# Codex Project Notes

## Project

`Coworker` is a local-first Windows AI coding coworker. It combines a Codex-style desktop app, local model provider configuration, a persistent Brain for memory and skills, and optional iPhone/iPad PWA access.

Repository:

```text
Code-Inc/Coworker
```

## Stack

```text
Electron, React, TypeScript, Vite
```

Package manager:

```text
npm
```

## Commands

Run only on Gitea Ubuntu runners:

```text
INSTALL_COMMAND = npm install
LINT_COMMAND = npm run lint
TEST_COMMAND = npm run test
BUILD_COMMAND = npm run build
AUDIT_COMMAND = npm run audit
PACKAGE_COMMAND = npm run package:win
```

Local checks are limited to lightweight validation such as `git diff --check`.

## Build Artifacts

Release artifacts are produced in:

```text
release/
```

Expected files:

```text
Coworker-Setup-<version>.exe
SHA256SUMS.txt
```

## Security Rules

- Web access is disabled by default.
- LAN/PWA access requires pairing-code authentication and scoped device tokens.
- Workspace tools may access only explicitly selected project directories.
- Agent writes and command execution require visible user approval.
- Local provider endpoints and tokens are stored in user app data, not tracked files.
- Unsigned installers are acceptable until a code-signing certificate is available.

## Release Rules

Before a release:

1. verify Gitea CI is green,
2. run release dry-run workflow,
3. confirm `Coworker-Setup-<version>.exe` and `SHA256SUMS.txt` exist,
4. update `CHANGELOG.md` and release notes,
5. create a `v*` tag,
6. let Gitea Actions publish the release artifact.

Do not create a release unless explicitly requested.