Codex: Codex プロンプトのベストプラクティス

# 悪いプロンプト
"Help me write a function"

# 良いプロンプト
"In src/utils/date.ts, create a formatDate function,
input: Date object and locale string,
output: localized date string,
follow the style of formatNumber in the same file,
include null handling and unit tests."

[Goal]: 何を達成するか
[Scope]: どのファイル/ディレクトリを変更するか
[Reference]: どの既存コードを参照するか
[Constraints]: どのルールに従うか
[Verification]: 完了をどう確認するか

[Goal] ユーザーパスワードリセット機能を追加
[Scope] src/auth/reset.ts, src/api/reset.ts
[Reference] src/auth/login.ts のコードスタイル
[Constraints] bcrypt ハッシュを使用、トークンは1時間で有効期限切れ
[Verification] npm test -- --grep "reset" がすべて通過

Step 1: Create PasswordReset model with token, expires_at, user_id fields
Tell me when done, I'll confirm before continuing to step 2.

Step 2: Implement POST /api/auth/reset-request endpoint
Step 3: Implement POST /api/auth/reset-confirm endpoint
Step 4: Write integration tests for all endpoints

# 良い：特定のファイルを参照
> Follow the User type definition in src/models/user.ts, add Profile type

# 悪い：曖昧な説明
> Follow existing models, add new ones

# App で画像を添付
> Implement this page following the UI layout in the screenshot

# エラーログを参照
> Output from cat error.log:
> TypeError: Cannot read property 'id' of undefined
> Fix this error

> Project uses Next.js 14 + App Router + TypeScript
> Database uses Prisma ORM + PostgreSQL
> Test framework is Vitest
> Add CRUD functionality for the new page

# テストの実行を要求
> Ensure npm test passes
> Run pytest, fix all failing cases
> Test coverage no less than 80%

> Ensure tsc --noEmit has no errors
> Add complete TypeScript type annotations

> Ensure eslint has no errors
> Fix all lint warnings

Add pagination to the orders API:
1. Modify GET /api/orders endpoint
2. Support page and pageSize query parameters
3. Return pagination metadata
4. Ensure tsc --noEmit has no errors
5. Ensure eslint has no errors
6. npm test all pass
7. New tests covering pagination logic

Fix <Bug-description> in <file>.
Error message: <paste-error-log>
Expected behavior: <correct-behavior>
Ensure <verify-command> passes.

Add <feature> to <module>.
Follow the code style of <existing-file>.
Include input validation and error handling.
Write unit tests, ensure <verify-command> passes.

Refactor <old-impl> to <new-impl>.
Maintain the external interface.
Ensure all existing tests pass.
Add new tests covering the new implementation.

Review <file/PR>, focusing on:
1. Security vulnerabilities (SQL injection, XSS, etc.)
2. Performance issues (N+1 queries, memory leaks, etc.)
3. Code style consistency
4. Error handling completeness
5. Test coverage

Generate documentation for <module/API>:
- API interface docs (Markdown format)
- Usage examples (including curl commands)
- Parameter description table
- Error code list

You are a senior security engineer specializing in Web security.
Review the following code for security vulnerabilities, categorized by OWASP Top 10.

Output in the following format:
1. One issue per line
2. Format: [Severity] file:line - Issue description
3. Severity: 🔴Critical 🟡Medium 🟢Low
4. Finally, provide a fix priority ranking

Only use dependencies already in the project, do not install new packages.
Do not modify .env files.
Do not delete existing tests.
All new functions must have TypeScript type annotations.