Merge pull request ilysenko#1016 from danielcadev/codex/scope-browser-sockets-per-user

fix(browser): scope socket directory per Linux user

Author: ilysenko

.github/workflows/upstream-build-app.yml

@@ -14,10 +14,14 @@ on:
       - scripts/ci/upstream-dmg-*.js
       - scripts/validate-upstream-dmg.js
       - scripts/lib/candidate-install.sh
+      - scripts/lib/bundled-plugins.sh
+      - scripts/lib/browser-client-node-repl-runtime.test.js
+      - scripts/lib/patch-browser-client-iab-socket-scope.js
       - scripts/lib/patch-validation.js
       - scripts/lib/upstream-dmg-acceptance.js
       - scripts/lib/upstream-dmg-release-profile.js
       - scripts/lib/linux-features.js
+      - computer-use-linux/src/bin/codex-chrome-extension-host.rs
       - linux-features/**
       - .github/workflows/upstream-build-app.yml
   push:
@@ -33,10 +37,14 @@ on:
       - scripts/ci/upstream-dmg-*.js
       - scripts/validate-upstream-dmg.js
       - scripts/lib/candidate-install.sh
+      - scripts/lib/bundled-plugins.sh
+      - scripts/lib/browser-client-node-repl-runtime.test.js
+      - scripts/lib/patch-browser-client-iab-socket-scope.js
       - scripts/lib/patch-validation.js
       - scripts/lib/upstream-dmg-acceptance.js
       - scripts/lib/upstream-dmg-release-profile.js
       - scripts/lib/linux-features.js
+      - computer-use-linux/src/bin/codex-chrome-extension-host.rs
       - linux-features/**
       - .github/workflows/upstream-build-app.yml
   workflow_dispatch:
@@ -164,6 +172,13 @@ jobs:
           REBUILD_REPORT_DIR: ${{ github.workspace }}/upstream-acceptance
         run: make build-app DMG=/tmp/codex-upstream-ci/Codex.dmg
 
+      - name: Import staged Browser clients through node_repl
+        if: steps.acceptance-build.outcome == 'success'
+        env:
+          CODEX_NODE_REPL_PATH: ${{ github.workspace }}/codex-app/resources/node_repl
+          CODEX_STAGED_BUNDLED_PLUGINS_ROOT: ${{ github.workspace }}/codex-app/resources/plugins/openai-bundled/plugins
+        run: node --test scripts/lib/browser-client-node-repl-runtime.test.js
+
       - name: Upload upstream DMG metadata artifact
         # The transactional installer records a decision before returning a
         # rejected status, so diagnostics remain available on failed runs.

computer-use-linux/src/bin/codex-chrome-extension-host.rs

@@ -7,6 +7,7 @@ use std::{
     io::{self, BufRead, BufReader, ErrorKind, Read, Seek, SeekFrom, Write},
     net::Shutdown,
     os::unix::{
+        ffi::OsStrExt,
         fs::{MetadataExt, PermissionsExt},
         io::AsRawFd,
         net::{UnixListener, UnixStream},
@@ -26,7 +27,8 @@ use chrome_runtime::RuntimeManager;
 const HOST_NAME: &str = "com.openai.codexextension";
 const SOCKET_DIR_ENV: &str = "CODEX_BROWSER_USE_SOCKET_DIR";
 const SESSIONS_DIR_ENV: &str = "CODEX_BROWSER_USE_SESSIONS_DIR";
-const DEFAULT_SOCKET_DIR: &str = "/tmp/codex-browser-use";
+const SOCKET_DIR_NAME: &str = "codex-browser-use";
+const MAX_UNIX_SOCKET_PATH_BYTES: usize = 107;
 const ROLLOUT_POLL_INTERVAL: Duration = Duration::from_millis(500);
 const OBSERVED_TURN_TTL: Duration = Duration::from_secs(6 * 60 * 60);
 const ROLLOUT_SEARCH_MAX_DEPTH: usize = 5;
@@ -330,9 +332,10 @@ impl RolloutTracker {
 }
 
 fn main() -> Result<()> {
-    let socket_dir = socket_dir();
+    let effective_uid = unsafe { libc::geteuid() };
+    let socket_dir = socket_dir(effective_uid);
+    let socket_path = socket_path(&socket_dir)?;
     prepare_socket_dir(&socket_dir)?;
-    let socket_path = socket_path(&socket_dir);
     remove_socket_if_present(&socket_path)?;
 
     let listener = UnixListener::bind(&socket_path)
@@ -364,10 +367,16 @@ fn main() -> Result<()> {
     result
 }
 
