decode-codex skill
Two skills extract code from the installed ChatGPT macOS app and turn minified JavaScript into readable source with real names.
- 139 ★ on the repository
- Last commit
Broad access
Why this level
- Reverse engineering a third-party app: the code belongs to OpenAI and ChatGPT terms limit use.
- The script deletes and recreates the `./ref` folder.
- The agent runs `node` and `bun` scripts on your machine.
Install
- Works in
Manual install
node .agents/skills/codex-app-ref-refresh/scripts/refresh-codex-ref.mjsFirst run command from the README. There is no install: skills live in `.agents/skills` and the second one's dependencies come from `bun install`.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Reverse engineering a third-party app: the code belongs to OpenAI and ChatGPT terms limit use.
- The script deletes and recreates the `./ref` folder.
- The agent runs `node` and `bun` scripts on your machine.
This is third-party code. Review the repository files before installing.
What it does
decode-codex is a repository with two agent skills. The first, `codex-app-ref-refresh`, takes `app.asar` from the installed `/Applications/ChatGPT.app`, extracts it into `./ref` and formats files with Prettier. The second, `deobfuscate-javascript`, restores bundled JS into readable code: the agent chooses meaningful names while `bun` scripts do the mechanical work. Output goes to `./restored` with semantic subfolders, provenance headers and a shared `IMPORT_MAP.json`. A default mode and a deep mode exist, the latter adding typed `.tsx` and an acceptance review. The author frames it as personal study and interoperability research, and the extracted code belongs to OpenAI.
Who it is for. Developers studying the structure of an installed desktop app and interoperability with it. Needs macOS, Node.js and Bun.
Good fit when
- Reading the web part of the ChatGPT app in the version installed locally.
- Turning a minified bundle into readable code with clear names.
- After an app update, `./ref` is rebuilt and changes are compared.
- A single unclear JS function is handed to the agent for analysis.
Not a fit when
- The ChatGPT macOS app is not installed, since the skill reads only that install.
- The extracted code is meant to be published or redistributed.
- An official API is needed rather than client analysis.
Example request
Refresh `./ref` from the installed ChatGPT app, then restore `ref/webview/assets` into readable code and show the import map.Limitations
`codex-app-ref-refresh` deletes and recreates `./ref`, so run it only from the directory that owns that folder. The repository has no license. The app code belongs to OpenAI, the ChatGPT terms apply to the result, and `ref` and `restored` must not be redistributed. Restored names are invented by a model and do not guarantee the original meaning. It works only with an app installed on macOS.
How to disable. Remove the `codex-app-ref-refresh` and `deobfuscate-javascript` skill folders from the project, plus the `ref` and `restored` folders.
FAQ
What is required to run it?
macOS with `/Applications/ChatGPT.app`, Node.js and Bun. The agent must read skills from `.agents/skills`, as Claude Code or Codex do.
What does `--dry-run` do?
It prints resolved paths and deletes or extracts nothing. Use it to check the run before the first `./ref` wipe.
Can the app be elsewhere?
Yes, set `CHATGPT_APP_ASAR` to the path of `app.asar`. The old alias `CODEX_APP_ASAR` also works.
How does deep mode differ?
It adds typed `.tsx`, npm import resolution, a full import graph and an acceptance loop. Words such as deep or production switch it on.
May the output be published?
No. The app code belongs to OpenAI and the author asks not to redistribute extracted or restored code.
Discussion
No questions or reviews yet.
Related
SkillsNine skills turn a repository of agent workflows into a validated, deterministically packaged ChatGPT or Codex plugin
A Codex skill hands planning and review to ChatGPT over a local MCP bridge and keeps execution and checks in Codex
Codex Settings skills
Codex CLI Skills & Profiles
A Codex CLI plugin with twelve skills: deep research, pull request review, image generation and session handoff
Eleven skills for Claude Code and Codex: test audit, git worktree cleanup, plan pages, screen recording transcripts and 1Password sign-in
The author's personal set: shared agent rules and dozens of skills for GitHub, the browser, macOS, messaging and releases, plus a sync script
A CLI that gives six coding agents project context, over 80 skills, verification and resumable tasks across sessions
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| decode-codex (this card) | no | 139 | |
| reverse-skill | no | 44,569 | a skill for third-party web clients with signatures and bot protection; here the unpacking and reading of your own ChatGPT install |
| Reverse Engineering Skills | no | 2,355 | extracts behavioural specifications from a codebase; here minified JS is deobfuscated |
README in short
Readable output is produced in stages: deobfuscation, smart renaming, polish. Scripts keep staging files separate and promote only finished ones to `./restored`.