Skip to content

fix(claude): keep picker CA signing key ephemeral #6072

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
luvs01 wants to merge 1 commit into from
Closed

fix(claude): keep picker CA signing key ephemeral #6072

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions docs-site/src/content/docs/fr/guides/claude-code.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -165,8 +165,10 @@ Le mode picker fait partie du mode first-party. Sur macOS, il est activé par d
est sélectionné, sauf si `claudeCode.intercept.picker: false` est défini. Il modifie le sélecteur de
modèles de l'onglet Code de Desktop first-party pour y afficher les modèles opencodex disponibles par
leur nom. Lors de la première activation, macOS peut demander l'autorisation d'une autorité de certification
locale dans le trousseau de connexion. Cette autorité est limitée à `claude.ai` et à ses sous-domaines ;
la demande correspond à cette étape de confiance unique pour cette AC locale.
locale dans le trousseau de connexion. Cette autorité est limitée à `claude.ai` et à ses sous-domaines.
Sa clé de signature n'existe que dans le processus OpenCodex en cours : chaque redémarrage d'OpenCodex
publie une nouvelle autorité et macOS demande donc de nouveau votre confiance — approuvez la demande,
ou lancez ensuite `ocx claude desktop picker trust`, après chaque redémarrage.

Lorsque le mode picker est actif, Claude Desktop accède au réseau par OpenCodex. Si OpenCodex s'arrête,
Desktop reste hors ligne jusqu'à son redémarrage complet ou jusqu'à la désactivation du mode picker.
Expand Down
4 changes: 3 additions & 1 deletion docs-site/src/content/docs/guides/claude-code.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -211,7 +211,9 @@ Picker mode is part of first-party mode. On macOS it is on by default when first
unless `claudeCode.intercept.picker: false` is set. It changes the first-party Desktop Code-tab picker
so it lists available opencodex models by name. The first time it is enabled, macOS may ask you to
trust a local certificate authority in the login keychain. That authority is constrained to `claude.ai`
and its subdomains; the prompt is a one-time trust step for this local CA.
and its subdomains. Its signing key exists only inside the running OpenCodex process, so every
OpenCodex restart publishes a fresh authority and macOS asks you to trust it again — approve the
prompt, or later run `ocx claude desktop picker trust`, after each restart.

While picker mode is on, Claude Desktop reaches the network through OpenCodex. If OpenCodex stops,
Desktop is offline until you fully restart it or turn picker mode off. Check the state with
Expand Down
5 changes: 3 additions & 2 deletions docs-site/src/content/docs/ja/guides/claude-code.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -140,8 +140,9 @@ Picker モードは 1P モードの一部です。macOS で 1P を選ぶとデ
`claudeCode.intercept.picker: false` を設定した場合は無効です。1P の Desktop の Code タブにある
モデルピッカーを書き換え、利用できる opencodex モデルを名前付きで表示します。初回の有効化時は、
macOS がログインキーチェーン内のローカル証明書認証局を信頼するよう求めることがあります。この認証局の
制約は `claude.ai` とそのサブドメインに限られ、このダイアログはこのローカル CA に対する一度だけの
信頼操作です。
制約は `claude.ai` とそのサブドメインに限られます。署名鍵は実行中の OpenCodex プロセス内にだけ存在する
ため、OpenCodex を再起動するたびに新しい認証局が発行され、macOS が再び信頼を求めます。再起動のたびに
プロンプトを承認するか、あとから `ocx claude desktop picker trust` を実行してください。

Picker モードが有効な間、Claude Desktop のネットワークは OpenCodex を経由します。OpenCodex が停止
すると、Picker モードをオフにするか Desktop を完全に再起動するまで Desktop はオフラインになります。
Expand Down
6 changes: 4 additions & 2 deletions docs-site/src/content/docs/ko/guides/claude-code.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -162,8 +162,10 @@ unknown은 설정이 아직 opencodex 프록시를 가리키는지 판단할 수
Picker 모드는 1P 모드의 일부예요. macOS에서 1P를 선택하면 기본으로 켜지지만,
`claudeCode.intercept.picker: false`를 설정하면 꺼져요. 1P Desktop의 Code 탭 모델 선택기를 바꿔서
사용 가능한 opencodex 모델을 이름으로 보여줘요. 처음 켤 때 macOS 로그인 키체인에서 로컬 인증 기관을
신뢰하라는 메시지가 표시될 수 있어요. 이 인증 기관은 `claude.ai`와 그 하위 도메인으로 제한되며,
이 메시지는 이 로컬 CA를 한 번 신뢰하기 위한 절차예요.
신뢰하라는 메시지가 표시될 수 있어요. 이 인증 기관은 `claude.ai`와 그 하위 도메인으로 제한돼요.
서명 키는 실행 중인 OpenCodex 프로세스 안에만 존재하므로, OpenCodex를 다시 시작할 때마다 새 인증
기관이 발행되고 macOS가 다시 신뢰를 요청해요. 다시 시작할 때마다 메시지를 승인하거나, 나중에
`ocx claude desktop picker trust`를 실행하면 돼요.