-fn socket_dir() -> PathBuf {
-    env::var_os(SOCKET_DIR_ENV)
-        .map(PathBuf::from)
-        .unwrap_or_else(|| PathBuf::from(DEFAULT_SOCKET_DIR))
+fn socket_dir(effective_uid: u32) -> PathBuf {
+    if let Some(path) = env::var_os(SOCKET_DIR_ENV).filter(|value| !value.is_empty()) {
+        return PathBuf::from(path);
+    }
+
+    default_socket_dir(effective_uid)
+}
+
+fn default_socket_dir(effective_uid: u32) -> PathBuf {
+    PathBuf::from(format!("/tmp/{SOCKET_DIR_NAME}-{effective_uid}"))
 }
 
 fn sessions_root() -> Option<PathBuf> {
@@ -397,12 +406,23 @@ fn is_extension_id(value: &str) -> bool {
     value.len() == 32 && value.bytes().all(|byte| matches!(byte, b'a'..=b'p'))
 }
 
-fn socket_path(socket_dir: &Path) -> PathBuf {
+fn socket_path(socket_dir: &Path) -> Result<PathBuf> {
     let nonce = SystemTime::now()
         .duration_since(UNIX_EPOCH)
         .map(|duration| duration.as_nanos())
         .unwrap_or_default();
-    socket_dir.join(format!("extension-{}-{nonce}.sock", process::id()))
+    socket_path_for(socket_dir, process::id(), nonce)
+}
+
+fn socket_path_for(socket_dir: &Path, process_id: u32, nonce: u128) -> Result<PathBuf> {
+    let path = socket_dir.join(format!("extension-{process_id}-{nonce}.sock"));
+    if path.as_os_str().as_bytes().len() > MAX_UNIX_SOCKET_PATH_BYTES {
+        bail!(
+            "unix socket path exceeds the {MAX_UNIX_SOCKET_PATH_BYTES}-byte Linux limit: {}",
+            path.display()
+        );
+    }
+    Ok(path)
 }
 
 fn prepare_socket_dir(path: &Path) -> Result<()> {
@@ -1027,6 +1047,27 @@ fn log(message: &str) {
 mod tests {
     use super::*;
 
+    #[test]
+    fn socket_directory_default_is_scoped_by_uid() {
+        assert_eq!(
+            default_socket_dir(1000),
+            PathBuf::from("/tmp/codex-browser-use-1000")
+        );
+    }
+
+    #[test]
+    fn complete_socket_path_is_guarded_against_the_linux_limit() {
+        let short = socket_path_for(Path::new("/tmp/codex-browser-use-1000"), 42, 7).unwrap();
+        assert_eq!(
+            short,
+            PathBuf::from("/tmp/codex-browser-use-1000/extension-42-7.sock")
+        );
+
+        let long_dir = PathBuf::from("/tmp").join("x".repeat(MAX_UNIX_SOCKET_PATH_BYTES));
+        let error = socket_path_for(&long_dir, 42, 7).unwrap_err();
+        assert!(error.to_string().contains("unix socket path exceeds"));
+    }
+
     #[test]
     fn frame_round_trip_uses_native_length_prefix() {
         let message = json!({ "jsonrpc": "2.0", "id": "1", "method": "ping" });

