lidge-jun · luvs01 · Aug 12, 2026 · Aug 12, 2026 · Aug 12, 2026 · Aug 12, 2026
@@ -5,8 +5,8 @@ user's machine. It is not about contributing to this repository — that is
 [`AGENTS.md`](./AGENTS.md), and nothing here concerns you if you are only
 reading or changing this codebase.
 
-There is one rule, and it exists because `ocx start` can print a question that
-an agent is capable of answering and must not.
+There is one consent rule, and it covers user-owned identity and scarce credits
+that an agent is capable of spending and must not.
 
 For everything else about driving opencodex from a scripted terminal —
 installation, `ocx init`, headless flags, exit codes — see the
@@ -22,7 +22,8 @@ install or operations task authorizes, and an agent must never perform or
 auto-answer them — even when the surrounding task is approved, even when the
 credential is sitting right there.
 
-The current one is **starring the repository on GitHub**.
+The current consent-bound actions are **starring the repository on GitHub** and
+**consuming a Codex reset credit**.
 
 ### Do not
 
@@ -35,6 +36,13 @@ The current one is **starring the repository on GitHub**.
   `ocx service install`. When an agent is detected the prompt is deliberately
   suppressed and its one-time marker left unwritten, so the user still gets the
   real question on their own next run.
+- Do **not** run `ocx account reset-credits <id|main> --consume --yes` or call
+  `POST /api/codex-auth/reset-credits/consume` on the user's behalf. Inspecting
+  reset credits is read-only and allowed; consuming one is not. Agent-driven
+  CLI runs are refused, and the API returns `403 agent_consent_required` unless
+  the request carries a dashboard GUI session or the CLI's short-lived,
+  one-shot local consent capability. A reusable admin token or a client
+  `confirmed` field is not consent; do not route around either refusal.
 
 ### Do
 
@@ -60,18 +68,30 @@ reads, so the CLI prints one dim line and this file carries the contract.
 
 ## Where the enforcement lives
 
-Reading this file is not what makes the boundary hold — the code refuses
-agent-driven callers regardless:
+Reading this file is not what makes the boundary hold — the code refuses known
+agent-driven callers on the normal path. Like the dashboard session, local
+capability checks are not proof of human presence: a determined process running
+as the same user can reach the same local secrets and browser surface. The rule
+above is the actual boundary and remains binding even when those mechanisms are
+technically reachable:
 
 - [`src/cli/agent-driven.ts`](./src/cli/agent-driven.ts) — agent detection.
 - [`src/cli/star-prompt.ts`](./src/cli/star-prompt.ts) — prompt suppression and
   the one-time marker.
 - [`src/server/management/sidebar-routes.ts`](./src/server/management/sidebar-routes.ts)
   — the `403 agent_consent_required` refusal.
+- [`src/cli/account-auth.ts`](./src/cli/account-auth.ts) and
+  [`src/cli/reset-credit-consent-client.ts`](./src/cli/reset-credit-consent-client.ts)
+  — hand-typed reset-credit consent and one-shot capability transport.
+- [`src/codex/auth-api.ts`](./src/codex/auth-api.ts) and
+  [`src/server/management-auth.ts`](./src/server/management-auth.ts) — consent
+  principal enforcement before any reset-credit dispatch.
 
 Regression coverage: `tests/startup-prompt.test.ts`,
-`tests/agent-driven.test.ts`, `tests/sidebar-routes.test.ts`.
+`tests/agent-driven.test.ts`, `tests/sidebar-routes.test.ts`,
+`tests/cli-account.test.ts`, `tests/reset-credit-consent-client.test.ts`,
+`tests/server-management-auth.test.ts`, and `tests/codex-auth-api.test.ts`.
 
-If a future action spends the user's identity, credits, or reputation, gate it
+If another action spends the user's identity, credits, or reputation, gate it
 the same way rather than relying on a prompt an agent can answer, and document
 it here.
@@ -54,6 +54,15 @@ most once per opencodex version, and a later version asks again on its own. Star
 only after an explicit yes; an explicit no settles it permanently and is never raised again.
 :::
 
+:::caution[Codex reset-credit consent]
+Inspecting reset credits is read-only. Never run `ocx account reset-credits <id|main> --consume --yes`
+or call the consume endpoint on the user's behalf. Agent-driven attempts are refused with
+`agent_consent_required`; do not bypass the refusal with an admin token or a client `confirmed`
+field. Only a hand-typed user-confirmed CLI run or the dashboard's GUI session may consume a credit.
+These checks remove the casual automation path but do not prove human presence to a determined
+same-user process; the agent consent rule remains the actual boundary.
+:::
+
 ## Check a headless installation
 
