Developer setup · production Guard

Use AI through Guard.

Get a scoped Guard Agent token, connect Codex, and work in your own project. Guard keeps the upstream Orbio key server-side and applies model and spend policy to every request.

One token for the developer tool.Your Guard Agent token begins with og_agent_. It is shown once and saved securely by the CLI. Never put it in a repository, TOML file, or screenshot.

Quick Start

Codex in a few commands.

Install the CLI from the Orbio Guard repository with Node.js 22 or newer. The CLI is not currently distributed as a separate npm package.

git clone https://github.com/Jhayboo3/orbio-build.git
cd orbio-build/03_implementation/orbio-guard
npm ci
npm run build
npm link

The tenant owner connects Orbio once in the operator console. A signed-in operator can then create your agent:

guard login
guard create-agent SubVault
guard token save
guard connect codex --model gpt-5.6-sol
guard doctor --model gpt-5.6-sol
guard run codex

guard login prints a short-lived code. Approve it in the dashboard's Guard CLI panel. guard create-agent asks for the agent's environment, name, allowed models, daily budget, per-request limit, and optional expiration. It prints the og_agent_ token once; paste it at the hidden guard token save prompt.

Already have a token?

Begin at guard token save. You do not need an operator login to use an agent that was issued to you.

Developer Tools

Use the commands that exist.

Operator access

Issue and manage

guard login starts a Clerk-approved eight-hour session. guard create-agent <project> issues a cloud agent. guard project set-budget <project> --daily-budget 10 sets a shared cap for an admin or owner. guard logout-operator removes the saved operator session.

Agent access

Connect and run

guard token save stores a one-time token in the OS credential store. guard connect codex validates model permission and writes a dedicated profile. guard doctor diagnoses the connection; guard status shows spend and policy. guard run codex injects the token into the Codex child process only. guard token clear removes it.

Operations

Roles and smoke checks

An owner can use guard operator list, guard operator grant <Clerk user ID> --role viewer, and guard operator revoke <Clerk user ID>. An admin or owner can run guard smoke-test; it makes small billed requests with disposable agents.

Cloud dashboard

Agent controls

Pause, resume, rotate a token, and archive cloud agents in the operator console. The older guard agent ... commands manage local-runtime agents, not cloud agents. There is no guard whoami or guard token status command in v1.

Codex setup

Keep local tools local.

Codex uses the model alias gpt-5.6-sol. Grant the agent access to Orbio's openai/gpt-5.6-sol model ID and let guard doctor confirm it is currently available. Guard adapts Codex additional_tools definitions into standard Responses tools and preserves call IDs, results, previous_response_id, and SSE events. Codex executes shell and filesystem tools locally; Guard never executes them.

guard status
guard doctor --model gpt-5.6-sol
guard run codex exec "Run pwd, then run ls -la"

The first two commands should report the agent's policy and a healthy connection. The final command should show actual local command executions. For a small billed structured-tool transport probe, add --probe-tools to guard doctor.

Compatibility

Know what is verified.

Client	Status	Protocol
Codex	Production verified: shell and file tool lifecycle	Responses JSON and SSE
OpenAI / Anthropic SDKs	Inference routes tested; full SDK tool lifecycle not verified	Responses, Chat Completions / Messages
Claude Code, OpenCode, Cursor	Configuration audited; full live tool lifecycle not verified	Client-dependent

Guard accepts agent-authenticated /v1/responses, /v1/chat/completions, and /v1/messages. The authenticated /v1/models endpoint reflects the live Orbio catalogue. Do not assume a model listed there supports every tool format.

Known limitations

Clear boundaries.

Parallel tools: Orbio does not guarantee parallel_tool_calls with tools. Guard enforces sequential requests and returns PARALLEL_TOOL_CALLS_UNSUPPORTED when a client requires guaranteed parallel execution.
Incomplete streams: If final usage is unavailable, Guard conservatively charges the reserved request bound and labels the accounting source in the operator request record.
Model unavailable: Model IDs and availability change. Use guard doctor and the live catalogue; Codex needs the unqualified gpt-5.6-sol alias.
Agent access denied: Check guard status for expiration, pause, allowed models, and remaining budget. Operators can search the request ID in the dashboard without viewing prompt contents.

Ready to work

Run Codex through Guard.

One agent token, explicit policy, and local tool execution.

Open operator console