Operator controls

These commands run on the operator machine, outside the restricted ChatGPT guest shell.

Grant one repository

zodex sprite github grant-push \
  --sprite dev \
  --repo owner/repo

If needed, supply the writer App Client ID explicitly:

zodex sprite github grant-push \
  --sprite dev \
  --repo owner/repo \
  --publisher-client-id <writer-client-id>

The grant material installed on the Sprite is repo-scoped. The writer PEM/token is not exposed to zodex-agent.

List explicit grants

zodex sprite github list-grants --sprite dev

Revoke one grant

zodex sprite github revoke-push --sprite dev --repo owner/repo

--forget-local-auth also removes operator-side cached Device Flow auth for that repository when deliberately requested.

Enable YOLO policy

One repository:

zodex sprite github yolo --sprite dev --repo owner/repo --ttl 2h

Several repositories:

zodex sprite github yolo \
  --sprite dev \
  --repo owner/repo \
  --repo owner/another-repo \
  --ttl 2h

All eligible repositories for a trusted window:

zodex sprite github yolo --sprite dev --ttl 2h

No TTL is an explicit opt-out:

zodex sprite github yolo --sprite dev --no-ttl

Inspect YOLO state

zodex sprite github status --sprite dev

YOLO stores policy metadata, not writer credentials. Direct push still needs writer App installation/target coverage.

Return to default policy

zodex sprite github default --sprite dev

This removes YOLO state only. Explicit push grants remain independent until expiry/revocation.