[WRONG BRANCH] fix(security): require dashboard consent for Codex restart

[luvs01]

Motivation

• A newly-declared agent-facing CLI and capability let a local coding agent call the restart path with --yes, which used the raw admin token attached by runtimeRequest and allowed interruption without a dashboard-confirmed GUI session.
• The restart operation can interrupt in-flight editor turns and must be guarded by the operator consent boundary (a minted dashboard gui-session), not by an agent-controllable flag.
• The change defers the restart capability from agent discovery and ensures the management route enforces the documented consent model before resolving the restart service.

Description

• Add a fail-closed principal check to the restart branch in src/server/management/system-routes.ts so POST /api/system/codex-restart returns HTTP 403 unless ctx.principal === "gui-session".
• Remove the agent-callable CLI verb and flag for restart from src/cli/system-command.ts and drop the restart entry from the capability index in src/cli/capabilities.ts.
• Mark the management route as session-only in src/server/management/route-registry.ts (exemption session-only) and update the exemption type so this rationale is expressible.
• Add regression coverage in tests/codex-restart-route.test.ts asserting that callers with admin-token or a missing principal are rejected before performRestart runs and regenerate the skills/ocx surface reference to reflect the removal of the CLI capability.

Testing

• ✅ Ran focused tests: ./node_modules/bun/bin/bun.exe test tests/codex-restart-route.test.ts tests/cli-capabilities.test.ts tests/cli-dispatch.test.ts tests/skill-ocx.test.ts, which completed with 61 passed and 0 failed.
• ✅ Regenerated and checked the CLI skill surface with ./node_modules/bun/bin/bun.exe run skill:surface:check which is current.
• ✅ Type-checked the code with ./node_modules/bun/bin/bun.exe run typecheck and ran ./node_modules/bun/bin/bun.exe run privacy:scan, both of which passed.
• ⚠️ A repository-wide bun run test was attempted but produced unrelated timeouts/failures in the large parallel suite (Lab automation, API-key attribution, server-auth, and other unrelated tests); these failures are pre-existing and not caused by this focused security fix.

---

Codex Task

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: b9474375-b219-4361-a257-8def279ae47e

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-30T05:37:05.818129Z	5d163e5	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev.

What to do

• Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5d163e5f74

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Support Codex restart from remote dashboards

When the proxy uses a non-loopback bind, issueGuiSession returns null (src/server/management-auth.ts:250), so the supported remote dashboard signs in with the raw admin token and managementPrincipal resolves it as admin-token (src/server/management-auth.ts:436-442). This check therefore returns 403 for every restart confirmed in a remote dashboard, permanently breaking its restart control. Provide a consent flow that can grant authenticated remote browsers an appropriate session principal, or explicitly disable the control and document the restriction; the current Web Dashboard and Management API docs still describe remote-token authentication and this endpoint without that limitation.

AGENTS.md reference: AGENTS.md:L300-L301

Useful? React with 👍 / 👎.