Codex: Codex Prompt Best Practices

# Bad Prompt
"Help me write a function"

# Good Prompt
"In src/utils/date.ts, create a formatDate function,
input: Date object and locale string,
output: localized date string,
follow the style of formatNumber in the same file,
include null handling and unit tests."

[Goal]: What to accomplish
[Scope]: Which files/directories to modify
[Reference]: Which existing code to reference
[Constraints]: What rules to follow
[Verification]: How to verify completion

[Goal] Add user password reset feature
[Scope] src/auth/reset.ts, src/api/reset.ts
[Reference] Code style of src/auth/login.ts
[Constraints] Use bcrypt hashing, token expires in 1 hour
[Verification] npm test -- --grep "reset" all pass

Step 1: Create PasswordReset model with token, expires_at, user_id fields
Tell me when done, I'll confirm before continuing.

Step 2: Implement POST /api/auth/reset-request endpoint
Step 3: Implement POST /api/auth/reset-confirm endpoint
Step 4: Write integration tests for all endpoints

# Good: reference specific files
> Follow the User type definition in src/models/user.ts, add Profile type

# Bad: vague description
> Follow existing models, add new ones

# Attach images in the App
> Implement this page following the UI layout in the screenshot

# Reference error logs
> Output from cat error.log:
> TypeError: Cannot read property 'id' of undefined
> Fix this error

> Project uses Next.js 14 + App Router + TypeScript
> Database uses Prisma ORM + PostgreSQL
> Test framework is Vitest
> Add CRUD functionality for the new page

# Require running tests
> Ensure npm test passes
> Run pytest, fix all failing cases
> Test coverage no less than 80%

> Ensure tsc --noEmit has no errors
> Add complete TypeScript type annotations

> Ensure eslint has no errors
> Fix all lint warnings

Add pagination to the orders API:
1. Modify GET /api/orders endpoint
2. Support page and pageSize query parameters
3. Return pagination metadata
4. Ensure tsc --noEmit has no errors
5. Ensure eslint has no errors
6. npm test all pass
7. New tests covering pagination logic

Fix <Bug-description> in <file>.
Error message: <paste-error-log>
Expected behavior: <correct-behavior>
Ensure <verify-command> passes.

Add <feature> to <module>.
Follow the code style of <existing-file>.
Include input validation and error handling.
Write unit tests, ensure <verify-command> passes.

Refactor <old-impl> to <new-impl>.
Maintain the external interface.
Ensure all existing tests pass.
Add new tests covering the new implementation.

Review <file/PR>, focusing on:
1. Security vulnerabilities (SQL injection, XSS, etc.)
2. Performance issues (N+1 queries, memory leaks, etc.)
3. Code style consistency
4. Error handling completeness
5. Test coverage

Generate documentation for <module/API>:
- API interface docs (Markdown format)
- Usage examples (including curl commands)
- Parameter description table
- Error code list

You are a senior security engineer specializing in Web security.
Review the following code for security vulnerabilities, categorized by OWASP Top 10.

Output in the following format:
1. One issue per line
2. Format: [Severity] file:line - Issue description
3. Severity: 🔴Critical 🟡Medium 🟢Low
4. Finally, provide a fix priority ranking

Only use dependencies already in the project, do not install new packages.
Do not modify .env files.
Do not delete existing tests.
All new functions must have TypeScript type annotations.