Codex94

Overview

Codex94 is an unofficial, independent macOS app for **Codex quota and Token usage statistics. The 4.0.0 development branch adds optional Claude Code quota monitoring** alongside Codex. It keeps remaining quota and reset times in the menu bar without a Dock icon, with details in one popover and Dashboard.

Version 0.3.0 (14) adds Codex service-reported summary cards, switchable **bar and line charts, and CSV export** of daily Token records. A manual update check shows newer stable GitHub Releases; downloading and installing remain manual.

The quota features introduced in 0.2.2 (13) remain: four menu-bar layouts, including a dual-window view, optional low-quota and recovery alerts, and a configurable global shortcut. Either mouse button toggles the same popover. The read-only Manual quota resets card shows the available reset count in the popover and Overview without redeeming a reset.

Codex94 is an MIT-licensed source project. It uses the locally installed CLI for each enabled service and bundles no third-party runtime frameworks.

Vibe-built with Codex. Each release is still maintainer-reviewed, tested, and security-scanned before it is tagged.

Codex94 is not affiliated with, endorsed by, or sponsored by OpenAI or

Anthropic. Codex app-server is experimental; CLI and status-line formats

may change between upstream releases.

4.0.0 development — not released

These features are implemented on the development branch. The published stable release and all download/clone links below remain 3.1.4 (20). The production reader has fetched authenticated 5-hour and weekly quotas from native Claude Code 2.1.286 with a default Max profile. Native App interaction and the maintainer-requested ten-minute runtime observation are complete; final publication remains pending.

Codex is on by default; Claude is off. Enable Claude in Dashboard →

Services. Each service has its own refresh tasks, quota selection, source, freshness, failures and opt-in notification settings. One service's failure does not replace the other's quota.

Choose one menu-bar service or two independent status items. Either

item opens the same scrollable popover containing all enabled services as separate sections. Overview also shows the enabled services. The Codex group picker, account options and read-only reset-credit display remain available.

Choose the floating window's service separately from the primary menu-bar

service. Disabling a service stops its monitoring and reminders. With both off, a neutral status item keeps Services settings reachable.

Claude quota can come from the official CLI's /usage screen or an

optional status-line connection. The card identifies the source and report time, preserves reported fractions, and leaves missing quota/reset values unknown. It does not combine Codex and Claude percentages.

A status-line report is local information emitted by Claude Code, not a new

cloud quota sample. Rereading an unchanged report does not update its report time. Services settings can preview and install a wrapper that preserves the existing status-line command; removal restores it only if the configuration still matches. Turning monitoring off leaves that connection installed but stops quota capture; removing it is a separate action.

**Token statistics, charts, CSV/PNG export and chart copying remain Codex

only.** Disabling Codex monitoring disables that page's data reads. Claude token/cost analytics are not part of this implementation.

Version 3.1.4

3.1.4 (20) is the published stable release, dated 2026-09-28 (Australia/Melbourne). Quota reads now have more time to complete, and transient failures retry after 5, 20 and 60 seconds. Between attempts, the last successful quota remains visible with an amber cached indicator and the failure reason. The popover, Connection page and menu-bar tooltip show the next automatic attempt when its scheduled time is known. See issue #36 and fix PR.

Earlier 3.1.3 release

3.1.3 (19) was released on 2026-09-28 (Australia/Melbourne). It reads quota before optional account details, keeps valid quota when optional identity is slow, and recovers transient quota failures with a bounded retry budget. Reopening a connected popover with data less than 60 seconds old reuses that snapshot. Cached status has an independent amber clock; active refresh remains blue. Colored menu-bar content now uses a transparent, sRGB, non-template native button image, with freshness in its tooltip. See issue #33 and fix PR #34.

The maintainer confirmed that the reported menu-bar color flash while switching Spaces was resolved on the tested Mac with the exact reviewed CI candidate. This acceptance does not establish behavior on every macOS version, fullscreen configuration, or keyboard path. The candidate identity and scope are recorded in the release record.

The bundled-CLI compatibility fix introduced in 3.1.2 (18) is retained, including discovery of the known ChatGPT/Codex App layouts, legacy fallbacks, and explicit manual-path precedence. Its original record remains issue #30 and PR #31.

Features

The service controls above extend these existing Codex and display features.

