codex on imessage

A coding agent that helps you build and ship with AI — powered by ChatGPT,
now on iMessage. Paste your OpenAI key, connect Spectrum, get a phone
number, text Codex from your iPhone.

- Stateful Codex conversation per user, threaded via the OpenAI Responses
  API. Send /new to reset.
- OpenAI keys and Spectrum project secrets AES-256-GCM encrypted at rest.
- One Docker image, two processes (webapp + bridge daemon).

Author: KumarVandit

.dockerignore

@@ -0,0 +1,15 @@
+.git
+.github
+.gitignore
+.next
+node_modules
+.env
+.env.local
+.env*.local
+README.md
+Dockerfile
+.dockerignore
+docker-compose.yml
+*.log
+.vscode
+.idea

.env.example

@@ -0,0 +1,26 @@
+# Public URL the app is reachable at (no trailing slash).
+PUBLIC_URL=http://localhost:3000
+
+# Spectrum dashboard host — exposes the device-auth flow and project APIs.
+SPECTRUM_API_HOST=https://app.photon.codes
+
+# Spectrum runtime host — exposes project-scoped user/platform/token APIs.
+SPECTRUM_RUNTIME_HOST=https://spectrum.photon.codes
+
+# Device-auth client_id. Must be in the operator's ALLOWED_DEVICE_CLIENT_IDS
+# allowlist on the Spectrum dashboard. `photon-cli` is the entry shipped with
+# the public Photon CLI and works out of the box.
+SPECTRUM_CLIENT_ID=photon-cli
+
+# Postgres connection string.
+DATABASE_URL=postgres://postgres:postgres@localhost:5432/codex
+
+# 32-byte hex master key for encrypting tenant OpenAI keys at rest.
+# Generate once: openssl rand -hex 32
+MASTER_KEY=
+
+# Default model used to answer iMessage threads.
+CODEX_MODEL=gpt-5-codex
+
+# Container entrypoint mode: "webapp" or "bridge".
+PROCESS=webapp

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @KumarVandit

.github/workflows/ci.yml

@@ -0,0 +1,44 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    name: Lint & Type Check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.3"
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Type check
+        run: bun run typecheck
+
+      - name: Lint & format (Biome)
+        run: bunx biome ci .
+
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    needs: [check]
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Build
+        uses: photon-hq/buildspace/.github/blocks/typescript-build@main
+        with:
+          bun-version: "1.3"
+          build-command: "bun run build"

.github/workflows/release.yml

@@ -0,0 +1,21 @@
+name: Release
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  release:
+    uses: photon-hq/buildspace/.github/workflows/typescript-service-release.yaml@main
+    permissions:
+      contents: write
+      pull-requests: read
+    with:
+      service-name: codex
+      bun-version: "1.3"
+      build-command: "bun run build"
+      no-npm-publish: true
+    secrets:
+      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+      APP_ID: ${{ secrets.APP_ID }}
+      APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}

.gitignore

@@ -0,0 +1,59 @@
+# dependencies
+node_modules/
+.pnp
+.pnp.*
+
+# next
+.next/
+out/
+
+# production
+build/
+dist/
+
+# misc
+.DS_Store
+*.pem
+
+# debug
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+.pnpm-debug.log*
+
+# env
+.env
+.env.local
+.env*.local
+
+# typescript
+*.tsbuildinfo
+tsconfig.tsbuildinfo
+next-env.d.ts
+
+# bun — lockfile IS committed for reproducible `bun install --frozen-lockfile`
+# in Docker builds. Only the legacy binary lockfile is ignored.
+bun.lockb
+
+# IDE
+.vscode/
+.idea/
+
+# local test/screenshot artifacts (Playwright MCP, ad-hoc captures)
+.playwright-mcp/
+*-stage.png
+test-results/
+playwright-report/
+
+# drizzle
+drizzle/migrations.json
+
+# deploy state (per-platform, never committed)
+.railway/
+railway.json
+railway.toml
+.vercel/
+.fly/
+fly.toml
+deploy/
+.deploy-state

