fix(browser): scope socket directory per Linux user

Author: danielcadev

computer-use-linux/src/bin/codex-chrome-extension-host.rs

@@ -26,7 +26,7 @@ use chrome_runtime::RuntimeManager;
 const HOST_NAME: &str = "com.openai.codexextension";
 const SOCKET_DIR_ENV: &str = "CODEX_BROWSER_USE_SOCKET_DIR";
 const SESSIONS_DIR_ENV: &str = "CODEX_BROWSER_USE_SESSIONS_DIR";
-const DEFAULT_SOCKET_DIR: &str = "/tmp/codex-browser-use";
+const SOCKET_DIR_NAME: &str = "codex-browser-use";
 const ROLLOUT_POLL_INTERVAL: Duration = Duration::from_millis(500);
 const OBSERVED_TURN_TTL: Duration = Duration::from_secs(6 * 60 * 60);
 const ROLLOUT_SEARCH_MAX_DEPTH: usize = 5;
@@ -365,9 +365,20 @@ fn main() -> Result<()> {
 }
 
 fn socket_dir() -> PathBuf {
-    env::var_os(SOCKET_DIR_ENV)
+    if let Some(path) = env::var_os(SOCKET_DIR_ENV).filter(|value| !value.is_empty()) {
+        return PathBuf::from(path);
+    }
+
+    let runtime_dir = env::var_os("XDG_RUNTIME_DIR");
+    default_socket_dir(runtime_dir.as_deref(), unsafe { libc::geteuid() })
+}
+
+fn default_socket_dir(runtime_dir: Option<&std::ffi::OsStr>, effective_uid: u32) -> PathBuf {
+    runtime_dir
+        .filter(|value| !value.is_empty())
         .map(PathBuf::from)
-        .unwrap_or_else(|| PathBuf::from(DEFAULT_SOCKET_DIR))
+        .map(|path| path.join(SOCKET_DIR_NAME))
+        .unwrap_or_else(|| PathBuf::from(format!("/tmp/{SOCKET_DIR_NAME}-{effective_uid}")))
 }
 
 fn sessions_root() -> Option<PathBuf> {
@@ -1027,6 +1038,22 @@ fn log(message: &str) {
 mod tests {
     use super::*;
 
+    #[test]
+    fn socket_directory_prefers_the_per_user_runtime_directory() {
+        assert_eq!(
+            default_socket_dir(Some(std::ffi::OsStr::new("/run/user/1000")), 1000),
+            PathBuf::from("/run/user/1000/codex-browser-use")
+        );
+    }
+
+    #[test]
+    fn socket_directory_fallback_is_scoped_by_uid() {
+        assert_eq!(
+            default_socket_dir(None, 1000),
+            PathBuf::from("/tmp/codex-browser-use-1000")
+        );
+    }
+
     #[test]
     fn frame_round_trip_uses_native_length_prefix() {
         let message = json!({ "jsonrpc": "2.0", "id": "1", "method": "ping" });

scripts/lib/bundled-plugins.sh

@@ -1021,6 +1021,20 @@ patch_browser_client_iab_socket_scope() {
     fi
 }
 
+patch_browser_client_linux_socket_dir() {
+    local client="$1"
+    local patcher="$SCRIPT_DIR/scripts/lib/patch-browser-client-iab-socket-scope.js"
+
+    if [ ! -f "$patcher" ]; then
+        warn "Browser socket-directory patch helper not found at $patcher; leaving browser-client.mjs unchanged"
+        return 0
+    fi
+
+    if ! node "$patcher" "$client" --socket-dir-only >&2; then
+        warn "Browser socket-directory patch helper failed; leaving browser-client.mjs unchanged"
+    fi
+}
+
 normalize_plugin_script_executable_modes() {
     local target_plugin="$1"
     local scripts_dir="$target_plugin/scripts"
@@ -1066,6 +1080,7 @@ stage_chrome_plugin_from_upstream() {
     patch_browser_use_node_repl_config_shim "$target_plugin/scripts/browser-client.mjs"
     patch_browser_use_native_pipe_import_meta_bridge "$target_plugin/scripts/browser-client.mjs"
     patch_browser_use_site_status_allowlist_fallback "$target_plugin/scripts/browser-client.mjs"
+    patch_browser_client_linux_socket_dir "$target_plugin/scripts/browser-client.mjs"
     normalize_plugin_script_executable_modes "$target_plugin"
     if ! install_chrome_extension_host_resource "$target_plugin"; then
         rm -rf "$target_plugin"

scripts/lib/patch-browser-client-iab-socket-scope.js

@@ -5,12 +5,41 @@ const fs = require("node:fs");
 
 const clientPath = process.argv[2];
 if (!clientPath) {
-  throw new Error("Usage: patch-browser-client-iab-socket-scope.js /path/to/browser-client.mjs");
+  throw new Error(
+    "Usage: patch-browser-client-iab-socket-scope.js /path/to/browser-client.mjs [--socket-dir-only]",
+  );
 }
+const socketDirOnly = process.argv.includes("--socket-dir-only");
 