The floating quota strip targets 480 × 90 logical points for weekly-only

or cold data and 680 × 90 when a 5-hour window is reported. It supports pin, drag, hide, and expand controls. It reuses existing quota data; hovering or focusing the update-time control reveals manual refresh. It adds no polling or credit redemption, and the existing global shortcut still toggles the popover.

Custom start/end dates join the three existing Token ranges. Dates use

source calendar-day labels. Reported average, selected-interval peak, and coverage stay separate from the service summary cards. Comparison includes the preceding equal-length interval's reported total and coverage; a growth percentage requires complete data in both intervals and a nonzero baseline.

Export PNG… and Copy chart image use the current range, bar/line style,

language, and theme. The image contains the chart, date range, fetch time, coverage, and any stale-data notice, without identity. Copying writes to the system clipboard only when clicked; CSV export remains available.

Floating preferences save pin state and position; 4.0 also saves the selected

service. Adaptive width is still derived from quota data. The app has no statistics history database, and distribution signing and manual installation remain unchanged.

Validation includes a fourth synthetic Floating UI scenario and Token controls/image checks. Evidence is listed below. Native keyboard focus, floating-panel behavior across Spaces, and fullscreen behavior remain separate from rendered images and panel flags; the earlier 3.1.3 menu-bar color acceptance is limited to its tested Mac and candidate.

Screenshots

All screenshots use isolated synthetic data, not a real account or live usage. The chart previews were captured during 0.3.0 (14) candidate testing and show Bar chart and Line chart over the same seven reported days. These original synthetic captures remain unchanged, from CI run 35521556558. The usage dates are fixed in 2033; the zero on May 15 is an explicit fixture value, not a filled-in missing day.

Token usage: switch between bars and lines

View the Simplified Chinese summary cards or inspect the exact screenshot provenance.

Earlier quota interface — historical screenshots

The retained menu-bar sample is from v0.1.7, the popover images from 0.1.8, and the Dashboard Overview images from 0.1.9 GitHub-hosted CI. Their fixed future Reset dates are synthetic test values. These files remain unchanged and show their original interfaces, not the 0.2.2 additions or the 0.3.0 statistics and update UI.

Compact menu bar status

Codex94 English CLI-style quota popover

CLI-style quota popover

Codex94 English Overview showing synthetic quota buckets in Terminal Dark

Quota Overview

Distribution status

The published stable release is

v3.1.4 (20), released on 2026-09-28 (Australia/Melbourne) as a Universal 2 DMG and source from the same annotated tag.

Download and source-clone instructions below refer to this published release.

Later documentation commits do not move its tag or regenerate its assets.

3.0.1 (15) is a maintenance release for request-context correctness and

focused reuse of parsing, chart preparation, and cleanup. It preserves the features introduced in 0.3.0 without a broad architecture rewrite.

This public repository can be cloned without GitHub authentication.
Users of 0.2.2, which has no update-check command, must manually install

0.3.0 or a later published release to gain that command. Update downloads and installation remain manual.

script/install.sh builds a local Release app, applies an ad-hoc Hardened

Runtime signature, and installs it at ~/Applications/Codex94.app.

The installer requires every Codex94 copy to be quit first. It

verifies a unique staged copy, uses an installation lock, and preserves the old App for rollback until replacement succeeds. It leaves recovery files intact if rollback fails; it does not maintain a version archive.

The published 3.1.4 DMG itself is completely unsigned, has no Apple Developer ID signature, and is not notarized by Apple. The Codex94.app inside is ad-hoc signed only. Neither SHA-256 nor GitHub artifact attestation changes that Apple trust status.

Requirements

macOS 14 or later.
Codex monitoring requires a compatible Codex executable and a current Codex

Optional Claude monitoring in 4.0 development requires the official Claude Code

CLI with its initial setup and login already completed in a terminal. Codex94 does not complete Claude login or onboarding for you. Status-line quota appears only when Claude Code reports it; installing the connection cannot create data.

DMG installation does not require Xcode. Source installation additionally requires full Xcode 16.4 or later (Command Line Tools alone are insufficient) and ripgrep (rg) for the installer's static security check.

Codex94 can use a compatible CLI bundled inside /Applications/ChatGPT.app or /Applications/Codex.app, so a standalone CLI installation is not required. It checks the newer Contents/Resources/codex-cli/CodexCLI.app/Contents/MacOS/codex locations before the legacy Contents/Resources/codex paths, then retains Homebrew and standard CLI fallbacks. Explicit manual-path selection keeps its precedence; an invalid manual choice is not silently bypassed.

