support path are stable. +No. The current beta supports Codex CLI only. CodePilot does not promise support for other coding agents as part of this beta. ## Do I need Cloudflare? From e85125d41e53fb9494d65486fc4828fcc425b48d Mon Sep 17 00:00:00 2001 From: CodePilot Date: Sat, 18 Jul 2026 17:55:41 +0200 Subject: [PATCH 38/44] docs: explain beta data deletion --- README.md | 2 +- docs/CHANGELOG.md | 1 + docs/FAQ.md | 6 ++++++ docs/PRIVACY.md | 10 ++++++++++ docs/index.md | 2 +- 5 files changed, 19 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 648bf420..764560fc 100644 --- a/README.md +++ b/README.md @@ -66,7 +66,7 @@ See: - [Cloudflare Setup](docs/CLOUDFLARE_SETUP.md) - [FAQ](docs/FAQ.md) - [Beta Feedback Guide](docs/BETA_FEEDBACK.md) -- [Privacy and beta data flow](docs/PRIVACY.md#beta-data-flow-at-a-glance) +- [Privacy, beta data flow, and deletion](docs/PRIVACY.md#beta-data-flow-at-a-glance) - [Support](docs/SUPPORT.md) - [Changelog](docs/CHANGELOG.md) - [App Store Metadata Draft](docs/APP_STORE_METADATA_DRAFT.md) diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index c88f2b42..67d0a3d6 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -46,6 +46,7 @@ - Added a safe source-build update path that preserves active turns and separates Mac updates from approved iPhone beta distribution. - Documented localhost link opening as a supported beta workflow, including its loopback-only gateway boundary, Cloudflare data flow, privacy guidance, and public-safe reporting and screenshot rules. - Removed the FAQ's implied future-provider promise and stated that the current beta supports Codex CLI only. +- Added a single retention and deletion summary for local uploads, connection settings, notification state, and data handled separately by enabled providers. ### Recent Product Work diff --git a/docs/FAQ.md b/docs/FAQ.md index 083ed829..89717e5f 100644 --- a/docs/FAQ.md +++ b/docs/FAQ.md @@ -40,6 +40,12 @@ Uploads pass through your Cloudflare Tunnel and are saved under the CodePilot st One turn can include up to eight attachments, with a 25 MB limit per file and a 50 MB combined limit. These are request limits, not an automatic cleanup policy. +## How do I remove beta data? + +Delete unneeded uploads from `~/.codex-account-switcher/phone-uploads/` on the Mac. Other saved profiles, gateway settings, notification registrations, and Live Activity registrations remain in the CodePilot state directory until you remove or replace them. On iPhone, clear or replace the saved gateway URL and token before handing the device to someone else; deleting the app removes its local app container according to iOS behavior. + +Removing local CodePilot data does not delete information retained separately by Codex, OpenAI, Cloudflare, or Apple. See [Privacy](PRIVACY.md#retention-and-deletion) for the full retention and deletion summary, and back up any account profile you still need before removing CodePilot state. + ## Can I open a localhost link from the iPhone app? Yes. When Codex output contains an `http` or `https` link for `localhost`, `127.0.0.1`, or `::1`, CodePilot can open it in an in-app browser through the authenticated Mac gateway. The web server must be running on the Mac, and the short-lived local-web session must still be active. diff --git a/docs/PRIVACY.md b/docs/PRIVACY.md index f808dfac..1e103fdf 100644 --- a/docs/PRIVACY.md +++ b/docs/PRIVACY.md @@ -38,6 +38,16 @@ Do not commit these files, include them in public issues, or show them in screen Uploaded files remain under the CodePilot state directory after a turn finishes. The current beta does not automatically remove them; delete uploads from the Mac when they are no longer needed. +## Retention And Deletion + +CodePilot does not operate a hosted account, analytics, or relay service