app-server: add macOS device key provider by euroelessar · Pull Request #18431 · openai/codex

euroelessar · 2026-04-18T00:02:02Z

Why

The device-key crate needs a platform provider that can keep private keys non-extractable on macOS while preserving the crate-level protection policy and structured signing boundary.

macOS has two useful local protection classes for this API: hardware-backed Secure Enclave keys when available, and OS-protected non-extractable keys as an explicit fallback. Reporting which class was selected keeps that distinction visible to callers.

The Security.framework access-control flags used here provide device-local non-exportability and continuity while the user session is unlocked. They do not require UserPresence or Biometry for each signature, so the key itself is not treated as a complete same-controller compromise boundary. The API still relies on local-transport restriction, app-server authorization, and structured payload validation.

What changed

Added the macOS DeviceKeyProvider implementation backed by Security.framework.
Created and loaded P-256 private keys by stable device-key ID.
Preferred Secure Enclave keys by default and allowed OS-protected non-extractable fallback only when requested by policy.
Returned SPKI DER public keys and DER-encoded ECDSA signatures through the existing crate API.
Documented the macOS provider threat-model boundary around this-device-only keys without UserPresence or Biometry flags.
Added macOS-only Security.framework and CoreFoundation dependencies.

Stack

This is stacked on #18430.

Validation

cargo test -p codex-device-key
just bazel-lock-update
just bazel-lock-check

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c0fc5bb1ce

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

viyatb-oai · 2026-04-18T01:56:00Z

[P2] OS‑protected fallback load path doesn’t validate non‑extractable attrs on existing keys; it is tag‑based. If we want the degraded path to still enforce non‑exportable, consider validating key attributes when loading, not just on create.

euroelessar · 2026-04-18T02:36:46Z

[codex] Addressed in 30d2da0: the macOS OS-protected fallback load query now includes kSecAttrIsExtractable = false, matching the create-time non-extractability constraint before an existing key is accepted.

## Summary Load LocalAuthentication.framework at runtime before constructing LAContext instead of linking the framework into every macOS target. The previous direct framework link made unrelated macOS Bazel targets link against an SDK-backed framework path, which caused the macOS CI jobs to fail during linking. The signing flow still uses LAContext for authenticated private-key operations; this only changes how the framework becomes available to the Objective-C runtime. ## Validation - just fmt - cargo test -p codex-device-key - just fix -p codex-device-key - git diff --check - bazel build //codex-rs/device-key:device-key

## Summary Add the required parameter-name comment for the None authentication-context argument in the macOS device-key lookup path. CI macOS argument-comment lint enforces these comments for positional literal-like arguments. ## Validation - just fmt - cargo test -p codex-device-key - just fix -p codex-device-key - bazel build --config=argument-comment-lint //codex-rs/device-key:device-key-unit-tests-bin - git diff --check Note: a full local just argument-comment-lint run reached the fixed device-key target, then failed later in an unrelated webrtc-sys build script with a stale sandbox path outside this PR changes.

The device-key crate needs a platform provider that can keep private keys non-extractable on macOS while preserving the crate-level protection policy and structured signing boundary. macOS has two useful local protection classes for this API: hardware-backed Secure Enclave keys when available, and OS-protected non-extractable keys as an explicit fallback. Reporting which class was selected keeps that distinction visible to callers. The Security.framework access-control flags used here provide device-local non-exportability and continuity while the user session is unlocked. They do not require UserPresence or Biometry for each signature, so the key itself is not treated as a complete same-controller compromise boundary; the API still relies on local-transport restriction, app-server authorization, and structured payload validation. - Added the macOS DeviceKeyProvider implementation backed by Security.framework. - Created and loaded P-256 private keys by stable device-key ID. - Preferred Secure Enclave keys by default and allowed OS-protected non-extractable fallback only when requested by policy. - Returned SPKI DER public keys and DER-encoded ECDSA signatures through the existing crate API. - Documented the macOS provider threat-model boundary around this-device-only keys without UserPresence or Biometry flags. - Added macOS-only Security.framework and CoreFoundation dependencies. - just fmt - cargo test -p codex-device-key - just fix -p codex-device-key - git diff --check - just bazel-lock-update - just bazel-lock-check