Install the Universal DMG

Download both stable assets from the v3.1.4 release page:

Codex94-3.1.4-macos-universal-unnotarized.dmg
Codex94-3.1.4-SHA256SUMS.txt

The DMG supports Apple Silicon (arm64) and Intel (x86_64) on macOS 14 or later. Verify the checksum before opening it:

shasum -a 256 -c Codex94-3.1.4-SHA256SUMS.txt

If you have the GitHub CLI, verify that the exact DMG came from this repository's GitHub workflow and commit:

gh attestation verify Codex94-3.1.4-macos-universal-unnotarized.dmg -R DEFY-AN94/codex94

Attestation is build provenance, not an Apple signature, notarization, malware review, or Gatekeeper approval.

Quit every running Codex94 copy, open the DMG, and drag Codex94.app onto its Applications shortcut. This installs it at /Applications/Codex94.app. Do not run that copy at the same time as a copy in ~/Applications; both use the same bundle identifier, preferences, cache, and login-item registration.

Because this technical-user DMG is unsigned and unnotarized, macOS may block opening it or the first App launch. If you trust the exact verified release, follow Apple's official Privacy & Security → Open Anyway flow. Do not remove quarantine attributes or disable Gatekeeper.

Install from source

Clone the published stable source tag:

git clone --branch v3.1.4 --depth 1 https://github.com/DEFY-AN94/codex94.git

Then build the selected tag:

cd codex94 brew install ripgrep sudo xcodebuild -license accept sudo xcodebuild -runFirstLaunch

./script/install.sh

Quit all Codex94 copies before installing. The installer builds, signs, installs, and opens ~/Applications/Codex94.app. Pass --no-launch to install without opening it:

./script/install.sh --no-launch

On first launch, choose whether Codex94 may request Quota + account or Quota only. Launch at login accepts exactly the stable /Applications/Codex94.app and ~/Applications/Codex94.app locations. The source installer does not migrate or remove a DMG-installed copy.

Main behavior

Token statistics and manual update checks

Dashboard → Token usage loads the service's account/usage/read data on

first entry or a manual statistics refresh, independently of quota polling. Statistics errors do not turn a working menu-bar quota into a connection error.

Summary cards show the returned lifetime tokens, peak daily tokens, current

and longest streaks, and longest running turn. Missing values remain unknown. These service-reported summaries may cover a different period from the daily records; the app does not invent model, project, input/output, cost, or hourly breakdowns.

Switch freely between Bar chart / Line chart; the app remembers the choice.

Selection guides line up with bar centers and line points. The line breaks across dates with no returned record.

The daily charts and table offer 7 days / 30 days / All returned / Custom.

The three preset ranges end at the latest reported day, not today; Custom uses the chosen inclusive dates. The chart preserves actual date gaps; an omitted day is not zero usage. Hover or click to inspect exact values. Reporting time zone and complete historical coverage are unspecified.

Export CSV… saves only reported daily records in the selected range, with

original source dates and exact token counts, to a user-selected file. The app keeps statistics in memory apart from explicit CSV/PNG exports and chart-image copying; refreshes replace the snapshot rather than accumulate the same usage.

Dashboard → About → Check for updates requests this repository's latest

public stable release from GitHub only when clicked. It displays the version and plain-text release notes, and can open the validated GitHub Release page in the system browser. Downloading and installing remain manual; the app does not poll for updates, download/install an app, or relaunch itself. See update checks and release maintenance for the fixed endpoint, first-install migration, and future automatic-installation conditions.

Existing quota behavior

The quota features introduced in 0.2.2 (13) remain, with the freshness and recovery refinements described below. The **Earlier quota interface** gallery retains older captures; the new Token usage previews have their own provenance above.

A new Dashboard window starts on Overview, which reuses the current

connection status, freshness context, and menu-bar quota picker, then shows every displayable bucket in the existing display order and only the 5-hour or Weekly windows actually returned. Missing data has an explicit empty state rather than a fabricated 0%. Opening, browsing, or scrolling Overview does not refresh or write the quota cache, and the page does not expose email, executable paths, or raw bucket identifiers; the existing Dashboard toolbar remains its refresh entry.

