mirror of
https://github.com/openai/codex.git
synced 2026-04-25 15:15:15 +00:00
48f82ca7c5
## Why Clients need a stable app-server protocol surface for enrolling a local device key, retrieving its public key, and producing a device-bound proof. The protocol reports `protectionClass` explicitly so clients can distinguish hardware-backed keys from an explicitly allowed OS-protected fallback. Signing uses a tagged `DeviceKeySignPayload` enum rather than arbitrary bytes so each signed statement is auditable at the API boundary. ## What changed - Added v2 JSON-RPC methods for `device/key/create`, `device/key/public`, and `device/key/sign`. - Added request/response types for device-key metadata, SPKI public keys, protection classes, and ECDSA signatures. - Added `DeviceKeyProtectionPolicy` with hardware-only default behavior and an explicit `allow_os_protected_nonextractable` option. - Added the initial `remoteControlClientConnection` signing payload variant. - Regenerated JSON Schema and TypeScript fixtures for app-server clients. ## Stack This is PR 1 of 4 in the device-key app-server stack. ## Validation - `just write-app-server-schema` - `cargo test -p codex-app-server-protocol`
45 lines
1.1 KiB
JSON
Generated
45 lines
1.1 KiB
JSON
Generated
{
|
|
"$schema": "http://json-schema.org/draft-07/schema#",
|
|
"definitions": {
|
|
"DeviceKeyAlgorithm": {
|
|
"description": "Device-key algorithm reported at enrollment and signing boundaries.",
|
|
"enum": [
|
|
"ecdsa_p256_sha256"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"DeviceKeyProtectionClass": {
|
|
"description": "Platform protection class for a controller-local device key.",
|
|
"enum": [
|
|
"hardware_secure_enclave",
|
|
"hardware_tpm",
|
|
"os_protected_nonextractable"
|
|
],
|
|
"type": "string"
|
|
}
|
|
},
|
|
"description": "Device-key metadata and public key returned by create/public APIs.",
|
|
"properties": {
|
|
"algorithm": {
|
|
"$ref": "#/definitions/DeviceKeyAlgorithm"
|
|
},
|
|
"keyId": {
|
|
"type": "string"
|
|
},
|
|
"protectionClass": {
|
|
"$ref": "#/definitions/DeviceKeyProtectionClass"
|
|
},
|
|
"publicKeySpkiDerBase64": {
|
|
"description": "SubjectPublicKeyInfo DER encoded as base64.",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"algorithm",
|
|
"keyId",
|
|
"protectionClass",
|
|
"publicKeySpkiDerBase64"
|
|
],
|
|
"title": "DeviceKeyCreateResponse",
|
|
"type": "object"
|
|
} |