chore: harden export skill release quality

Author: GaoSSR

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,55 @@
+name: Bug Report
+description: Report an export, selection, formatting, or privacy issue.
+title: "[Bug]: "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting a problem. Please do not paste private session content, secrets, or full local paths unless they are necessary and already sanitized.
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: What went wrong?
+      placeholder: The exporter selected the wrong session when...
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected Behavior
+      description: What did you expect to happen?
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual Behavior
+      description: What happened instead?
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Reproduction
+      description: Minimal steps or sanitized JSONL records that reproduce the issue.
+      render: text
+    validations:
+      required: true
+  - type: input
+    id: python
+    attributes:
+      label: Python Version
+      placeholder: "python3 --version"
+  - type: input
+    id: codex
+    attributes:
+      label: Codex Version
+      placeholder: "Codex CLI/Desktop version, if known"
+  - type: textarea
+    id: notes
+    attributes:
+      label: Additional Notes
+      description: Any extra context, sanitized logs, or related links.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1 @@
+blank_issues_enabled: true

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,31 @@
+name: Feature Request
+description: Suggest an improvement to export behavior, Skill usage, or transcript formatting.
+title: "[Feature]: "
+labels:
+  - enhancement
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What workflow or limitation should this solve?
+      placeholder: I want to export...
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed Solution
+      description: Describe the behavior you want.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives Considered
+      description: Other approaches or workarounds you considered.
+  - type: textarea
+    id: privacy
+    attributes:
+      label: Privacy Impact
+      description: Does this require exporting more session data, tool logs, or local paths?

.github/workflows/ci.yml

@@ -0,0 +1,44 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  test:
+    name: Python ${{ matrix.python-version }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version:
+          - "3.10"
+          - "3.11"
+          - "3.12"
+          - "3.13"
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Compile Python
+        run: python3 -m py_compile skills/export/scripts/export_codex_session.py tests/test_export_codex_session.py
+
+      - name: Run unit tests
+        run: python3 -m unittest discover -s tests -p 'test_*.py' -v
+
+      - name: Validate Skill package
+        run: npx --yes skills add . --list

CHANGELOG.md

@@ -0,0 +1,12 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+## 0.1.0 - 2026-04-24
+
+- Initial public Codex Skill for exporting local Codex sessions as Markdown transcripts.
+- Added current-session, cwd-aware, and global session selection fallback.
+- Added conservative privacy defaults that exclude system/developer context, reasoning records, and tool logs.
+- Added optional tool-log export for explicit debugging workflows.
+- Added path-redacted Markdown metadata by default.
+- Added machine-readable `--json` CLI output for Skill invocation.

CONTRIBUTING.md

@@ -0,0 +1,43 @@
+# Contributing
+
+Thanks for improving `codex-export-skill`.
+
+## Project Contract
+
+Keep changes aligned with the core contract:
+
+- `$export` should remain simple to invoke from Codex.
+- Markdown should remain the default transcript format.
+- Privacy defaults must stay conservative.
+- Tool logs, full local paths, and other sensitive execution details must require explicit opt-in.
+
+## Development
+
+Run the local verification suite before opening a pull request:
+
+```bash
+python3 -m py_compile skills/export/scripts/export_codex_session.py tests/test_export_codex_session.py
+python3 -m unittest discover -s tests -p 'test_*.py' -v
+npx skills add . --list
+```
+
+The exporter requires Python 3.10 or newer.
+
+## Parser And Formatting Changes
+
+Session JSONL and Markdown rendering changes are syntax-sensitive. Before changing parser, serializer, escaping, redaction, or selection behavior, define the invariant being changed and add regression tests for:
+
+- positive cases that prove the bug is fixed
+- negative cases that prove nearby literal text is preserved
+- contextual cases that prove the rewrite only applies in the intended structure
+
+For delimiter-sensitive changes, include near-miss examples such as literal Markdown fences, quoted context markers, and prose that only looks like injected context.
+
+## Pull Requests
+
+In pull request descriptions, include:
+
+- root cause or motivation
+- behavior changed
+- privacy impact, if any
+- tests run

LICENSE

@@ -187,7 +187,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright [yyyy] [name of copyright owner]
+   Copyright 2026 GaoSSR
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

README.md

@@ -13,6 +13,7 @@
     <img alt="Codex Skill" src="https://img.shields.io/badge/Codex-Skill-111827?style=flat-square" />
     <img alt="Markdown" src="https://img.shields.io/badge/output-Markdown-2563EB?style=flat-square" />
     <img alt="License" src="https://img.shields.io/badge/license-Apache--2.0-0F766E?style=flat-square" />
+    <img alt="CI" src="https://github.com/GaoSSR/codex-export-skill/actions/workflows/ci.yml/badge.svg" />
   </p>
 
 </div>
@@ -21,6 +22,12 @@
 
 ## Installation
 
+Requirements:
+
+- Codex with Skill support
+- Python 3.10 or newer available as `python3`
+- Node.js/npm for `npx skills`
+
 ```bash
 npx skills add GaoSSR/codex-export-skill --agent codex -g -y --copy
 ```
@@ -72,6 +79,7 @@ Markdown is the default output because LLM conversations already use Markdown he
 - **Current-session selection**: prefers the active Codex conversation when available.
 - **Workspace-aware fallback**: falls back to the latest session for the current workspace, then latest globally.
 - **Privacy-conscious defaults**: excludes system prompts, developer instructions, AGENTS context injection, environment context injection, reasoning records, and tool logs by default.
+- **Path redaction by default**: Markdown metadata shows only local source basenames unless full source paths are explicitly requested.
 - **Optional tool-log export**: include tool logs only when you explicitly ask for them.
 
