The Problem

Codexia functions as a Tauri v2 workstation bridging Codex CLI and Claude Code, consolidating agent workflows, git worktree management, and a headless web server into a single desktop application. The codebase spans 909 code files across TypeScript and Rust, with significant interdependence between frontend and backend layers. For engineers tasked with modifying or extending the system, the import graph reveals 1199 edges and 4 circular dependencies that create blast-radius risks when changes propagate through hub modules.

What This Does

Codexia is a desktop agent control center built on Tauri v2. The frontend (src/, 796 files) runs React + TypeScript + Zustand + shadcn/ui, while the desktop backend (src-tauri/src/, 166 files) provides Rust logic. A headless web server (src-tauri/src/web_server/) exposes Axum routes for remote control. Agent sessions flow through Codex app-server JSON-RPC integration (src-tauri/src/codex/), with skills managed under src-tauri/src/features/skills.rs. The frontend invokes Tauri commands via src/services/tauri/, and real-time updates flow through WebSocket broadcasts at /ws (src-tauri/src/web_server/handlers/git.rs handles git worktree operations). The system reads/write files (15 functions), databases (15 functions), runs external commands (1 function), and calls models for inference (1 function).

How It Is Wired

Execution begins at src-tauri/src/main.rs:48, which reaches 44 functions and is called by nothing else in the repo. From main, control flows to start_server → start_web_server → connect_codex, a path that leaves the process via command.spawn(). The internal call graph shows to_value called from 39 places and send_request from 31 places as the most widely connected functions. Hub modules with high blast radius include src/bindings/v2/index (352 imports received, 1 importer) and src/bindings/index (76 imports received, instability 0.99). Four circular import members exist across PermissionRequestCard.tsx, messages/index.tsx, and CCMessage.tsx, requiring type extraction or dependency inversion to break. The most connected module src/bindings/v2/index is imported by 352 other modules — a change there ripples broadly. Entry points also include start (src-tauri/src/p2p/server.rs:50, reaches 28 functions) and run (src-tauri/src/lib.rs:27, reaches 1 function).

How To Use It

Setup: Clone with git clone https://github.com/moses-y/codexia. The repo uses npm/pnpm (package.json present). No Dockerfile exists; build requires Tauri CLI and Rust toolchain.

Configuration: Environment variables are defined in .env.example (root) and bots/discord/.env.example, bots/telegram/.env.example. The Tauri config lives in src-tauri/Cargo.toml. No license key is required for local use, but Codex CLI and Claude Code CLI must be installed and configured per their respective docs.

Running it: Launch the built application or use brew tap milisp/codexia && brew install --cask codexia (macOS). The README also lists GitHub Releases for prebuilt macOS/Linux/Windows binaries. No internal CLI script is provided beyond the Tauri binary.

Real-World Use

A developer launches Codexia, adds a project directory, and enters a prompt to start an agent session. The frontend sends the request through Tauri commands to the Rust backend, which integrates with Codex app-server JSON-RPC to initialize a thread. The headless web server starts on a local port, exposing /api/codex/thread/* and /api/codex/turn/* endpoints for browser-based monitoring. A task scheduler job can be created via /api/automation/* to recur at intervals. The agent runs in a separate process with configured file and network permissions, and progress streams via WebSocket at /ws.

Code Health & Issues

The static analysis identified the following findings:

  • HIGH - Pin third-party GitHub Actions to a commit SHA: .github/workflows declares dtolnay/rust-toolchain@stable, Swatinem/rust-cache@v2, oven-sh/setup-bun@v2, tauri-apps/tauri-action@v0 without commit pins. Tags can move, so CI runs with whatever the owner last pushed — a known vector for credential leakage.
  • MEDIUM - Declare least-privilege permissions for GITHUB_TOKEN: .github/workflows/ci-linux-arm.yml declares no permissions and references secrets, so the token inherits repository defaults allowing push and release minting.
  • MEDIUM - Enable Dependabot or Renovate: 4 manifest files exist with no update bot configured. Without a bot, advisories remain unpatched.
  • MEDIUM - Gate pull requests on a dependency vulnerability scan: no dependency scan appears in CI. A known-vulnerable package could reach production without detection.
  • MEDIUM - Expand the test suite: 1 test file against 905 source files (ratio 0.001). A green test badge does not indicate meaningful coverage.
  • LOW - Set timeout-minutes on workflow jobs: .github/workflows/ci-linux-arm.yml and 3 other workflows declare no job timeout, risking overlap on the platform six-hour default.
  • LOW - Add convention files: missing .editorconfig, .gitattributes with text=auto eol=lf, and formatter config.

The Bottom Line

Codexia is a functional Tauri v2 workstation that successfully integrates Codex CLI and Claude Code agent workflows into a single desktop interface. The architecture is serviceable — React frontend, Rust backend, headless Axum server — but the import graph has significant coupling: hub modules like src/bindings/v2/index are imported by 352 other modules, and four circular dependencies exist across message components. Health issues center on CI hygiene (pinned Action SHAs, dependency scanning, test coverage) rather than code functionality. Engineers who need to modify agent session handling, git worktree operations, or the web server API will find the code navigable but must respect the high-blast-radius modules. It is suitable for teams already invested in Codex CLI + Claude Code who need a local agent control center, but the CI and test gaps should be addressed before relying on it for critical paths.