alt Hacker NewsI've really been enjoying using Codex as a headless remote agent on my home lab. I'll often pull it up from my phone and jam on some little project when inspiration strikes.
I kept bumping into the question of how to give it access to the things it needs without leaving my private keys and other credentials on the server though.
For SSH (and sudo through pam_ssh_agent_auth), I ended up building agent-auth and Agent Witness. Codex sees a normal SSH_AUTH_SOCK and supplies some context about why it needs a signature. If one of my Macs is available, agent-auth proxies the request to the 1Password SSH agent there. Otherwise it routes the request to Agent Witness on my phone.
Agent Witness runs as a PWA and is essentially a remote ssh-agent. The private keys are wrapped, encrypted, and stored in IndexedDB locally on the phone. The vault can only be unwrapped with a secret derived from a passkey, and all key handling and signing happens locally through the browser's Web Crypto APIs. The unwrapped keys are non-extractable CryptoKey objects (the web crypto APIs are pretty awesome!)
When a signing request comes in, the PWA gets a push notification. It shows me the reason Codex supplied, the command being run, and the key being requested. I authorize it with my passkey, the PWA signs the request, and only the resulting signature goes back to the server. The private key never leaves my phone.
https://github.com/evanpurkhiser/agent-auth https://github.com/evanpurkhiser/agent-witness
I also recently put together psst, which solves the related problem of handing a secret to Codex from 1Password. I give it a 1Password item-sharing link, it opens a local session where it decrypts the 1password item in memory, and Codex can inspect the available fields of the item before explicitly retrieving only the ones it needs. The CLI refuses to write secret values to a terminal, which helps keep them out of argv, shell history, and transcripts.
I’m sure I could work out a better approach where the agent absolutely cannot retrieve the secret since if it really wanted to read the secret, it could of course pipe the value into cat or whatever. The goal is to just make secret access explicit and avoid accidentally spraying credentials into places where they'll be retained. So far it’s been a very nice flow with agent browser.