[codex] Harden account storage and web access

Launch Codex Switcher Dashboard.cmd

@@ -0,0 +1,3 @@
+@echo off
+setlocal
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File "%~dp0scripts\launch-dashboard.ps1"

README.md

@@ -49,16 +49,28 @@ The built application will be in `src-tauri/target/release/bundle/`.
 You can also serve the built dashboard over HTTP instead of opening the Tauri shell.
 
 ```bash
-# Build the frontend and start the web server on 0.0.0.0:3210
+# Build the frontend and start the web server on 127.0.0.1:3210
 pnpm lan
 ```
 
+For everyday use on Windows, launch the hardened local dashboard in a standalone
+browser app window instead of a tab:
+
+```bash
+pnpm dashboard
+```
+
+You can also double-click `Launch Codex Switcher Dashboard.cmd`.
+
 Optional environment variables:
 
-- `CODEX_SWITCHER_WEB_HOST` to override the bind host
+- `CODEX_SWITCHER_WEB_HOST` to override the bind host. Non-local hosts require a session token.
 - `CODEX_SWITCHER_WEB_PORT` to override the port
+- `CODEX_SWITCHER_WEB_TOKEN` to provide a fixed session token instead of generating one
+
+The browser dashboard serves the same UI and backend actions through `/api/invoke/*`. If you bind to a non-local host such as `0.0.0.0`, the server prints a tokenized URL that must be opened before the dashboard can call backend actions.
 
-The browser dashboard serves the same UI and backend actions through `/api/invoke/*`, which makes it usable over LAN, Tailscale, or a remote host tunnel when you expose the chosen port safely.
+Full account backups are encrypted with the passphrase you enter during export. The same passphrase is required during import.
 
 ## Disclaimer
 

package.json

@@ -7,8 +7,10 @@
   "scripts": {
     "dev": "vite",
     "build": "tsc && vite build",
+    "dashboard": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/launch-dashboard.ps1",
+    "test:web-safe": "node scripts/check-web-safe-tauri-window.mjs",
     "preview": "vite preview",
-    "tauri": "sh ./scripts/tauri.sh",
+    "tauri": "node ./scripts/tauri.mjs",
     "lan": "pnpm build && cargo run --manifest-path src-tauri/Cargo.toml --bin codex-web",
     "version:bump": "node scripts/bump-version.mjs",
     "version:patch": "node scripts/bump-version.mjs patch",
@@ -29,13 +31,13 @@
     "react-dom": "^19.1.0"
   },
   "devDependencies": {
-    "@tailwindcss/vite": "^4.1.18",
+    "@tailwindcss/vite": "^4.3.0",
     "@tauri-apps/cli": "^2",
     "@types/react": "^19.1.8",
     "@types/react-dom": "^19.1.6",
-    "@vitejs/plugin-react": "^4.6.0",
-    "tailwindcss": "^4.1.18",
+    "@vitejs/plugin-react": "^4.7.0",
+    "tailwindcss": "^4.3.0",
     "typescript": "~5.8.3",
-    "vite": "^7.0.4"
+    "vite": "^7.3.5"
   }
 }