-const marker = "/*codexLinuxIabSocketScope*/";
-const source = fs.readFileSync(clientPath, "utf8");
-if (source.includes(marker)) {
+const socketDirMarker = "/*codexLinuxPerUserBrowserSocketDir*/";
+const iabMarker = "/*codexLinuxIabSocketScope*/";
+let source = fs.readFileSync(clientPath, "utf8");
+
+if (!source.includes(socketDirMarker)) {
+  const socketDirectoryPattern =
+    /([A-Za-z_$][\w$]*)=([A-Za-z_$][\w$]*)=>\2==="win32"\?("(?:\\.|[^"\\])*codex-browser-use"):"\/tmp\/codex-browser-use"/g;
+  const socketDirectoryMatches = [...source.matchAll(socketDirectoryPattern)];
+  if (socketDirectoryMatches.length === 1) {
+    const [target, resolver, platform, windowsSocket] = socketDirectoryMatches[0];
+    const helper =
+      `function codexLinuxBrowserUseSocketDir(){let e=process.env.CODEX_BROWSER_USE_SOCKET_DIR;` +
+      `if(typeof e==="string"&&e.length>0)return e;let r=process.env.XDG_RUNTIME_DIR;` +
+      `if(typeof r==="string"&&r.length>0)return r.replace(/\\\/+$/,"")+"/codex-browser-use";` +
+      `let t=typeof process.getuid==="function"?process.getuid():null;` +
+      `if(Number.isInteger(t)&&t>=0)return \`/tmp/codex-browser-use-\${t}\`;` +
+      `throw Error("Browser Use cannot resolve a per-user Linux socket directory")}${socketDirMarker}`;
+    const replacement =
+      `${resolver}=${platform}=>${platform}==="win32"?${windowsSocket}:codexLinuxBrowserUseSocketDir()`;
+    source = helper + source.replace(target, replacement);
+  } else if (source.includes("/tmp/codex-browser-use")) {
+    process.stderr.write(
+      `WARN: Expected one Browser Use socket-directory resolver, found ${socketDirectoryMatches.length}; leaving its path unchanged\n`,
+    );
+  }
+}
+
+if (socketDirOnly || source.includes(iabMarker)) {
+  fs.writeFileSync(clientPath, source, "utf8");
   process.exit(0);
 }
 
@@ -20,9 +49,10 @@ const matches = [...source.matchAll(socketListingPattern)];
 if (matches.length !== 1) {
   if (source.includes("codex-browser-use")) {
     process.stderr.write(
-      `WARN: Expected one IAB Browser socket listing target, found ${matches.length}; leaving browser-client.mjs unchanged\n`,
+      `WARN: Expected one IAB Browser socket listing target, found ${matches.length}; leaving IAB discovery unchanged\n`,
     );
   }
+  fs.writeFileSync(clientPath, source, "utf8");
   process.exit(0);
 }
 
@@ -40,7 +70,7 @@ const [
 const replacement =
   `${dispatcher}=()=>${platform}()==="win32"?${windowsListing}():${unixListing}(),` +
   `${unixListing}=async()=>(await ${readDirectory}(${socketDirectory}))` +
-  `.filter(${entry}=>!${entry}.startsWith("extension-")${marker})` +
+  `.filter(${entry}=>!${entry}.startsWith("extension-")${iabMarker})` +
   `.map(${entry}=>${pathModule}.resolve(${socketDirectory},${entry})),` +
   `${windowsListing}=async()=>`;
 fs.writeFileSync(clientPath, source.replace(target, replacement), "utf8");

scripts/lib/patch-browser-client-iab-socket-scope.test.js

@@ -7,10 +7,68 @@ const fs = require("node:fs");
 const os = require("node:os");
 const path = require("node:path");
 const test = require("node:test");
+const vm = require("node:vm");
 const { pathToFileURL } = require("node:url");
 
 const patcher = path.join(__dirname, "patch-browser-client-iab-socket-scope.js");
 
