Module codex 

Codex CLI transcripts — ~/.codex/sessions/YYYY/MM/DD/rollout-<iso>-<uuid>.jsonl.

Every line is {"timestamp":…, "type":…, "payload":…}. Four line types matter and the rest are the CLI talking to itself:

session_meta   the session's id, cwd and start time      (first line)
response_item  the model conversation, one item per line
event_msg      the CLI's own event stream                (see below)
world_state    workspace snapshots — ignored
turn_context   sandbox and approval settings — ignored

Inside response_item, payload.role is user, assistant or developer — and developer is the harness: permission instructions, agent-team rules, mode switches. It is dropped, or every Codex archive would open with the sandbox policy recorded as something the user said.

Which user turns are real

Dropping developer is not enough. Codex also injects text under role: "user" — this machine’s transcripts all begin with a <recommended_plugins> catalogue nobody typed — and nothing in the record itself distinguishes it from a prompt.

The CLI’s own event stream does distinguish it: a real prompt is mirrored as event_msg with payload.type = "user_message", whose message is byte identical to the prompt, and the injected blocks are not mirrored. So a user-role item counts as a turn when the file mirrors it as a user message — and when a file has no such events at all (a Codex build that does not emit them), every user-role item is kept, because losing the human’s side entirely is the worse failure.

Structs

CodexTranscripts

Codex’s session records.