for the current repository beta, so there is no separate hosted CodePilot copy to request from the project maintainers. Data stored by the beta remains on the Mac or iPhone until you remove it, reset it, or uninstall the relevant app. In particular: + +- Uploaded files remain in `~/.codex-account-switcher/phone-uploads/` until you delete them on the Mac. +- Saved account profiles, gateway configuration, registered notification devices, and Live Activity registrations remain in the CodePilot state directory until you remove or replace them. +- The iPhone app keeps its gateway URL, bearer token, and app preferences in local app storage. Clear or replace the connection values before giving the device to someone else; deleting the app removes its local app container according to iOS behavior. + +Removing CodePilot data does not delete data retained separately by Codex, OpenAI, Cloudflare, or Apple. Use each provider's account and data controls for data processed or retained by that service. Back up any local account profile you still need before removing CodePilot state, and never paste the state files or their contents into a public support request. + ## Mac Gateway The CodePilot gateway runs on your Mac and requires a bearer token. It exposes CodePilot features to trusted clients, including account status, usage status, thread access, file upload, notification registration, and turn controls where supported. diff --git a/docs/index.md b/docs/index.md index 8301ae12..6f4d68bd 100644 --- a/docs/index.md +++ b/docs/index.md @@ -28,7 +28,7 @@ CodePilot is source-available for noncommercial use. It is not OSI open source. - [Troubleshooting](TROUBLESHOOTING.md) - [FAQ](FAQ.md) - [Beta feedback guide](BETA_FEEDBACK.md) -- [Privacy and beta data flow](PRIVACY.md#beta-data-flow-at-a-glance) +- [Privacy, beta data flow, and deletion](PRIVACY.md#beta-data-flow-at-a-glance) - [Security](SECURITY.md) - [Support](SUPPORT.md) - [Changelog](CHANGELOG.md) From f39e85c10f5e0d6bb5682d69460d200fe355b5a8 Mon Sep 17 00:00:00 2001 From: CodePilot Date: Sat, 18 Jul 2026 20:29:01 +0200 Subject: [PATCH 39/44] ci: audit public presence metadata --- .github/workflows/ci.yml | 3 ++ docs/CHANGELOG.md | 1 + docs/PUBLIC_PRESENCE_CHECKLIST.md | 1 + scripts/public-presence-audit.sh | 55 +++++++++++++++++++++++++++++++ 4 files changed, 60 insertions(+) create mode 100755 scripts/public-presence-audit.sh diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7579d614..4c6625da 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,6 +17,9 @@ jobs: - name: Privacy audit run: scripts/privacy-audit.sh + - name: Public presence audit + run: scripts/public-presence-audit.sh + - name: SwiftPM tests run: swift test diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index 67d0a3d6..7a307f0a 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -47,6 +47,7 @@ - Documented localhost link opening as a supported beta workflow, including its loopback-only gateway boundary, Cloudflare data flow, privacy guidance, and public-safe reporting and screenshot rules. - Removed the FAQ's implied future-provider promise and stated that the current beta supports Codex CLI only. - Added a single retention and deletion summary for local uploads, connection settings, notification state, and data handled separately by enabled providers. +- Added an automated public-presence audit for broken relative documentation links and App Store metadata field-count drift. ### Recent Product Work diff --git a/docs/PUBLIC_PRESENCE_CHECKLIST.md b/docs/PUBLIC_PRESENCE_CHECKLIST.md index eeffaa99..7078232e 100644 --- a/docs/PUBLIC_PRESENCE_CHECKLIST.md +++ b/docs/PUBLIC_PRESENCE_CHECKLIST.md @@ -47,6 +47,7 @@ Maintainer approval is required before publishing or submitting: ## Publishing Readiness +- Run `scripts/public-presence-audit.sh` and `scripts/privacy-audit.sh` before committing public-content changes. - Confirm GitHub Pages is enabled from the approved `main` branch `docs/` source and the site returns successfully. - Add the live Pages URL to the repository website field and resolve the App Store support and privacy URL drafts to live pages. - Keep the repository description beta-focused and specific to the current audience. Recommended copy: `Public beta Mac and iPhone companion for Codex CLI workflows.