Require macOS-created device keys to prove user presence before private-key use by adding the UserPresence access-control flag at key creation time. This keeps the provider aligned with the device-ownership goal: a valid signature should require both the device-local private key and a successful local biometric or password authentication. Thread a process-local LAContext into signing lookups and reuse it across sign operations. Security.framework still owns the authentication policy and validity window, while the reusable context lets macOS reuse a recent successful authentication when policy permits instead of prompting on every connection. Public-key lookup and binding reads continue to avoid the authentication context because they do not use the private key. - just fmt - cargo test -p codex-device-key - just fix -p codex-device-key - git diff --check

## Summary Load LocalAuthentication.framework at runtime before constructing LAContext instead of linking the framework into every macOS target. The previous direct framework link made unrelated macOS Bazel targets link against an SDK-backed framework path, which caused the macOS CI jobs to fail during linking. The signing flow still uses LAContext for authenticated private-key operations; this only changes how the framework becomes available to the Objective-C runtime. ## Validation - just fmt - cargo test -p codex-device-key - just fix -p codex-device-key - git diff --check - bazel build //codex-rs/device-key:device-key

## Summary Add the required parameter-name comment for the None authentication-context argument in the macOS device-key lookup path. CI macOS argument-comment lint enforces these comments for positional literal-like arguments. ## Validation - just fmt - cargo test -p codex-device-key - just fix -p codex-device-key - bazel build --config=argument-comment-lint //codex-rs/device-key:device-key-unit-tests-bin - git diff --check Note: a full local just argument-comment-lint run reached the fixed device-key target, then failed later in an unrelated webrtc-sys build script with a stale sandbox path outside this PR changes.

euroelessar · 2026-04-24T19:17:20Z

Update pushed in two commits:

21ab239bc5 adds kSecUseDataProtectionKeychain to the macOS private-key query/create attributes.
eed4fccd03 adds codex-rs/scripts/check-device-key-app-server.py, a repeatable local harness that spawns codex app-server --listen stdio:// and exercises device/key/create, device/key/sign, and device/key/public.

Local check against the OpenAI-signed debug CLI currently reproduces the remaining blocker at device/key/create:

{
  "failedMethod": "device/key/create",
  "error": {
    "code": -32603,
    "message": "device key platform error: macOS Keychain entitlements are required to create persistent device keys"
  }
}

Command used:

codex-rs/scripts/check-device-key-app-server.py --binary codex-rs/target/debug/codex

github-actions · 2026-05-09T06:44:44Z

Closing this pull request because it has had no updates for more than 14 days. If you plan to continue working on it, feel free to reopen or open a new PR.

chatgpt-codex-connector Bot reviewed Apr 18, 2026

View reviewed changes

Comment thread codex-rs/device-key/src/platform/macos.rs Outdated

euroelessar force-pushed the ruslan/device-key-app-server branch from a6f5f5e to e4e9f03 Compare April 18, 2026 00:05

euroelessar force-pushed the ruslan/device-key-macos branch from c0fc5bb to 4de8c7d Compare April 18, 2026 00:05

euroelessar force-pushed the ruslan/device-key-app-server branch from e4e9f03 to f9220dd Compare April 18, 2026 00:07

euroelessar force-pushed the ruslan/device-key-macos branch 2 times, most recently from cb9c2f2 to e0eb231 Compare April 18, 2026 00:15

euroelessar force-pushed the ruslan/device-key-app-server branch from f9220dd to 75ba150 Compare April 18, 2026 00:15

euroelessar force-pushed the ruslan/device-key-macos branch from e0eb231 to d6970f9 Compare April 18, 2026 00:22

euroelessar force-pushed the ruslan/device-key-app-server branch 2 times, most recently from b59b13f to f7b198b Compare April 18, 2026 00:24

euroelessar force-pushed the ruslan/device-key-macos branch 2 times, most recently from 9ab7c21 to ee62f13 Compare April 18, 2026 00:26

euroelessar force-pushed the ruslan/device-key-app-server branch 2 times, most recently from 54f7030 to c4e3b95 Compare April 18, 2026 00:35

euroelessar force-pushed the ruslan/device-key-macos branch 2 times, most recently from 0060869 to ee406bb Compare April 18, 2026 00:40