Picker 모드가 켜져 있는 동안 Claude Desktop의 네트워크는 OpenCodex를 거쳐요. OpenCodex가 중단되면
Picker 모드를 끄거나 Desktop을 완전히 다시 시작할 때까지 Desktop은 오프라인이에요.
Expand Down
4 changes: 3 additions & 1 deletion docs-site/src/content/docs/ru/guides/claude-code.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,7 +147,9 @@ unknown означает, что opencodex не может определить,
если не задано `claudeCode.intercept.picker: false`. Он изменяет селектор моделей во вкладке Code
first-party Desktop и показывает доступные модели opencodex по именам. При первом включении macOS может
попросить доверить локальному центру сертификации в связке ключей для входа. Этот центр ограничен
`claude.ai` и его поддоменами; запрос появляется один раз для доверия этому локальному центру.
`claude.ai` и его поддоменами. Ключ подписи существует только внутри запущенного процесса OpenCodex,
поэтому при каждом перезапуске OpenCodex публикуется новый центр и macOS снова просит доверие —
подтвердите запрос или позже выполните `ocx claude desktop picker trust` после каждого перезапуска.

Пока режим picker включён, Claude Desktop выходит в сеть через OpenCodex. Если OpenCodex остановится,
Desktop будет офлайн, пока вы полностью не перезапустите его или не отключите режим picker.
Expand Down
6 changes: 4 additions & 2 deletions docs-site/src/content/docs/tr/guides/claude-code.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -188,8 +188,10 @@ Picker modu first-party modunun bir parçasıdır. macOS'ta first-party seçildi
açıktır; `claudeCode.intercept.picker: false` ayarlanırsa kapalı kalır. First-party Desktop'ın Code
sekmesindeki model seçiciyi değiştirerek kullanılabilir opencodex modellerini adlarıyla listeler.
İlk etkinleştirmede macOS, giriş anahtar zincirinde yerel bir sertifika yetkilisine güvenmenizi isteyebilir.
Bu yetkili `claude.ai` ve alt alan adlarıyla sınırlıdır; iletişim kutusu bu yerel CA için tek seferlik güven
adımıdır.
Bu yetkili `claude.ai` ve alt alan adlarıyla sınırlıdır. İmza anahtarı yalnızca çalışan OpenCodex sürecinde
bulunduğundan her OpenCodex yeniden başlatılmasında yeni bir yetkili yayımlanır ve macOS güveni yeniden ister —
her yeniden başlatmadan sonra iletişim kutusunu onaylayın veya daha sonra `ocx claude desktop picker trust`
komutunu çalıştırın.

Picker modu açıkken Claude Desktop ağa OpenCodex üzerinden çıkar. OpenCodex durursa Desktop, tamamen yeniden
başlatılana veya picker modu kapatılana kadar çevrimdışı kalır. Durumu `ocx claude desktop picker status`
Expand Down
4 changes: 3 additions & 1 deletion docs-site/src/content/docs/zh-cn/guides/claude-code.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,7 +132,9 @@ unknown 表示 opencodex 无法确定设置是否仍指向自己的代理。外
Picker 模式是第一方模式的一部分。在 macOS 上选择第一方时默认开启；设置
`claudeCode.intercept.picker: false` 后会保持关闭。它会修改第一方 Desktop 的 Code 标签页模型选择器，
按名称列出可用的 opencodex 模型。首次开启时，macOS 可能会要求你在登录钥匙串中信任本地证书颁发机构。
该颁发机构限制为 `claude.ai` 及其子域名；这个提示是对该本地 CA 的一次性信任步骤。
该颁发机构限制为 `claude.ai` 及其子域名。其签名密钥只存在于运行中的 OpenCodex 进程内，因此每次重启
OpenCodex 都会发布新的颁发机构，macOS 也会再次请求信任——请在每次重启后批准该提示，或稍后运行
`ocx claude desktop picker trust`。