Choose from four layouts in Dashboard → Display: Ring + Percentage,

Percentage Only, Ring Only, and the new dual-window layout. The original three layouts retain their existing behavior. The running menu-bar item changes layout and width immediately without being recreated. A status badge is centered in a visible ring or occupies a fixed trailing slot in Percentage Only.

Version 0.2.2 adds a fourth dual-window layout, showing the

selected bucket's 5-hour and Weekly values together. Its saved bucket choice is independent of the original three layouts' quota selection. Switching layouts preserves those existing choices; an unavailable window is not invented or combined with another window.

Left-clicking or right-clicking the menu-bar item toggles the same popover.

Opening follows the freshness-gated refresh path described below. A configurable global keyboard shortcut also toggles that popover and is unset by default. It must include Control or Option; Command and Shift may be added.

Optional local quota notifications are off by default. Explicitly enabling

them requests macOS notification permission. Remaining-quota warning levels start at 20% and 10% and can be adjusted or disabled. The default bucket is monitored, with optional additional buckets and optional recovery alerts. Only fresh successful snapshots drive alerts; baselines and per-window-cycle deduplication stay in memory. Messages contain the bucket name, window, and percentage, without email. macOS Notification Center manages delivered notifications and their retention.

Popover and Overview include a distinct, read-only Manual quota resets

card with a prominent available count. It is an informational card with no reset action. Its value comes from the authoritative rateLimitResetCredits.availableCount in the existing quota response. Zero means zero; missing or null data remains unavailable, not zero. Before the first live result the card says it has not been fetched; a retained value after failure is marked cached. The count stays in memory and is not written to the quota cache. Codex94 has no reset-redemption action or consume request.

Customize four independent colors for healthy

(50–100%), warning (20–49%), critical (0–19%), and hard-unavailable error states. These color thresholds cannot be changed and are separate from the configurable notification thresholds. Colors update immediately and are stored as opaque sRGB, normalized six-digit uppercase RRGGBB values without alpha. Critical and error remain independent even when both default to theme red. Restore Default Colors removes only the four overrides, preserving layout, theme, language, quota selection, executable path, and window size.

Quota rows show a separate absolute Reset line

with the full date, hour/minute, and UTC offset at the reset instant, including daylight-saving changes. The existing countdown remains; a missing reset is unavailable and a past date stays visible with a zero countdown. Dates follow the app language's locale and the current time zone. Dashboard → Connection shows the actual resolved menu-bar bucket/window, rather than the popover's browsed model.

Issue banners offer Open Connection or

Open Diagnostics, reusing the same Dashboard window. Ordinary Dashboard opening preserves its current page. These buttons only navigate; use the existing Refresh to retry. A signed-out state explains that you must sign in in Codex, then return and refresh; Codex94 does not perform login.

Layout/color changes, Overview rendering, Reset text rendering, and recovery

navigation do not themselves trigger quota requests, write quota cache, or change connection state. Opening the popover and the separate post-reset schedule follow their documented refresh behavior below.

Refreshes at launch and every 1, 5, 15, or 30 minutes according to the

selected setting. Opening a connected popover reuses successful data less than 60 seconds old; otherwise it uses the existing single-flight refresh. Explicit Refresh remains available and coalesces an already active read.

Transient quota failures may receive at most three additional read attempts,

after delays of 5, 20 and 60 seconds (four attempts including the initial read). The same bounded budget can follow a Reset-triggered attempt. Authentication, discovery and malformed-data errors do not automatically retry; a later normal refresh starts a new budget.

While waiting after a transient failure, the popover, Connection page and

native menu-bar tooltip/accessibility text show the next scheduled automatic attempt as local HH:mm:ss. This uses the earliest known retry, background or post-reset deadline. An unknown schedule, including after a clock change, hides the timestamp; the existing failure and cached-data information remain.

After the Mac wakes, refreshes once when there is no successful snapshot or

the last success is at least 60 seconds old. A fresher snapshot is kept, and wake, background, manual, and popover requests share the same single-flight refresh path.

After each successful snapshot, schedules one in-memory refresh for the

earliest future Reset across displayable windows, strictly at resetsAt + 5 seconds or later. Equal targets are deduplicated, adjacent requests reuse the same single-flight path, and a consumed target gets no Reset-specific retry. A session-only consumed-target watermark prevents clock rollback from rearming an already attempted Reset. Wake and system-clock changes reconcile the one-shot schedule without a persistent ledger or new background cadence.