 Use these read-only checks in scripts and agent runs:

@@ -207,7 +207,7 @@ security find-generic-password -w openrouter | ocx account add-key openrouter --
 
 ### `ocx account reset-credits <id|main> [--consume --yes]`
 
-アカウントの Codex リセット クレジットを検査します。クレジットの消費は破壊的であり、`--consume` と `--yes` の両方が必要です。
+アカウントの Codex リセット クレジットを検査します。消費は破壊的なため、ユーザーが手入力で確認した実行で `--consume` と `--yes` の両方が必要です。エージェント駆動の実行は one-shot のローカル同意 capability を発行する前に拒否され、再利用可能な管理トークンでは代替できません。
 
 ### `ocx account main <subcommand>`
 

@@ -217,7 +217,7 @@ Authorization: Bearer <admin-token>
 | `PUT /api/codex-auth/failover` |アカウントのフェイルオーバーしきい値を設定する | 400 無効なしきい値 |
 | `GET /api/codex-auth/quota` |キャッシュされたクォータ状態をアカウントごとに読み取る | — |
 | `GET /api/codex-auth/reset-credits` |アカウントのリセット クレジット資格を検査する | 400 アカウント ID がありません。アップストリームステータスパススルー。 500 検索失敗 |
-| `POST /api/codex-auth/reset-credits/consume` |対象となるリセット クレジットを消費する | 400 アカウント ID がありません。アップストリームステータスパススルー。 503 `server_busy`; 500 消費失敗 |
+| `POST /api/codex-auth/reset-credits/consume` | 対象のリセット クレジットを消費する。GUI session または CLI の one-shot ローカル同意 capability が必要で、再利用可能な管理認証や `confirmed` field では代替不可 | 400 無効な identity; 403 `agent_consent_required`; upstream status passthrough; 503 `server_busy`; 500 消費失敗 |
 | `POST /api/codex-auth/login` | Codex のログインまたは再認証を開始する | 400 無効なリクエスト。競合/ビジー ログイン状態 |
 | `POST /api/codex-auth/login/code` | Codex ログイン フローの手動コードを送信する | 400 無効なフロー/コード |
 | `POST /api/codex-auth/login/cancel` | Codex ログイン フローをキャンセルする | — |

@@ -206,7 +206,7 @@ security find-generic-password -w openrouter | ocx account add-key openrouter --
 
 ### `ocx account reset-credits <id|main> [--consume --yes]`
 
-계정의 Codex reset credits를 확인합니다. credit을 소비하는 동작은 파괴적이므로 `--consume`와 `--yes`를 둘 다 요구합니다.
+계정의 Codex reset credits를 확인합니다. credit 소비는 파괴적이므로 사용자가 직접 입력해 확인한 실행에서 `--consume`와 `--yes`를 둘 다 요구합니다. 에이전트가 실행한 호출은 one-shot 로컬 동의 capability를 만들기 전에 거부되며, 재사용 가능한 관리 토큰으로 대체할 수 없습니다.
 
 ### `ocx account main <subcommand>`
 

@@ -217,7 +217,7 @@ Authorization: Bearer <admin-token>
 | `PUT /api/codex-auth/failover` | account failover threshold를 설정합니다 | 400 잘못된 threshold |
 | `GET /api/codex-auth/quota` | 계정별 캐시된 quota 상태를 읽습니다 | — |
 | `GET /api/codex-auth/reset-credits` | 계정의 reset-credit 자격을 확인합니다 | 400 누락된 account id; upstream 상태 전달; 500 조회 실패 |
-| `POST /api/codex-auth/reset-credits/consume` | 사용할 수 있는 reset credit을 소비합니다 | 400 누락된 account id; upstream 상태 전달; 503 `server_busy`; 500 소비 실패 |
+| `POST /api/codex-auth/reset-credits/consume` | 사용할 수 있는 reset credit을 소비합니다. GUI 세션 또는 CLI의 one-shot 로컬 동의 capability가 필요하며 재사용 가능한 관리 인증이나 `confirmed` 필드로 대체할 수 없습니다 | 400 잘못된 식별자; 403 `agent_consent_required`; upstream 상태 전달; 503 `server_busy`; 500 소비 실패 |
 | `POST /api/codex-auth/login` | Codex 로그인 또는 재인증을 시작합니다 | 400 잘못된 요청; 충돌/바쁨 로그인 상태 |
 | `POST /api/codex-auth/login/code` | Codex 로그인 흐름용 수동 코드를 제출합니다 | 400 잘못된 흐름/code |
 | `POST /api/codex-auth/login/cancel` | Codex 로그인 흐름을 취소합니다 | — |