` diff --git a/scripts/public-presence-audit.sh b/scripts/public-presence-audit.sh new file mode 100755 index 00000000..5ff2ef27 --- /dev/null +++ b/scripts/public-presence-audit.sh @@ -0,0 +1,55 @@ +#!/bin/zsh +set -euo pipefail + +ROOT="$(cd "$(dirname "$0")/.." && pwd)" +cd "$ROOT" + +ruby <<'RUBY' +require "pathname" + +markdown_files = ["README.md"] + Dir.glob("docs/**/*.md") + Dir.glob(".github/**/*.md") +missing_links = [] + +markdown_files.each do |file| + File.read(file).scan(/\[[^\]]*\]\(([^)]+)\)/).flatten.each do |target| + target = target.split(/\s+['\"]/).first + next if target.start_with?("http://", "https://", "mailto:", "#") + + relative_path = target.split("#", 2).first + next if relative_path.empty? + + resolved_path = (Pathname(file).dirname + relative_path).cleanpath + missing_links << "#{file}: #{target}" unless resolved_path.exist? + end +end + +unless missing_links.empty? + warn "public presence audit failed: relative Markdown links do not resolve" + missing_links.each { |link| warn " #{link}" } + exit 1 +end + +metadata_path = "docs/APP_STORE_METADATA_DRAFT.md" +metadata = File.read(metadata_path) + +{"Promotional Text" => 170, "Keywords" => 100}.each do |heading, field_limit| + value = metadata[/^## #{Regexp.escape(heading)}\n\n([^\n]+)/, 1] + count_match = metadata.match( + /^## #{Regexp.escape(heading)}\n\n[^\n]+\n\nCharacter count: (\d+) of (\d+)\./ + ) + + unless value && count_match + warn "public presence audit failed: #{heading} or its character count is missing" + exit 1 + end + + declared_count, declared_limit = count_match.captures.map(&:to_i) + if value.length != declared_count || declared_limit != field_limit || value.length > field_limit + warn "public presence audit failed: #{heading} is #{value.length} characters, " \ + "but the draft declares #{declared_count} of #{declared_limit} (limit #{field_limit})" + exit 1 + end +end + +puts "public presence audit passed" +RUBY From 7b69c2e0ec8566ce9588c4ff66c1ccadf5e04ced Mon Sep 17 00:00:00 2001 From: CodePilot Date: Sat, 18 Jul 2026 21:44:30 +0200 Subject: [PATCH 40/44] docs: align Pages beta description --- docs/CHANGELOG.md | 1 + docs/_config.yml | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index 7a307f0a..1eef5ec4 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -48,6 +48,7 @@ - Removed the FAQ's implied future-provider promise and stated that the current beta supports Codex CLI only. - Added a single retention and deletion summary for local uploads, connection settings, notification state, and data handled separately by enabled providers. - Added an automated public-presence audit for broken relative documentation links and App Store metadata field-count drift. +- Aligned the GitHub Pages metadata description with the approved Mac-and-iPhone public beta positioning for Codex CLI users. ### Recent Product Work diff --git a/docs/_config.yml b/docs/_config.yml index a1675813..47d1d446 100644 --- a/docs/_config.yml +++ b/docs/_config.yml @@ -1,5 +1,5 @@ title: CodePilot Public Beta -description: An iPhone companion and Mac gateway for existing Codex CLI users. +description: Public beta Mac and iPhone companion for Codex CLI workflows. theme: jekyll-theme-minimal show_downloads: false From 5ecae33acb6efacc0ee5ab20aebfcd698b9e49e6 Mon