Uses account/rateLimits/read for live quota data before the optional

account/read request in Quota + account mode, with refreshToken: false. Quota requests have a 10-second request budget and a 20-second transaction budget; Token usage retains 5 and 15 seconds respectively. The optional account read keeps its 2-second cap and preserves valid quota if identity is slow; missing identity is shown separately, without reusing an earlier account's details or Token snapshot. Explicit authentication failures still fail the read.

Keeps the standard/default quota bucket separate from additional named model

buckets returned by Codex. The default bucket is shown as Codex; named buckets use service-provided names. No model's availability or retirement date is hard-coded. Historical synthetic screenshots may show older names.

The popover model picker browses one bucket at a time and is independent from

the menu-bar selection. Browsing a model does not change the menu-bar ring. If its browsed bucket disappears, the popover uses the available default bucket, or the first displayable bucket when the default has no windows. Long bucket names remain distinguishable in the selection menu.

The dynamic menu-bar quota menu offers Auto plus each available bucket and

window. Auto chooses the lowest remaining percentage across all displayable buckets and windows. When a fresh successful snapshot no longer contains a pinned bucket/window, the saved preference becomes Auto. It stays Auto if that option later returns; cache loading and failed requests do not change the saved selection.

Supports only the returned 5-hour and Weekly windows. Weekly-only data is

valid: missing rows and selections are hidden without inferring entitlement from plan type. It never estimates or combines independent quota windows.

Keeps quota severity separate from connection and data freshness: quota

rings, percentages, and bars share the same resolved healthy/warning/critical colors, defaulting to green, amber, and red. Refreshing keeps the blue/cyan connection accent; cached status uses its own amber clock, independent of the user's quota warning-color override. A hard-unavailable badge, banner, or Dashboard error dot uses its independent error color, defaulting to the theme red before any critical override.

Keeps the last successful quota value after a refresh failure and marks it as

cached; when no snapshot is available, it shows a gray -- instead of 0%.

Shows the relative age of the last successful quota data in the popover

header. Refreshing with an existing snapshot reports the last success, while refreshing or unavailable states without a snapshot use explicit no-success wording. The same freshness context is included in menu-bar and popover accessibility descriptions and the native menu-bar button's tooltip.

Closes the transient popover when the user clicks elsewhere without consuming

the original click or requesting Accessibility permission.

Locates Codex in this order: explicit manual path, the known ChatGPT/Codex

nested bundled locations, their legacy paths, Homebrew, /usr/local/bin, ~/.local/bin, then absolute PATH entries.

Offers Dashboard window presets at 900x600, 1280x720, 1440x810, and 1920x1080

logical points, with proportional fitting to the current display. Screen fitting preserves the requested preset; a user resize still updates it.

Dashboard → Startup refreshes Launch at Login status when returning to

the app and shows a localized failure if a requested change fails. Automated tests use a fake service and never change real Login Items.

The executable picker follows the app's selected language.
Dashboard → About shows the running app's exact version and build. A

user-triggered copy action preserves that string, and the project link targets https://github.com/DEFY-AN94/codex94. Opening that link uses the system browser; the separate manual update-check flow is described above.

Supports system, Terminal Dark, and Terminal Light themes plus English and

Simplified Chinese.

Uses only the current Codex login. It does not manage multiple accounts or

alternate CODEX_HOME directories, or collect a local quota-history ledger.

Security and privacy

The 4.0 development branch adds a separate local Claude CLI reader and optional status-line quota cache. Previewing setup is read-only; installing or removing the connection explicitly edits Claude Code's status-line setting and retains recovery material. The diagram below describes the existing Codex path.

flowchart LR
    A["Codex94"] <-->|"local stdio JSON-RPC"| B["Codex app-server"]
    B -->|"Codex-owned login"| C["OpenAI account service"]
    A --> D["quota-only local cache"]
    A -->|"opt-in local alerts"| E["macOS Notification Center"]
    A -->|"0.3.0: user-initiated update check"| F["GitHub public latest-release API"]

The Codex provider starts its validated executable with fixed arguments:

codex -s read-only -a never app-server --stdio

Codex itself owns authentication and may contact OpenAI services. Codex94 does not implement OAuth, receive an access or refresh token, make a direct quota HTTP request, or read authentication files, browser cookies, Keychain entries, Codex session logs, or SQLite databases.