@@ -279,7 +279,10 @@ security find-generic-password -w openrouter | ocx account add-key openrouter --
 ### `ocx account reset-credits <id|main> [--consume --yes]`
 
 Inspect Codex reset credits for an account. Consuming a credit is destructive and requires both
-`--consume` and `--yes`.
+`--consume` and `--yes` in a hand-typed user-confirmed run. Agent-driven runs are refused before
+the one-shot local consent capability is minted; a reusable management token cannot substitute.
+The CLI durably reuses the same operation identity until a terminal response is observed, so rerun
+the same command after a timeout instead of trying to start a second redemption.
 
 ### `ocx account main <subcommand>`
 

@@ -250,7 +250,7 @@ manager. Its routes are:
 | `PUT /api/codex-auth/failover` | Set the account failover threshold | 400 invalid threshold |
 | `GET /api/codex-auth/quota` | Read cached quota state by account | — |
 | `GET /api/codex-auth/reset-credits` | Inspect reset-credit eligibility for an account | 400 missing account id; upstream status passthrough; 500 lookup failure |
-| `POST /api/codex-auth/reset-credits/consume` | Consume an eligible reset credit | 400 missing account id; upstream status passthrough; 503 `server_busy`; 500 consume failure |
+| `POST /api/codex-auth/reset-credits/consume` | Consume an eligible reset credit; requires a GUI session or the CLI's one-shot local consent capability, not reusable admin auth or a `confirmed` field. The caller must durably reuse its operation ID until a terminal code is observed; quota refresh is a separate follow-up read. | 400 invalid identity; 403 `agent_consent_required`; upstream status passthrough; 503 `server_busy` before settlement; 500 consume failure |
 | `POST /api/codex-auth/login` | Start Codex login or reauthentication | 400 invalid request; conflict/busy login states |
 | `POST /api/codex-auth/login/code` | Submit a manual code for a Codex login flow | 400 invalid flow/code |
 | `POST /api/codex-auth/login/cancel` | Cancel a Codex login flow | — |

@@ -266,8 +266,9 @@ security find-generic-password -w openrouter | ocx account add-key openrouter --
 
 ### `ocx account reset-credits <id|main> [--consume --yes]`
 
-Проверить reset-credit'ы Codex для аккаунта. Расходование кредита разрушительно и требует сразу
-оба флага: и `--consume`, и `--yes`.
+Проверить reset-credit'ы Codex для аккаунта. Расходование кредита необратимо и требует `--consume`
+и `--yes` в запуске, который пользователь ввёл и подтвердил сам. Запуск агентом отклоняется до
+создания одноразового локального consent capability; многоразовый admin token его не заменяет.
 
 ### `ocx account main <subcommand>`
 

@@ -241,7 +241,7 @@ picker изменилась. `catalogRefreshPending: true` в успешном
 | `PUT /api/codex-auth/failover` | Задать порог failover аккаунтов | 400 invalid threshold |
 | `GET /api/codex-auth/quota` | Прочитать кэшированное состояние квоты по аккаунтам | — |
 | `GET /api/codex-auth/reset-credits` | Проверить право аккаунта на reset credit | 400 missing account id; upstream status passthrough; 500 lookup failure |
-| `POST /api/codex-auth/reset-credits/consume` | Израсходовать доступный reset credit | 400 missing account id; upstream status passthrough; 503 `server_busy`; 500 consume failure |
+| `POST /api/codex-auth/reset-credits/consume` | Израсходовать reset credit; требуется GUI session или одноразовый локальный consent capability CLI, а не многоразовая admin auth или поле `confirmed` | 400 invalid identity; 403 `agent_consent_required`; upstream status passthrough; 503 `server_busy`; 500 consume failure |
 | `POST /api/codex-auth/login` | Запустить login или reauthentication для Codex | 400 invalid request; conflict/busy login states |
 | `POST /api/codex-auth/login/code` | Отправить manual code для login-flow Codex | 400 invalid flow/code |
 | `POST /api/codex-auth/login/cancel` | Отменить login-flow Codex | — |