Sep 17 00:00:00 2001 From: CodePilot Date: Sat, 18 Jul 2026 22:44:58 +0200 Subject: [PATCH 41/44] ops: audit live public presence --- docs/CHANGELOG.md | 1 + docs/PUBLIC_PRESENCE_CHECKLIST.md | 1 + scripts/public-presence-live-audit.sh | 57 +++++++++++++++++++ .../tests/public-presence-live-audit-test.sh | 47 +++++++++++++++ 4 files changed, 106 insertions(+) create mode 100755 scripts/public-presence-live-audit.sh create mode 100755 scripts/tests/public-presence-live-audit-test.sh diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index 1eef5ec4..1ee059a4 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -49,6 +49,7 @@ - Added a single retention and deletion summary for local uploads, connection settings, notification state, and data handled separately by enabled providers. - Added an automated public-presence audit for broken relative documentation links and App Store metadata field-count drift. - Aligned the GitHub Pages metadata description with the approved Mac-and-iPhone public beta positioning for Codex CLI users. +- Added a read-only live-presence audit for the public repository description, website field, Pages source and URLs, and private vulnerability reporting. ### Recent Product Work diff --git a/docs/PUBLIC_PRESENCE_CHECKLIST.md b/docs/PUBLIC_PRESENCE_CHECKLIST.md index 7078232e..ea715af7 100644 --- a/docs/PUBLIC_PRESENCE_CHECKLIST.md +++ b/docs/PUBLIC_PRESENCE_CHECKLIST.md @@ -48,6 +48,7 @@ Maintainer approval is required before publishing or submitting: ## Publishing Readiness - Run `scripts/public-presence-audit.sh` and `scripts/privacy-audit.sh` before committing public-content changes. +- Run `scripts/public-presence-live-audit.sh` when verifying repository settings and the published site. It checks the approved repository description, website field, Pages source, private vulnerability reporting, and the landing, privacy, and support URLs without changing GitHub settings. - Confirm GitHub Pages is enabled from the approved `main` branch `docs/` source and the site returns successfully. - Add the live Pages URL to the repository website field and resolve the App Store support and privacy URL drafts to live pages. - Keep the repository description beta-focused and specific to the current audience. Recommended copy: `Public beta Mac and iPhone companion for Codex CLI workflows.` diff --git a/scripts/public-presence-live-audit.sh b/scripts/public-presence-live-audit.sh new file mode 100755 index 00000000..0103a756 --- /dev/null +++ b/scripts/public-presence-live-audit.sh @@ -0,0 +1,57 @@ +#!/bin/zsh +set -euo pipefail + +repository="codepilotios/codepilot" +expected_description="Public beta Mac and iPhone companion for Codex CLI workflows." +expected_homepage="https://codepilotios.github.io/codepilot/" +gh_command="${CODEPILOT_LIVE_AUDIT_GH:-gh}" +curl_command="${CODEPILOT_LIVE_AUDIT_CURL:-curl}" +failures=0 + +fail() { + printf 'public presence live audit: %s\n' "$1" >&2 + failures=$((failures + 1)) + return 0 +} + +if ! command -v "$gh_command" >/dev/null 2>&1; then + fail "GitHub CLI is required" +else + description="$("$gh_command" repo view "$repository" --json description --jq '.description // ""' 2>/dev/null || true)" + homepage="$("$gh_command" repo view "$repository" --json homepageUrl --jq '.homepageUrl // ""' 2>/dev/null || true)" + if [[ -z "$description" ]]; then + fail "could not read repository description and website field" + else + [[ "$description" == "$expected_description" ]] || \ + fail "repository description is not the approved public-beta copy" + [[ "$homepage" == "$expected_homepage" ]] || \ + fail "repository website field is not the verified Pages URL" + fi + + pages=(${(f)"$("$gh_command" api "repos/$repository/pages" --jq '.status, .html_url, .source.branch, .source.path' 2>/dev/null || true)"}) + if [[ ${#pages[@]} -ne 4 ]]; then + fail "GitHub Pages is not enabled or its settings are unavailable" + else + [[ "${pages[1]}" == "built" ]] || fail "GitHub Pages status is ${pages[1]}" + [[ "${pages[2]}" == "$expected_homepage" ]] || fail "GitHub Pages URL is not the approved URL" + [[ "${pages[3]}" == "main" && "${pages[4]}" == "/docs" ]] || \ + fail "GitHub Pages must publish from main:/docs" + fi + + vulnerability_reporting="$("$gh_command" api "repos/$repository/private-vulnerability-reporting" --jq '.enabled' 2>/dev/null || true)" + [[ "$vulnerability_reporting" == "true" ]] || fail "private vulnerability reporting is not enabled" +fi + +for page in "" "PRIVACY.html" "SUPPORT.html"; do + url="${expected_homepage}${page}" + if ! "$curl_command" --fail --location --silent --show-error --max-time 20 --output /dev/null "$url"; then + fail "$url is not reachable" + fi +done + +if (( failures > 0 )); then + printf 'public presence live audit failed with %d finding(s)\n' "$failures" >&2 + exit 1 +fi + +echo "public presence live audit passed" diff --git a/scripts/tests/public-presence-live-audit-test.sh b/scripts/tests/public-presence-live-audit-test.sh new file mode 100755 index 00000000..3ea44b8a --- /dev/null +++ b/scripts/tests/public-presence-live-audit-test.sh @@ -0,0 +1,47 @@ +#!/usr/bin/env zsh +set -euo pipefail + +ROOT="$(cd "$(dirname "$0")/../.." && pwd)" +TMP_ROOT="$(mktemp -d)" + +cleanup() { + rm -rf "$TMP_ROOT" +} +trap cleanup EXIT + +cat > "$TMP_ROOT/gh" <<'EOF' +#!/bin/zsh +if [[ "$1 $2" == "repo view" ]]; then + if [[ "$5" == "description" ]]; then + printf '%s\n' 'Public beta Mac and iPhone companion for Codex CLI workflows.' + else + printf '%s\n' 'https://codepilotios.github.io/codepilot/' + fi +elif [[ "$2" == "repos/codepilotios/codepilot/pages" ]]; then + printf '%s\n' 'built' 'https://codepilotios.github.io/codepilot/' 'main' '/docs' +elif [[ "$2" == "repos/codepilotios/codepilot/private-vulnerability-reporting" ]]; then + printf '%s\n' 'true' +else + exit 1 +fi +EOF + +cat > "$TMP_ROOT/curl" <<'EOF' +#!/bin/zsh +exit "${CODEPILOT_FAKE_CURL_EXIT:-0}" +EOF + +chmod +x "$TMP_ROOT/gh" "$TMP_ROOT/curl" +CODEPILOT_LIVE_AUDIT_GH="$TMP_ROOT/gh" \ + CODEPILOT_LIVE_AUDIT_CURL="$TMP_ROOT/curl" \ + "$ROOT/scripts/public-presence-live-audit.sh" + +if CODEPILOT_FAKE_CURL_EXIT=22 \ + CODEPILOT_LIVE_AUDIT_GH="$TMP_ROOT/gh" \ + CODEPILOT_LIVE_AUDIT_CURL="$TMP_ROOT/curl" \ + "$ROOT/scripts/public-presence-live-audit.sh" >/dev/null 2>&1; then + echo "Live audit accepted unreachable Pages URLs" >&2 + exit 1 +fi + +echo "CodePilot public presence live audit tests passed." From 8e4b5303798524445ab4c2f5f8e3b39e87420f41 Mon Sep 17 00:00:00 2001 From: CodePilot Date: Sun, 19 Jul 2026 00:19:01 +0200 Subject: [PATCH 42/44] ci: guard App Store metadata field limits --- docs/APP_STORE_METADATA_DRAFT.md | 4 ++++ docs/CHANGELOG.md | 1 + scripts/public-presence-audit.sh | 16 +++++++++++++++- 3 files changed, 20 insertions(+), 1 deletion(-) diff --git a/docs/APP_STORE_METADATA_DRAFT.md b/docs/APP_STORE_METADATA_DRAFT.md index 3593fa60..15ab4255 100644 --- a/docs/APP_STORE_METADATA_DRAFT.md +++ b/docs/APP_STORE_METADATA_DRAFT.md @@ -6,10 +6,14 @@ This draft is for TestFlight and App Store Connect preparation only. Do not subm CodePilot +Character count: 9 of 30. + ## Subtitle Codex companion for your Mac +Character count: 28 of 30. + ## Promotional Text Public beta for Codex CLI users: check usage and threads, upload files, and steer coding sessions running on a Mac you control. diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index 1ee059a4..b878d9ac 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -50,6 +50,7 @@ - Added an automated public-presence audit for broken relative documentation links and App Store