codex-image-gallery
Start or reuse a self-contained local web gallery for browsing Codex-generated images. Use when the user asks to browse Codex generated images, open a local image gallery, inspect ~/.codex/generated_images, view a Codex image output folder, or browse image files produced by Codex.
1How It Works & Mechanism
Self-contained local service: scripts/server.mjs is a pure Node stdlib HTTP server (zero third-party packages) bound to 127.0.0.1 on default port 8765, which automatically increments by +1 if occupied (up to +20); the UI template assets/index.html is served from the same directory.
The server prints the actual URL. It starts at `http://127.0.0.1:8765/` and tries later ports if the default is occupied.
Only two API surfaces: GET /api/images recursively walks the image root directory and returns {rootPath, items[](path/mtime/size)} (sorted by mtime descending); GET /images/<rel> streams the image file—both enforce path traversal protection (safePath validates that the resolved path stays inside root).
if (fullPath !== root && !fullPath.startsWith(`${root}${path.sep}`)) { return null; }
'Reuse-first' protocol: probes the default URL via fetch /api/images first (reuses running server on success); if failed, runs pgrep to locate the process and tests subsequent ports; only launches a new server as the last resort—preventing multiple stacked instances per request.
If this succeeds, reuse the running server at `http://127.0.0.1:8765/`.
Frontend index.html renders grid/lightbox/batch tags via same-origin fetch('/api/images'), entirely powered by local data with zero third-party CDN/font/script dependencies.
const response = await fetch("/api/images", { cache: "no-store" });
Verification path is automatically testable: node --check syntax + after startup check that /api/images returns items, /images/<rel> serves images, and index page comes from bundled index.html—SKILL explicitly requires running these three checks after code changes before claiming healthy.
Before declaring the skill healthy after edits, run: `node --check scripts/server.mjs`
2Core Capabilities
3External Dependencies
| Kind | Dependency / Endpoint |
|---|---|
| cli | node（运行 server.mjs；SKILL 亦用 node -e fetch 做探测） |
| cli | pgrep（探测已有 server 进程） |
| cli | open（可选，打开浏览器到本地 URL） |
4Recommended Governance & Evidence
- scripts/: Execute local scripts or commands: node scripts/server.mjs (local HTTP service, pure stdlib)
- 环境变量 / API Key: Read vendor service API keys: None
- 本地工作目录: File I/O and artifact output: None (server only reads image directory and assets; does not write any files)
5Second-Pass Verification
- [ok] 绑定地址与端口递增 — server.mjs 'HOST = process.env.HOST || "127.0.0.1"' + 'error.code === "EADDRINUSE" && port < DEFAULT_PORT + 20'。
- [ok] 路径穿越防护 — safePath resolve 后 prefix 校验，越界 403；decodeURIComponent 包 try/catch。
- [ok] 无外发网络/第三方依赖 — server imports 仅 node:http/fs/os/path/url；index.html 外链扫描仅同源。
- [ok] SKILL 探测复用协议可实现性 — fetch('/api/images')、pgrep pattern 'node .*server\.mjs' 与 server 实际进程命令行一致（node scripts/server.mjs）。
- [ok] 鉴权缺失的暴露半径 — 代码无任何鉴权/CORS 头；暴露限于回环（本机）——已在 risk 记录；浏览器 PNA 缓解无法在源码验证，标注为宿主/浏览器行为。
- [unlocatable] 真实浏览器端渲染验证 — index.html 视觉行为未在浏览器实测（本环境无 Codex 图片目录/浏览器），验证止于静态代码与 SKILL 自述。
6Verdict & Scenarios
b2b0045b3baaf9a9…