@@ -238,8 +238,8 @@ security find-generic-password -w openrouter | ocx account add-key openrouter --
 
 ### `ocx account reset-credits <id|main> [--consume --yes]`
 
-查看某个账号的 Codex 重置额度。消耗额度会造成破坏性影响，因此同时需要 `--consume`
-和 `--yes`。
+查看某个账号的 Codex 重置额度。消耗额度是破坏性操作，只有用户亲自输入并确认的运行才可同时使用
+`--consume` 和 `--yes`。代理驱动的运行会在签发一次性本地同意 capability 之前被拒绝；可重复使用的管理令牌不能替代该同意。
 
 ### `ocx account main <subcommand>`
 

@@ -219,7 +219,7 @@ Authorization: Bearer <admin-token>
 | `PUT /api/codex-auth/failover` | 设置账户故障转移阈值 | 400 阈值无效 |
 | `GET /api/codex-auth/quota` | 按账户读取缓存的配额状态 | — |
 | `GET /api/codex-auth/reset-credits` | 检查某个账户是否具备 reset-credit 资格 | 400 缺少账户 id；上游状态透传；500 查询失败 |
-| `POST /api/codex-auth/reset-credits/consume` | 消耗一个符合条件的 reset credit | 400 缺少账户 id；上游状态透传；503 `server_busy`；500 消耗失败 |
+| `POST /api/codex-auth/reset-credits/consume` | 消耗 reset credit；需要 GUI session 或 CLI 的一次性本地同意 capability，不能用可重复使用的管理认证或 `confirmed` 字段代替 | 400 身份无效；403 `agent_consent_required`；上游状态透传；503 `server_busy`；500 消耗失败 |
 | `POST /api/codex-auth/login` | 启动 Codex 登录或重新认证 | 400 请求无效；登录状态冲突/忙碌 |
 | `POST /api/codex-auth/login/code` | 为 Codex 登录流程提交手动代码 | 400 流程/代码无效 |
 | `POST /api/codex-auth/login/cancel` | 取消一个 Codex 登录流程 | — |

@@ -161,7 +161,7 @@ security find-generic-password -w openrouter | ocx account add-key openrouter --
 
 ### `ocx account reset-credits <id|main> [--consume --yes]`
 
-檢查帳號的 Codex reset credits。消耗 credit 是破壞性的，需要同時提供 `--consume` 與 `--yes`。
+檢查帳號的 Codex reset credits。消耗 credit 是破壞性操作，僅限使用者親自輸入並確認的執行同時提供 `--consume` 與 `--yes`。代理驅動的執行會在簽發一次性本機同意 capability 前遭拒；可重複使用的管理權杖不能取代該同意。
 
 ### `ocx account priority <provider> <account-id|main> [<-100..100|first|earlier|normal|later|last|reset>] [--json]`
 

@@ -212,7 +212,7 @@ Session 簽發在需要 data-plane 認證時停用，這包含遠端綁定。遠
 | `PUT /api/codex-auth/failover` | 設定帳號容錯移轉閾值 | 400 無效閾值 |
 | `GET /api/codex-auth/quota` | 依帳號讀取快取配額狀態 | — |
 | `GET /api/codex-auth/reset-credits` | 檢查帳號的 reset-credit 資格 | 400 缺失帳號 id；上游狀態 passthrough；500 查詢失敗 |
-| `POST /api/codex-auth/reset-credits/consume` | 消耗一個合格的 reset credit | 400 缺失帳號 id；上游狀態 passthrough；503 `server_busy`；500 消耗失敗 |
+| `POST /api/codex-auth/reset-credits/consume` | 消耗 reset credit；需要 GUI session 或 CLI 的一次性本機同意 capability，不能以可重複使用的管理認證或 `confirmed` 欄位取代 | 400 身分無效；403 `agent_consent_required`；上游狀態 passthrough；503 `server_busy`；500 消耗失敗 |
 | `POST /api/codex-auth/login` | 啟動 Codex 登入或重新認證 | 400 無效請求；衝突／忙碌登入狀態 |
 | `POST /api/codex-auth/login/code` | 為 Codex 登入流程提交手動碼 | 400 無效流程／碼 |
 | `POST /api/codex-auth/login/cancel` | 取消 Codex 登入流程 | — |