metadata field-count drift. - Aligned the GitHub Pages metadata description with the approved Mac-and-iPhone public beta positioning for Codex CLI users. - Added a read-only live-presence audit for the public repository description, website field, Pages source and URLs, and private vulnerability reporting. +- Expanded the App Store metadata audit to guard the app name, subtitle, description, and beta testing instructions against submission field-limit drift. ### Recent Product Work diff --git a/scripts/public-presence-audit.sh b/scripts/public-presence-audit.sh index 5ff2ef27..d482802d 100755 --- a/scripts/public-presence-audit.sh +++ b/scripts/public-presence-audit.sh @@ -32,7 +32,7 @@ end metadata_path = "docs/APP_STORE_METADATA_DRAFT.md" metadata = File.read(metadata_path) -{"Promotional Text" => 170, "Keywords" => 100}.each do |heading, field_limit| +{"App Name" => 30, "Subtitle" => 30, "Promotional Text" => 170, "Keywords" => 100}.each do |heading, field_limit| value = metadata[/^## #{Regexp.escape(heading)}\n\n([^\n]+)/, 1] count_match = metadata.match( /^## #{Regexp.escape(heading)}\n\n[^\n]+\n\nCharacter count: (\d+) of (\d+)\./ @@ -51,5 +51,19 @@ metadata = File.read(metadata_path) end end +{"Description" => 4_000, "What To Test" => 4_000}.each do |heading, field_limit| + value = metadata[/^## #{Regexp.escape(heading)}\n\n(.*?)(?=\n## |\z)/m, 1]&.strip + + unless value + warn "public presence audit failed: #{heading} is missing" + exit 1 + end + + if value.length > field_limit + warn "public presence audit failed: #{heading} is #{value.length} characters (limit #{field_limit})" + exit 1 + end +end + puts "public presence audit passed" RUBY From 394ac24663dbec7d7499f5637bb368d0de531fd8 Mon Sep 17 00:00:00 2001 From: CodePilot Date: Sun, 19 Jul 2026 01:11:39 +0200 Subject: [PATCH 43/44] ops: reverify public presence blockers --- ops/agents/escalations/presence-maintenance.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ops/agents/escalations/presence-maintenance.md b/ops/agents/escalations/presence-maintenance.md index feb4f469..0fab0466 100644 --- a/ops/agents/escalations/presence-maintenance.md +++ b/ops/agents/escalations/presence-maintenance.md @@ -12,7 +12,7 @@ The following public-publishing decisions are approved: ## Pending Maintainer Action -Reverified on 2026-07-18. The public repository review found three launch-readiness settings that require maintainer access, one legal-content decision, and one unresolved release blocker: +Reverified on 2026-07-19. The public repository review found three launch-readiness settings that require maintainer access, one legal-content decision, and one unresolved release blocker: Repository-setting follow-up is tracked in GitHub issue #27. From 55fb5e6782ca854c38330cfc9d19a81df583597e Mon Sep 17 00:00:00 2001 From: CodePilot Date: Sun, 19 Jul 2026 01:52:10 +0200 Subject: [PATCH 44/44] ops: correct presence escalation count --- ops/agents/escalations/presence-maintenance.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ops/agents/escalations/presence-maintenance.md b/ops/agents/escalations/presence-maintenance.md index 0fab0466..5b3a90df 100644 --- a/ops/agents/escalations/presence-maintenance.md +++ b/ops/agents/escalations/presence-maintenance.md @@ -12,7 +12,7 @@ The following public-publishing decisions are approved: ## Pending Maintainer Action -Reverified on 2026-07-19. The public repository review found three launch-readiness settings that require maintainer access, one legal-content decision, and one unresolved release blocker: +Reverified on 2026-07-19. The public repository review found four launch-readiness settings that require maintainer access, one legal-content decision, and one unresolved release blocker: Repository-setting follow-up is tracked in GitHub issue #27.