Merge pull request #917 from lidge-jun/codex/postmerge-audit-fixes

fix(security): close the agent star-consent bypass found auditing the #892 merge

Author: lidge-jun

.gitignore

@@ -39,3 +39,10 @@ devlog/**/security-advisory-draft*
 # Test-generated artifacts
 tests/.tmp-*/
 .claude/
+
+# Retired Go native-runtime experiment. `go/` is not part of the build, the
+# typecheck, or the test path, and nothing in `src/` imports it. A single file
+# from it (go/internal/cli/config_parity.go) has now been committed by a broad
+# `git add` three separate times and reached `dev` once — see
+# tests/repo-hygiene.test.ts, which fails if any path here becomes tracked again.
+go/

AGENTS.md

@@ -130,6 +130,16 @@ with regression coverage in `tests/startup-prompt.test.ts`,
 another action that spends the user's identity, credits, or reputation, gate it
 the same way rather than relying on a prompt an agent can answer.
 
+**Be clear about what that enforcement is and is not.** The management endpoint
+requires a dashboard session, which stops the casual path — an agent that would
+have POSTed there because the endpoint existed, and one holding only the admin
+token. It is not a technical barrier against a determined local agent: a process
+running as the user can mint its own session from the loopback dashboard
+bootstrap, and can skip the proxy entirely by running `gh` itself. Every local
+credential is equally reachable by both the browser and the agent, so no check
+inside this process can tell them apart. The real boundary is the rule above, and
+it binds you regardless of which mechanism is within reach.
+
 ## Commands
 
 ```bash