{"record":{"id":"e602a5a41650c54a","repo":"affaan-m/ECC","slug":"explicit-consent-to-openai-is-required","errorCode":null,"errorMessage":"explicit --consent-to-openai is required","messagePattern":"explicit --consent-to-openai is required","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"skills/council-multi-model/scripts/review-with-codex.js","lineNumber":80,"sourceCode":"      options.hostProvider = argv[index + 1];\n      index += 1;\n    } else if (arg === '--timeout-seconds') {\n      const seconds = Number(argv[index + 1]);\n      if (!Number.isInteger(seconds) || seconds < 10 || seconds > 120) {\n        throw new Error('--timeout-seconds must be an integer from 10 to 120');\n      }\n      options.timeoutMs = seconds * 1000;\n      index += 1;\n    } else if (arg === '--help' || arg === '-h') {\n      options.help = true;\n    } else {\n      throw new Error(`unknown argument: ${arg}`);\n    }\n  }\n\n  if (options.help) return options;\n  if (!options.consent) {\n    throw new Error('explicit --consent-to-openai is required');\n  }\n  if (!HOST_PROVIDERS.has(options.hostProvider)) {\n    throw new Error('--host-provider must be anthropic, openai, or unknown');\n  }\n  return options;\n}\n\nfunction providerLabel(hostProvider) {\n  if (hostProvider === 'anthropic') return 'cross-provider external critique';\n  if (hostProvider === 'openai') return 'same-provider external critique';\n  return 'provider relationship unverified';\n}\n\nfunction buildCodexArgs(tempDir, outputFile) {\n  return [\n    '--ask-for-approval', 'never',\n    ...REQUIRED_TOOLLESS_FEATURES.flatMap((feature) => ['--disable', feature]),\n    'exec',","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/affaan-m/ECC/blob/01e15490f04e29cfefe3896951f43db46994d8ee/skills/council-multi-model/scripts/review-with-codex.js#L62-L98","documentation":"Thrown by parseArgs() after the loop when options.consent is still false. This is a deliberate consent gate: the script pipes a review packet to OpenAI's Codex CLI, which is an external transfer of prompt data, so the caller must explicitly opt in with --consent-to-openai on every invocation. There is no env-var bypass.","triggerScenarios":"Running review-with-codex.js without --consent-to-openai. The flag takes no value; its mere presence sets options.consent=true. --help short-circuits before this check, so `--help` alone is allowed.","commonSituations":"First-time use without reading the consent requirement; CI job that forgot the flag after a refactor; assuming a one-time env consent exists (it does not).","solutions":["Add --consent-to-openai to the invocation: `... review-with-codex.js --consent-to-openai --host-provider anthropic`.","Only add it in contexts where transferring the prompt to OpenAI is acceptable (read the skill docs first).","If you do not want OpenAI transfer, do not use this script; pick a different review path."],"exampleFix":"// before\nnode skills/council-multi-model/scripts/review-with-codex.js --host-provider anthropic\n\n// after\nnode skills/council-multi-model/scripts/review-with-codex.js --consent-to-openai --host-provider anthropic","handlingStrategy":"validation","validationCode":"function ensureConsent(argv) {\n  if (!argv.includes('--consent-to-openai')) {\n    throw new Error('explicit --consent-to-openai is required to transfer the prompt to OpenAI');\n  }\n  return true;\n}","typeGuard":"function hasConsentFlag(argv) {\n  return Array.isArray(argv) && argv.includes('--consent-to-openai');\n}","tryCatchPattern":null,"preventionTips":["Add --consent-to-openai on every invocation; there is no persistent opt-in.","Only enable it where transferring the prompt to OpenAI is acceptable.","If consent is unwanted, choose a different review path."],"tags":["cli","validation","consent","security","data-transfer"],"backgroundTag":null,"analyzedSha":"01e15490f04e29cfefe3896951f43db46994d8ee","analyzedAt":"2026-08-13T00:31:08.655Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}