The versioned local cache stores only quota-bucket identifiers and optional names, plan type, window duration and type, percentage, reset time, and fetch time with owner-only permissions. Email is memory-only in Quota + account mode and is removed from the in-memory snapshot after switching to **Quota only**. UserDefaults stores interface choices, including the preferred menu-bar quota selection, and an optional manually selected executable path. Version 0.1.8 introduced menuBarLayout.v1 and statusAccentOverrides.v1 for layout and four color overrides; subsequent releases reuse those keys and migration. Version 0.2.1 changes an unavailable pinned selection to Auto only after a successful fresh snapshot, using the existing preference key. Reset text and the in-memory post-reset schedule use the existing reset timestamp, with no additional cache fields or persistent ledger. Overview uses the existing snapshot without storing new identity data. The popover's browsed model and the Dashboard's selected section are session-only; Dashboard frame autosave is unchanged. Version 0.2.2 adds dualWindowBucketSelection.v1, globalHotKey.v1, and notifications.v1 preferences for the independent dual-window bucket, chosen shortcut, and alert settings. Notification baselines, deduplication, and the reset-credit count are memory-only; cache schema v2 is unchanged. The shortcut uses system hotkey registration and does not record typed text. Opt-in notifications use the local macOS notification service, which can retain delivered bucket/window/percentage messages in Notification Center. This is an explicit new permission and local system data flow, not remote telemetry. Token statistics in 0.3.0 remain in memory unless the user exports CSV. Its separate update check makes a direct request to GitHub's fixed public latest-release API only after user action, without sending account or usage data. Update results stay in memory. Codex94 has no analytics, advertising, telemetry upload, crash-reporting SDK, system profiling, or project-operated server. Opening the Release page hands navigation to the system browser.

Version 0.2.0 added distribution packaging and the second stable installation path. Version 0.2.1 retains the same data and permission boundaries. The DMG, checksum, and CI artifact contain the App, not account data, credentials, preferences, cache, logs, or real quota. Browser download and Gatekeeper quarantine handling are macOS distribution behavior. Version 0.3.0 adds an explicit update-network path; it does not change how Codex credentials or quota data are accessed.

App Sandbox is intentionally disabled because the Codex child process must access its own login state. Hardened Runtime remains enabled; subprocess arguments are fixed, the environment is minimized, output is bounded, requests time out, and the process group is terminated after each refresh or during app shutdown with bounded cleanup. Version validation checks protocol compatibility, not publisher identity, so users must trust the ChatGPT/Codex installation and any executable they select.

The Diagnostics and About copy buttons write only after a user action. Copied diagnostics normalize the executable path and version; About copies the exact displayed version and build. Users should still review diagnostics before sharing them. Codex94 never reads or uploads clipboard contents or diagnostics.

See PRIVACY.md and SECURITY.md for the complete boundaries.

Development and build

Contributor and release checks also require jq:

brew install ripgrep jq

Build and run a Debug app:

./script/build_and_run.sh

build_and_run.sh stops existing named Codex94 processes before building and launches the Debug app. install.sh asks you to quit running copies instead of stopping them, replaces only its installation path, and may launch the installed App. These scripts are not read-only checks; local app runs can use the same preferences and cache as the installed app.

Use synthetic fixtures and injected fetchers or an explicit fake executable for automated tests and documentation screenshots. Do not include real account credentials, identity, quota, or private paths in shared fixtures or artifacts. Keep test preferences and cache separate from daily app data; see CONTRIBUTING.md.

Run the unit and fake app-server integration tests:

DEVELOPER_DIR=/Applications/Xcode_16.4.app/Contents/Developer \
  xcodebuild -project Codex94.xcodeproj -scheme Codex94 \
  -destination 'platform=macOS' -derivedDataPath .build/DerivedData \
  CODE_SIGNING_ALLOWED=NO test

Run the complete release gate, including isolated metadata/installer tests, hosted tests, one Universal Release build, and DMG create/verify. script/release_metadata.py reads the App target's version/build; CI and the UI fixture use the committed values. The packager owns the complete App signature and payload validation:

./script/release_check.sh

Version 0.1.8 passed the full GitHub test/release job, synthetic Display and click-functional Recovery UI jobs, and Actions/Swift CodeQL. For 0.1.9 (10), PR #11 remains the historical record for exact-head test, Display/Recovery UI, Actions/Python/Swift CodeQL, and final App acceptance. The synthetic Overview capture embedded above has been reviewed for layout and privacy. Keyboard activation, AXPress, and hosted tooltip exposure are not claimed as passed. Version 0.3.0 (14) was published on 2026-09-21 (Australia/Melbourne). Its source and distribution artifacts remain bound to that release tag. Later documentation changes do not replace the recorded evidence, and future versions require their own validation.