Dockerfile

@@ -0,0 +1,43 @@
+ARG BUN_VERSION=1.3
+ARG NODE_VERSION=22
+
+FROM oven/bun:${BUN_VERSION}-alpine AS deps
+WORKDIR /app
+COPY package.json bun.lock* ./
+RUN bun install --frozen-lockfile
+
+FROM oven/bun:${BUN_VERSION}-alpine AS builder
+WORKDIR /app
+ENV NEXT_TELEMETRY_DISABLED=1
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+RUN bun run build
+
+FROM oven/bun:${BUN_VERSION}-alpine AS runner
+WORKDIR /app
+ENV NODE_ENV=production \
+    NEXT_TELEMETRY_DISABLED=1 \
+    PORT=3000 \
+    PROCESS=webapp
+
+RUN apk add --no-cache nodejs ca-certificates tini \
+ && addgroup -S app && adduser -S -G app app
+
+COPY --from=builder --chown=app:app /app/.next/standalone ./
+COPY --from=builder --chown=app:app /app/.next/static ./.next/static
+COPY --from=builder --chown=app:app /app/public ./public
+
+COPY --from=builder --chown=app:app /app/bridge ./bridge
+COPY --from=builder --chown=app:app /app/lib ./lib
+COPY --from=builder --chown=app:app /app/db ./db
+COPY --from=builder --chown=app:app /app/scripts ./scripts
+COPY --from=builder --chown=app:app /app/node_modules ./bridge-node_modules
+COPY --from=builder --chown=app:app /app/tsconfig.json ./tsconfig.json
+COPY --from=builder --chown=app:app /app/package.json ./package.json
+
+RUN ln -s /app/bridge-node_modules /app/node_modules || true
+
+USER app
+EXPOSE 3000
+ENTRYPOINT ["/sbin/tini", "--"]
+CMD ["bun", "scripts/entrypoint.ts"]

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Photon
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,30 @@
+# Codex on iMessage
+
+A coding agent that helps you build and ship with AI — powered by ChatGPT, now on iMessage.
+
+## How it works
+
+1. Paste your OpenAI API key
+2. Connect Spectrum and get a phone number
+3. Open iMessage with the number and start chatting
+
+Codex replies in the same thread. Send `/new` any time to start a fresh conversation.
+
+## Commands
+
+| Message                  | What it does                                            |
+| ------------------------ | ------------------------------------------------------- |
+| _anything_               | Asks Codex. Stateful — follow-ups remember the context. |
+| `/new`                   | Resets the conversation. Bot reacts with 👌 to confirm. |
+
+## Privacy
+
+- Your OpenAI API key is AES-256-GCM encrypted at rest. Plaintext only exists in memory
+  while a message is being answered.
+- Messages go directly to OpenAI's Responses API — nothing is shared with third parties.
+- Revoke your key on the OpenAI dashboard any time; the bot will stop replying until you
+  rotate it.
+
+## License
+
+MIT.

app/api/oauth/device/poll/route.ts

@@ -0,0 +1,56 @@
+import { pollDeviceToken } from "@/lib/spectrum";
+import { cookies } from "next/headers";
+import { NextResponse } from "next/server";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+export async function POST() {
+  const jar = await cookies();
+  const deviceCode = jar.get("device_code")?.value;
+  if (!deviceCode) {
+    return NextResponse.json(
+      { status: "error", reason: "no device flow in progress" },
+      { status: 400 },
+    );
+  }
+
+  let result: Awaited<ReturnType<typeof pollDeviceToken>>;
+  try {
+    result = await pollDeviceToken(deviceCode);
+  } catch (err) {
+    console.error("[oauth/device/poll] failed:", err);
+    const host = process.env.SPECTRUM_API_HOST ?? "<unset>";
+    return NextResponse.json(
+      { status: "error", reason: `Couldn't reach Spectrum at ${host}` },
+      { status: 502 },
+    );
+  }
+
+  if (result.ok) {
+    jar.set("bearer", result.token.access_token, {
+      httpOnly: true,
+      sameSite: "lax",
+      secure: process.env.NODE_ENV === "production",
+      path: "/",
+      maxAge: result.token.expires_in ?? 60 * 60 * 24 * 7,
+    });
+    jar.delete("device_code");
+    return NextResponse.json({ status: "ok" });
+  }
+
+  switch (result.error) {
+    case "authorization_pending":
+      return NextResponse.json({ status: "pending" });
+    case "slow_down":
+      return NextResponse.json({ status: "slow_down" });
+    case "access_denied":
+      jar.delete("device_code");
+      return NextResponse.json({ status: "denied" });
+    case "expired_token":
+      jar.delete("device_code");
+      return NextResponse.json({ status: "expired" });
+    default:
+      return NextResponse.json({ status: "error", reason: result.error });
+  }
+}