euroelessar force-pushed the ruslan/device-key-app-server branch from c4e3b95 to 20c2078 Compare April 18, 2026 00:40

viyatb-oai reviewed Apr 18, 2026

View reviewed changes

Comment thread codex-rs/device-key/src/platform/macos.rs Outdated

viyatb-oai reviewed Apr 18, 2026

View reviewed changes

Comment thread codex-rs/device-key/src/platform/macos.rs Outdated

euroelessar force-pushed the ruslan/device-key-app-server branch from 20c2078 to cd244b7 Compare April 18, 2026 01:10

euroelessar force-pushed the ruslan/device-key-macos branch from ee406bb to 2f748ae Compare April 18, 2026 01:10

github-actions Bot mentioned this pull request Apr 18, 2026

📊 AI CLI 工具社区动态日报 2026-04-18 gsscsd/big_model_radar#203

Open

euroelessar force-pushed the ruslan/device-key-macos branch from 2f748ae to dc066ce Compare April 18, 2026 01:25

euroelessar force-pushed the ruslan/device-key-app-server branch from cd244b7 to b371887 Compare April 18, 2026 01:25

euroelessar force-pushed the ruslan/device-key-app-server branch from b371887 to f664fa1 Compare April 18, 2026 02:36

euroelessar force-pushed the ruslan/device-key-macos branch from dc066ce to 30d2da0 Compare April 18, 2026 02:36

euroelessar marked this pull request as draft April 18, 2026 02:38

euroelessar force-pushed the ruslan/device-key-app-server branch from f664fa1 to 123af8e Compare April 18, 2026 19:25

euroelessar force-pushed the ruslan/device-key-macos branch from e50e78c to 5ff2eec Compare April 23, 2026 21:11

euroelessar changed the base branch from main to ruslan/device-key-sqlite-binding April 23, 2026 21:12

euroelessar force-pushed the ruslan/device-key-sqlite-binding branch from cba35b7 to 05a41cc Compare April 23, 2026 21:39

euroelessar force-pushed the ruslan/device-key-macos branch from 5ff2eec to e38f027 Compare April 23, 2026 21:39

euroelessar force-pushed the ruslan/device-key-sqlite-binding branch from 05a41cc to 3c1f8d4 Compare April 23, 2026 22:02

euroelessar force-pushed the ruslan/device-key-macos branch from e38f027 to 751e183 Compare April 23, 2026 22:02

euroelessar force-pushed the ruslan/device-key-sqlite-binding branch from 3c1f8d4 to 763ee60 Compare April 23, 2026 22:09

euroelessar force-pushed the ruslan/device-key-macos branch from 751e183 to eab5a71 Compare April 23, 2026 22:10

euroelessar added a commit that referenced this pull request Apr 23, 2026

codex: fix CI failure on PR #18431

f326b6b

euroelessar added a commit that referenced this pull request Apr 23, 2026

codex: fix CI failure on PR #18431

aa16360

euroelessar force-pushed the ruslan/device-key-macos branch from f326b6b to aa16360 Compare April 23, 2026 23:07

euroelessar added 10 commits April 23, 2026 21:58

Move macOS device key provider to Objective-C

6fd3bf8

Handle missing entitlement for macOS device keys

9721499

app-server: require keychain entitlements before macOS fallback

8d431c0

codex: fix CI failure on PR #18431

e06c0a4

Use data protection keychain for macOS device keys

21ab239

Add device key app-server check script

eed4fcc

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

app-server: add macOS device key provider#18431

app-server: add macOS device key provider#18431
euroelessar wants to merge 10 commits into
mainfrom
ruslan/device-key-macos

euroelessar commented Apr 18, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

viyatb-oai commented Apr 18, 2026 •

edited

Loading

Uh oh!

euroelessar commented Apr 18, 2026

Uh oh!

euroelessar commented Apr 24, 2026

Uh oh!

github-actions Bot commented May 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

euroelessar commented Apr 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What changed

Stack

Validation

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

viyatb-oai commented Apr 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

euroelessar commented Apr 18, 2026

Uh oh!

euroelessar commented Apr 24, 2026

Uh oh!

github-actions Bot commented May 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

euroelessar commented Apr 18, 2026 •

edited

Loading

viyatb-oai commented Apr 18, 2026 •

edited

Loading