scripts/lib/browser-client-node-repl-runtime.test.js

@@ -0,0 +1,126 @@
+#!/usr/bin/env node
+"use strict";
+
+const assert = require("node:assert/strict");
+const { spawn } = require("node:child_process");
+const fs = require("node:fs");
+const path = require("node:path");
+const readline = require("node:readline");
+const test = require("node:test");
+const { pathToFileURL } = require("node:url");
+
+const runtimePath = process.env.CODEX_NODE_REPL_PATH;
+const pluginsRoot = process.env.CODEX_STAGED_BUNDLED_PLUGINS_ROOT;
+
+function runNodeReplImport(runtime, clients) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(runtime, [], {
+      env: {
+        ...process.env,
+        CODEX_BROWSER_USE_SOCKET_DIR: "/tmp/codex-browser-use-runtime-test",
+      },
+      stdio: ["pipe", "pipe", "pipe"],
+    });
+    const stdout = readline.createInterface({ input: child.stdout });
+    let stderr = "";
+    let settled = false;
+
+    const finish = (error, value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      stdout.close();
+      child.kill("SIGTERM");
+      if (error) reject(error);
+      else resolve(value);
+    };
+
+    const send = (message) => child.stdin.write(`${JSON.stringify(message)}\n`);
+    const code = `${clients
+      .map((client) => `await import(${JSON.stringify(pathToFileURL(client).href)});`)
+      .join("")}nodeRepl.write("imports-ok")`;
+    const timer = setTimeout(
+      () => finish(new Error(`node_repl import timed out: ${stderr}`)),
+      20_000,
+    );
+
+    child.stderr.setEncoding("utf8");
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk;
+    });
+    child.on("error", (error) => finish(error));
+    child.on("exit", (codeValue, signal) => {
+      if (!settled) {
+        finish(
+          new Error(
+            `node_repl exited before the import response (code=${codeValue}, signal=${signal}): ${stderr}`,
+          ),
+        );
+      }
+    });
+    stdout.on("line", (line) => {
+      let message;
+      try {
+        message = JSON.parse(line);
+      } catch {
+        return;
+      }
+
+      if (message.id === 1) {
+        send({ jsonrpc: "2.0", method: "notifications/initialized", params: {} });
+        send({
+          jsonrpc: "2.0",
+          id: 2,
+          method: "tools/call",
+          params: {
+            name: "js",
+            arguments: {
+              code,
+              timeout_ms: 10_000,
+              title: "Import staged Browser clients",
+            },
+          },
+        });
+      }
+
+      if (message.id === 2) {
+        const text = message.result?.content
+          ?.filter((item) => item.type === "text")
+          .map((item) => item.text)
+          .join("");
+        if (message.result?.isError) {
+          finish(new Error(`node_repl import failed: ${text || stderr}`));
+        } else {
+          finish(null, text);
+        }
+      }
+    });
+
+    send({
+      jsonrpc: "2.0",
+      id: 1,
+      method: "initialize",
+      params: {
+        protocolVersion: "2025-06-18",
+        capabilities: {},
+        clientInfo: { name: "codex-browser-client-runtime-test", version: "1" },
+      },
+    });
+  });
+}
+
+test(
+  "staged Browser and Chrome clients import through the real node_repl runtime",
+  { skip: !runtimePath || !pluginsRoot },
+  async () => {
+    const clients = ["browser", "chrome"].map((plugin) =>
+      path.join(pluginsRoot, plugin, "scripts", "browser-client.mjs"),
+    );
+    assert.ok(fs.existsSync(runtimePath), `node_repl runtime not found: ${runtimePath}`);
+    for (const client of clients) {
+      assert.ok(fs.existsSync(client), `staged Browser client not found: ${client}`);
+    }
+
+    assert.equal(await runNodeReplImport(runtimePath, clients), "imports-ok");
+  },
+);

scripts/lib/bundled-plugins.sh

@@ -1021,6 +1021,20 @@ patch_browser_client_iab_socket_scope() {
     fi
 }
 
+patch_browser_client_linux_socket_dir() {
+    local client="$1"
+    local patcher="$SCRIPT_DIR/scripts/lib/patch-browser-client-iab-socket-scope.js"
+
+    if [ ! -f "$patcher" ]; then
+        warn "Browser socket-directory patch helper not found at $patcher; leaving browser-client.mjs unchanged"
+        return 0
+    fi
+
+    if ! node "$patcher" "$client" --socket-dir-only >&2; then
+        warn "Browser socket-directory patch helper failed; leaving browser-client.mjs unchanged"
+    fi
+}
+
 normalize_plugin_script_executable_modes() {
     local target_plugin="$1"
     local scripts_dir="$target_plugin/scripts"
@@ -1066,6 +1080,7 @@ stage_chrome_plugin_from_upstream() {
     patch_browser_use_node_repl_config_shim "$target_plugin/scripts/browser-client.mjs"
     patch_browser_use_native_pipe_import_meta_bridge "$target_plugin/scripts/browser-client.mjs"
     patch_browser_use_site_status_allowlist_fallback "$target_plugin/scripts/browser-client.mjs"
+    patch_browser_client_linux_socket_dir "$target_plugin/scripts/browser-client.mjs"
     normalize_plugin_script_executable_modes "$target_plugin"
     if ! install_chrome_extension_host_resource "$target_plugin"; then
         rm -rf "$target_plugin"