Historical validation for 3.0.1 (15) includes 315 hosted tests, the Display/Recovery/Token usage CI scenarios, Actions/Python/Swift CodeQL, and verification of its final-main Universal App and DMG. These are this maintenance release's own results. The unchanged 0.3.0 screenshots and maintainer interaction records retain their original provenance; they are not relabelled as fresh 3.0.1 manual acceptance. Final CI-package acceptance is recorded separately in the 3.0.1 release record.

The local 3.1.0 (16) unit suite recorded **340 tests executed, 1 skipped, 0 failures**. The hosted keyboard-focus check was skipped because its test process could not establish a key window; it is not counted as a pass. PNG checks include actual-image stale/fresh text recognition and isolated pasteboard verification. The 3.1.0 release record separately identifies the four external UI scenarios (Display, Recovery, Token usage, Floating), Actions/Python/Swift CodeQL, and final source/artifact acceptance. Prior release screenshots and interaction records retain their original provenance.

Local validation for 3.1.1 (17) recorded **345 tests executed, 1 skipped, 0 failures**. The hosted focus skip is not a pass. External UI, security, final-main packaging and installed-artifact results need their own records for this version; the preceding 3.1.0 evidence does not stand in for those checks.

Local validation for 3.1.2 (18) recorded **353 tests executed, 1 skipped, 0 failures**. The skipped check is not a pass. Final-main checks, published assets, and installed-App acceptance are recorded separately in the release record.

Validation for 3.1.3 (19) recorded **381 tests executed, 1 skipped, 0 failures**, including 11 menu-bar renderer tests. The hosted focus skip is not a pass. release CI passed the four synthetic UI scenarios, and release CodeQL passed Actions, Python and Swift. The maintainer's Spaces color acceptance applies only to the reviewed CI candidate on the tested Mac; final-main assets and installation are separate records in RELEASING.md.

Validation for 3.1.4 (20): **396 tests executed, 1 existing hosted-focus skip, 0 failures**. Exact final-main checks, public asset verification and local background-refresh observation are recorded in RELEASING.md.

The 4.0.0 (21) product candidate c9e7c01 passed **486 tests executed, 1 existing hosted-focus skip, 0 failures**, Universal packaging, all five synthetic UI scenarios and Actions/Python/Swift CodeQL. The maintainer accepted the real dual-provider popover, menu items and Claude floating strip. A requested ten-minute observation recorded two Codex and one Claude background refreshes, all successful; two additional popover-triggered reads were counted separately. This short observation does not establish long-term unattended stability. Final-main artifacts and publication remain separate release records.

SwiftUI owns views and state presentation; AppKit owns the native status items, popover, application appearance, and Dashboard window lifecycle. See the component ownership and reuse rules, CONTRIBUTING.md and docs/RELEASING.md for contribution and release workflows.

Uninstall

If you installed the Claude statusline connection, disconnect it in Services while Codex94 is still installed. This restores the previous command before its helper executable is removed. Then disable Launch at login in Dashboard and quit every Codex94 copy. Remove only the App locations that you actually installed; neither installer automatically removes the other copy:

rm -rf "/Applications/Codex94.app"
rm -rf "$HOME/Applications/Codex94.app"

Removing the App does not remove its local data. To remove that too, separately delete the cache and preferences:

rm -rf "$HOME/Library/Application Support/Codex94"
defaults delete com.defyan94.codex94

License

Codex94 is licensed under the MIT License. See ATTRIBUTIONS.md for design and implementation references.

Codex and ChatGPT are trademarks of OpenAI. Codex94 is an independent, unofficial project and does not use the OpenAI logo.

DEFY-AN94/codex94: Unofficial macOS Codex quota and Token monitor: menu-bar layouts, floating strip, bar/line charts, custom ranges, PNG/CSV export, alerts and manual release checks. 非官方 Codex 额度与 Token 统计，支持悬浮窗、自定义区间、图表导出及