codex-history-ingest — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited codex-history-ingest (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are extracting knowledge from the user's past Codex sessions and distilling it into the Obsidian wiki. Session logs are rich but noisy: focus on durable knowledge, not operational telemetry.
This skill can be invoked directly or via the wiki-history-ingest router (/wiki-history-ingest codex).
llm-wiki/SKILL.md (walk up CWD for .env → ~/.obsidian-wiki/config → prompt setup). This gives OBSIDIAN_VAULT_PATH and CODEX_HISTORY_PATH (defaults to ~/.codex).manifest.json at the vault root to check what has already been ingestedindex.md at the vault root to understand what the wiki already containsCheck .manifest.json for each source file. Only process:
ingested_at in the manifestUse this mode for regular syncs.
Process everything regardless of manifest. Use after wiki-rebuild or if the user explicitly asks for a full re-ingest.
Codex stores local artifacts under ~/.codex/.
~/.codex/
├── sessions/ # Session rollout logs by date
│ └── YYYY/MM/DD/
│ └── rollout-<timestamp>-<id>.jsonl
├── archived_sessions/ # Archived rollout logs
├── session_index.jsonl # Lightweight index of thread id/name/updated_at
├── history.jsonl # Local transcript history (if persistence enabled)
├── config.toml # User config (contains history settings)
└── state_*.sqlite / logs_*.sqlite # Runtime DBs (usually skip)session_index.jsonl — best inventory source for IDs, titles, and freshnesssessions/**/rollout-*.jsonl — rich structured transcript eventshistory.jsonl — useful fallback/timeline aid if enabledAvoid ingesting SQLite internals unless the user explicitly asks.
Scan CODEX_HISTORY_PATH and compare against .manifest.json:
~/.codex/session_index.jsonl~/.codex/sessions/**/rollout-*.jsonl~/.codex/archived_sessions/** (optional; only if user asks for archived history)~/.codex/history.jsonl (optional fallback)Classify each file:
ingested_atReport a concise delta summary before deep parsing.
session_index.jsonl typically has entries like:
{"id":"...","thread_name":"...","updated_at":"..."}Use it to:
Each rollout-*.jsonl line is an event envelope with:
{
"timestamp": "...",
"type": "session_meta|turn_context|event_msg|response_item",
"payload": { ... }
}response_item records with user/assistant message contentevent_msg selectively for meaningful milestones; ignore pure telemetrysession_meta as metadata (cwd, model, ids), not user knowledgeRollout logs can include injected instructions, tool payloads, and sensitive text. Do not ingest verbatim system/developer prompts or secrets.
Do not create one wiki page per session.
cwd from metadata to infer project scopeRoute extracted knowledge using existing wiki conventions:
projects/<name>/...concepts/skills/entities/synthesis/For each impacted project, create/update projects/<name>/<name>.md (project name as filename, never _project.md).
summary: frontmatter on each new/updated page (1-2 sentences, <= 200 chars) base_confidence: 0.42
lifecycle: draft
lifecycle_changed: <ISO date today>Leave lifecycle unchanged on update.
^[extracted] when directly grounded in explicit session content^[inferred] when synthesizing patterns across events/sessions^[ambiguous] when sessions conflictprovenance: frontmatter mix for each changed page.manifest.jsonFor each processed source file:
ingested_at, size_bytes, modified_atsource_type: codex_rollout | codex_index | codex_historyproject: inferred project name (when applicable)pages_created, pages_updatedAdd/update a top-level project/session summary block:
{
"project-name": {
"source_path": "~/.codex/sessions/...",
"last_ingested": "TIMESTAMP",
"sessions_ingested": 12,
"sessions_total": 40,
"index_updated_at": "TIMESTAMP"
}
}Update index.md and log.md:
- [TIMESTAMP] CODEX_HISTORY_INGEST sessions=N pages_updated=X pages_created=Y mode=append|full`hot.md` — Read $OBSIDIAN_VAULT_PATH/hot.md (create from the template in wiki-ingest if missing). Update Recent Activity with a one-line summary — e.g. "Ingested 12 Codex sessions; surfaced recurring patterns in CLI tooling and shell scripting." Keep the last 3 operations. Update updated timestamp.
See references/codex-data-format.md for field-level parsing notes and extraction guidance.
QMD is a search index, not the source of truth. If $QMD_WIKI_COLLECTION is empty or unset, skip this step. Run it only after this skill has written or rewritten vault markdown. If QMD refresh fails, do not roll back the vault changes; report the QMD status separately.
Use $QMD_CLI if set; otherwise use qmd.
${QMD_CLI:-qmd} updateIf the output says vectors are needed or embeddings may be stale, run:
${QMD_CLI:-qmd} embedVerify the collection with either:
${QMD_CLI:-qmd} ls "$QMD_WIKI_COLLECTION"or, when a specific page path is known:
${QMD_CLI:-qmd} get "qmd://$QMD_WIKI_COLLECTION/<page>.md" -l 5Record one of:
QMD refreshed: update + embed + verifiedQMD refreshed: update only + verifiedQMD skipped: QMD_WIKI_COLLECTION unsetQMD skipped: qmd CLI unavailableQMD failed: <short error summary>~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.