scripts/lib/patch-browser-client-iab-socket-scope.js

@@ -5,12 +5,41 @@ const fs = require("node:fs");
 
 const clientPath = process.argv[2];
 if (!clientPath) {
-  throw new Error("Usage: patch-browser-client-iab-socket-scope.js /path/to/browser-client.mjs");
+  throw new Error(
+    "Usage: patch-browser-client-iab-socket-scope.js /path/to/browser-client.mjs [--socket-dir-only]",
+  );
 }
+const socketDirOnly = process.argv.includes("--socket-dir-only");
 
-const marker = "/*codexLinuxIabSocketScope*/";
-const source = fs.readFileSync(clientPath, "utf8");
-if (source.includes(marker)) {
+const socketDirMarker = "/*codexLinuxPerUserBrowserSocketDir*/";
+const iabMarker = "/*codexLinuxIabSocketScope*/";
+let source = fs.readFileSync(clientPath, "utf8");
+
+if (!source.includes(socketDirMarker)) {
+  const socketDirectoryPattern =
+    /([A-Za-z_$][\w$]*)=([A-Za-z_$][\w$]*)=>\2==="win32"\?("(?:\\.|[^"\\])*codex-browser-use"):"\/tmp\/codex-browser-use"/g;
+  const socketDirectoryMatches = [...source.matchAll(socketDirectoryPattern)];
+  if (socketDirectoryMatches.length === 1) {
+    const [target, resolver, platform, windowsSocket] = socketDirectoryMatches[0];
+    const userInfoImport =
+      'import{userInfo as codexLinuxBrowserUseUserInfo}from"node:os";';
+    const helper =
+      `function codexLinuxBrowserUseSocketDir(){let e=globalThis.nodeRepl?.env?.CODEX_BROWSER_USE_SOCKET_DIR;` +
+      `if(typeof e==="string"&&e.length>0)return e;let t=codexLinuxBrowserUseUserInfo().uid;` +
+      `if(Number.isInteger(t)&&t>=0)return \`/tmp/codex-browser-use-\${t}\`;` +
+      `throw Error("Browser Use cannot resolve a per-user Linux socket directory")}${socketDirMarker}`;
+    const replacement =
+      `${resolver}=${platform}=>${platform}==="win32"?${windowsSocket}:codexLinuxBrowserUseSocketDir()`;
+    source = userInfoImport + helper + source.replace(target, replacement);
+  } else if (source.includes("/tmp/codex-browser-use")) {
+    process.stderr.write(
+      `WARN: Expected one Browser Use socket-directory resolver, found ${socketDirectoryMatches.length}; leaving its path unchanged\n`,
+    );
+  }
+}
+
+if (socketDirOnly || source.includes(iabMarker)) {
+  fs.writeFileSync(clientPath, source, "utf8");
   process.exit(0);
 }
 
@@ -20,9 +49,10 @@ const matches = [...source.matchAll(socketListingPattern)];
 if (matches.length !== 1) {
   if (source.includes("codex-browser-use")) {
     process.stderr.write(
-      `WARN: Expected one IAB Browser socket listing target, found ${matches.length}; leaving browser-client.mjs unchanged\n`,
+      `WARN: Expected one IAB Browser socket listing target, found ${matches.length}; leaving IAB discovery unchanged\n`,
     );
   }
+  fs.writeFileSync(clientPath, source, "utf8");
   process.exit(0);
 }
 
@@ -40,7 +70,7 @@ const [
 const replacement =
   `${dispatcher}=()=>${platform}()==="win32"?${windowsListing}():${unixListing}(),` +
   `${unixListing}=async()=>(await ${readDirectory}(${socketDirectory}))` +
-  `.filter(${entry}=>!${entry}.startsWith("extension-")${marker})` +
+  `.filter(${entry}=>!${entry}.startsWith("extension-")${iabMarker})` +
   `.map(${entry}=>${pathModule}.resolve(${socketDirectory},${entry})),` +
   `${windowsListing}=async()=>`;
 fs.writeFileSync(clientPath, source.replace(target, replacement), "utf8");