Picker 模式开启期间，Claude Desktop 通过 OpenCodex 访问网络。如果 OpenCodex 停止，Desktop 会处于离线状态，
直到你完全重启 Desktop 或关闭 Picker 模式。使用 `ocx claude desktop picker status` 查看状态，使用
Expand Down
4 changes: 3 additions & 1 deletion docs-site/src/content/docs/zh-tw/guides/claude-code.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,7 +143,9 @@ unknown 表示 opencodex 無法確定設定是否仍指向自己的代理。外
Picker 模式是第一方模式的一部分。在 macOS 上選擇第一方時預設開啟；設定
`claudeCode.intercept.picker: false` 後會保持關閉。它會修改第一方 Desktop 的 Code 分頁模型選擇器，
依名稱列出可用的 opencodex 模型。首次開啟時，macOS 可能會要求你在登入鑰匙圈中信任本機憑證授權單位。
該授權單位限制為 `claude.ai` 及其子網域；這個提示是對該本機 CA 的一次性信任步驟。
該授權單位限制為 `claude.ai` 及其子網域。其簽章金鑰只存在於執行中的 OpenCodex 處理程序內，因此每次重新啟動
OpenCodex 都會發佈新的授權單位，macOS 也會再次請求信任——請在每次重新啟動後核准該提示，或稍後執行
`ocx claude desktop picker trust`。

Picker 模式開啟期間，Claude Desktop 會透過 OpenCodex 存取網路。如果 OpenCodex 停止，Desktop 會離線，
直到你完全重新啟動 Desktop 或關閉 Picker 模式。使用 `ocx claude desktop picker status` 查看狀態，
Expand Down
8 changes: 6 additions & 2 deletions src/claude/desktop-picker.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ import type { OcxConfig } from "../types";
import { claudeDesktopIntegrationEnabled } from "../codex/desired-state";
import { getConfigDir } from "../config/paths";
import { readFileSync, existsSync } from "node:fs";
import { pickerCaCertPath, pickerCaFingerprints, ensurePickerCa, issuePickerLeaf, pickerLeafCertPath } from "./intercept/picker-ca";
import { pickerCaCertPath, pickerCaFingerprints, ensurePickerCa, issuePickerLeaf, pickerLeafCertPath, publishedPickerCaSha256 } from "./intercept/picker-ca";
import { inspectPickerTrust, trustPickerCa, untrustPickerCa } from "./intercept/picker-trust";
import type { PickerRuntime } from "./intercept/picker-runtime";
import type { PickerTrustState, SecurityRunner } from "./intercept/picker-trust";
Expand Down Expand Up @@ -36,6 +36,8 @@ export interface DesktopPickerStatus {
supported: boolean;
trust: PickerTrustState;
profile: DesktopPickerProfileInspection["kind"];
/** SHA-256 of this process's picker authority, so a CLI can verify the file it is about to trust; null when no authority exists yet. */
caSha256: string | null;
listenerReady: boolean;
effective: boolean;
reason: DesktopPickerReason;
Expand Down Expand Up @@ -107,6 +109,7 @@ function emptyStatus(config: OcxConfig, platform: NodeJS.Platform, reason: Deskt
models: 0,
snapshotAt: null,
lastBootstrapAt: null,
caSha256: null,
};
}

Expand Down Expand Up @@ -154,6 +157,7 @@ export function createDesktopPickerController(deps: DesktopPickerControllerDeps)
models: runtime.models,
snapshotAt: runtime.snapshotAt,
lastBootstrapAt: runtime.lastBootstrapAt,
caSha256: publishedPickerCaSha256(deps.configDir),
};
}

Expand Down Expand Up @@ -231,7 +235,7 @@ export function createDesktopPickerController(deps: DesktopPickerControllerDeps)
let trust = await inspectPickerTrust(pickerLeafCertPath(deps.configDir), caSha1, deps.security, platform);
observedTrust = trust;
if (trust !== "trusted" && options.context === "server") {
const added = await trustPickerCa(caPath, deps.security, platform);
const added = await trustPickerCa(caPath, deps.security, platform, { pem: ca.certPem });
trustedByAttempt = added.ok;
trust = await inspectPickerTrust(pickerLeafCertPath(deps.configDir), caSha1, deps.security, platform);
observedTrust = trust;
Expand Down
Loading
Loading