 ## Safety Boundaries
@@ -82,6 +90,8 @@ By default, the export includes:
 - visible assistant messages
 - session metadata such as session id, source file, cwd, timestamps, originator, and CLI version
 
+Local source file paths and cwd metadata are redacted by default. The exported Markdown keeps only basenames such as `rollout-...jsonl` and the workspace folder name.
+
 By default, the export excludes:
 
 - system prompts
@@ -93,6 +103,8 @@ By default, the export excludes:
 
 Tool calls and command output are exported only when you explicitly ask the Skill to include tool logs.
 
+Advanced script users can pass `--json` for machine-readable output, or `--show-paths` when they intentionally need full local source paths in Markdown metadata.
+
 ## Session Selection
 
 When you do not specify a session, the Skill tries to export the current Codex conversation first. If the current conversation id is unavailable, it falls back to the latest session recorded for the active workspace, then to the latest session globally.
@@ -115,4 +127,6 @@ Issues and pull requests are welcome. Please keep changes aligned with the core
 
 Licensed under the [Apache License 2.0](LICENSE).
 
+Copyright 2026 GaoSSR.
+
 This is not an official OpenAI project.

README_zh.md

@@ -13,6 +13,7 @@
     <img alt="Codex Skill" src="https://img.shields.io/badge/Codex-Skill-111827?style=flat-square" />
     <img alt="Markdown" src="https://img.shields.io/badge/output-Markdown-2563EB?style=flat-square" />
     <img alt="License" src="https://img.shields.io/badge/license-Apache--2.0-0F766E?style=flat-square" />
+    <img alt="CI" src="https://github.com/GaoSSR/codex-export-skill/actions/workflows/ci.yml/badge.svg" />
   </p>
 
 </div>
@@ -21,6 +22,12 @@
 
 ## 安装
 
+运行要求：
+
+- 支持 Skill 的 Codex
+- 可通过 `python3` 调用的 Python 3.10 或更新版本
+- 用于执行 `npx skills` 的 Node.js/npm
+
 ```bash
 npx skills add GaoSSR/codex-export-skill --agent codex -g -y --copy
 ```
@@ -72,6 +79,7 @@ $export export this session with tool logs
 - **优先导出当前会话**：可用时优先选择当前 Codex conversation。
 - **工作区感知回退**：当前会话 id 不可用时，回退到当前工作区最近会话，再回退到全局最近会话。
 - **隐私友好的默认边界**：默认排除 system prompt、developer 指令、AGENTS 上下注入、环境上下文注入、reasoning 记录和工具日志。
+- **默认路径脱敏**：Markdown 元数据默认只保留本地源文件 basename 和工作区目录名，除非明确要求完整源路径。
 - **可选工具日志**：只有你明确要求包含 tool logs 时，才会导出工具调用和命令输出。
 
 ## 安全边界
@@ -82,6 +90,8 @@ $export export this session with tool logs
 - 可见的助手回复
 - 会话元数据，例如 session id、source file、cwd、时间戳、originator 和 CLI version
 
+本地源文件路径和 cwd 元数据默认会脱敏。导出的 Markdown 只保留 `rollout-...jsonl` 这样的文件名和工作区目录名。
+
 默认不会导出：
 
 - system prompt
@@ -93,6 +103,8 @@ $export export this session with tool logs
 
 只有你明确要求 Skill 包含 tool logs 时，工具调用和命令输出才会被导出。
 
+如果直接调用脚本，可以使用 `--json` 获取机器可解析输出；只有在确实需要完整本地源路径时才使用 `--show-paths`。
+
 ## 会话选择
 
 当你不指定 session id 时，Skill 会优先尝试导出当前 Codex 会话。如果当前会话 id 不可用，则回退到当前工作区最近的会话，再回退到全局最近会话。
@@ -115,4 +127,6 @@ $export export session <session-id> to Markdown
 
 本项目基于 [Apache License 2.0](LICENSE) 开源。
 
+Copyright 2026 GaoSSR.
+
 本项目不是 OpenAI 官方项目。

SECURITY.md

@@ -0,0 +1,30 @@
+# Security Policy
+
+## Supported Versions
+
+Security fixes target the current `main` branch and the latest tagged release.
+
+## Reporting A Vulnerability
+
+Please do not open a public issue for vulnerabilities that could expose private session content, local paths, secrets, or tool output.
+
+Report security issues privately through GitHub Security Advisories for this repository. Include:
+
+- affected version or commit
+- sanitized reproduction steps
+- whether the issue can expose hidden prompts, local paths, tool logs, or secrets
+- suggested fix, if known
+
+## Privacy Boundary
+
+The default export must not include:
+
+- system prompts
+- developer instructions
+- AGENTS or project-doc context injection
+- environment context injection
+- encrypted or summarized reasoning records
+- tool calls or command output
+- full local source paths in Markdown metadata
+
+Any change that expands exported data must require explicit user opt-in and dedicated regression tests.