+test("Linux socket discovery uses the override, runtime directory, then UID fallback", () => {
+  const workspace = fs.mkdtempSync(path.join(os.tmpdir(), "codex-user-socket-dir-"));
+  const clientPath = path.join(workspace, "browser-client.mjs");
+  const fixture =
+    'var kE=t=>t==="win32"?"\\\\\\\\.\\\\pipe\\\\codex-browser-use":"/tmp/codex-browser-use";globalThis.result=kE("linux");';
+
+  try {
+    fs.writeFileSync(clientPath, fixture, "utf8");
+    const firstPatch = spawnSync(process.execPath, [patcher, clientPath, "--socket-dir-only"], {
+      encoding: "utf8",
+    });
+    assert.equal(firstPatch.status, 0, firstPatch.stderr);
+    const patched = fs.readFileSync(clientPath, "utf8");
+    assert.match(patched, /codexLinuxPerUserBrowserSocketDir/);
+
+    const resolve = (env, uid = 1000) => {
+      const context = { process: { env, getuid: () => uid } };
+      context.globalThis = context;
+      vm.runInNewContext(patched, context);
+      return context.result;
+    };
+    assert.equal(
+      resolve({ CODEX_BROWSER_USE_SOCKET_DIR: "/custom/browser-sockets" }),
+      "/custom/browser-sockets",
+    );
+    assert.equal(
+      resolve({ XDG_RUNTIME_DIR: "/run/user/1000/" }),
+      "/run/user/1000/codex-browser-use",
+    );
+    assert.equal(resolve({}, 1001), "/tmp/codex-browser-use-1001");
+
+    const secondPatch = spawnSync(process.execPath, [patcher, clientPath, "--socket-dir-only"], {
+      encoding: "utf8",
+    });
+    assert.equal(secondPatch.status, 0, secondPatch.stderr);
+    assert.equal(fs.readFileSync(clientPath, "utf8"), patched);
+  } finally {
+    fs.rmSync(workspace, { recursive: true, force: true });
+  }
+});
+
+test("keeps the per-user socket patch when IAB discovery cannot be identified", () => {
+  const workspace = fs.mkdtempSync(path.join(os.tmpdir(), "codex-user-socket-only-"));
+  const clientPath = path.join(workspace, "browser-client.mjs");
+  const fixture =
+    'var kE=t=>t==="win32"?"\\\\\\\\.\\\\pipe\\\\codex-browser-use":"/tmp/codex-browser-use";';
+
+  try {
+    fs.writeFileSync(clientPath, fixture, "utf8");
+    const result = spawnSync(process.execPath, [patcher, clientPath], { encoding: "utf8" });
+    assert.equal(result.status, 0, result.stderr);
+    assert.match(fs.readFileSync(clientPath, "utf8"), /codexLinuxPerUserBrowserSocketDir/);
+  } finally {
+    fs.rmSync(workspace, { recursive: true, force: true });
+  }
+});
+
 test("IAB discovery excludes extension sockets before connecting", async () => {
   const workspace = fs.mkdtempSync(path.join(os.tmpdir(), "codex-iab-socket-scope-"));
   const clientPath = path.join(workspace, "browser-client.mjs");

tests/scripts_smoke.sh

@@ -163,7 +163,7 @@ JSON
 {"name":"browser","version":"0.1.0-alpha2","interface":{"category":"Engineering"}}
 JSON
     cat > "$resources_dir/plugins/openai-bundled/plugins/browser/scripts/browser-client.mjs" <<'JS'
-function lu(e){let t=globalThis.nodeRepl?.env[e];return typeof t=="string"?t:void 0}function th(){let e=import.meta.__codexNativePipe;return e==null||typeof e.createConnection!="function"?null:e}var I2=new Set(["about:blank"]);function Gb(e){if(I2.has(e))return!0;let t;try{t=new URL(e)}catch{return!1}return t.protocol==="http:"||t.protocol==="https:"}class Uf{async fetchBlocked(e,t){let r=await bS(e.endpoint,{method:"GET"});if(!r.ok)throw new Error(ae(`${t} cannot determine if ${e.displayUrl} is allowed. Please try again later or use another source.`));let n=await r.json();return TF(n)}}var Cb=kE(hV.platform()),EV=()=>_P()==="win32"?TV():CV(),CV=async()=>(await yP(Cb)).map(e=>wP.resolve(Cb,e)),TV=async()=>[];export function setupAtlasRuntime() {}
+function lu(e){let t=globalThis.nodeRepl?.env[e];return typeof t=="string"?t:void 0}function th(){let e=import.meta.__codexNativePipe;return e==null||typeof e.createConnection!="function"?null:e}var I2=new Set(["about:blank"]);function Gb(e){if(I2.has(e))return!0;let t;try{t=new URL(e)}catch{return!1}return t.protocol==="http:"||t.protocol==="https:"}class Uf{async fetchBlocked(e,t){let r=await bS(e.endpoint,{method:"GET"});if(!r.ok)throw new Error(ae(`${t} cannot determine if ${e.displayUrl} is allowed. Please try again later or use another source.`));let n=await r.json();return TF(n)}}var kE=t=>t==="win32"?"\\\\.\\pipe\\codex-browser-use":"/tmp/codex-browser-use";var Cb=kE(hV.platform()),EV=()=>_P()==="win32"?TV():CV(),CV=async()=>(await yP(Cb)).map(e=>wP.resolve(Cb,e)),TV=async()=>[];export function setupAtlasRuntime() {}
 JS
 }
 
@@ -7296,6 +7296,8 @@ test_browser_plugin_renamed_upstream_staging() {
     assert_contains "$browser_dir/scripts/browser-client.mjs" "codexLinuxSiteStatusAllowlistFallback"
     assert_contains "$browser_dir/scripts/browser-client.mjs" "codexLinuxFileUrlPolicy"
     assert_contains "$browser_dir/scripts/browser-client.mjs" "codexLinuxIabSocketScope"
+    assert_contains "$browser_dir/scripts/browser-client.mjs" "codexLinuxPerUserBrowserSocketDir"
+    assert_not_contains "$browser_dir/scripts/browser-client.mjs" '"/tmp/codex-browser-use"'
     assert_contains "$browser_dir/scripts/browser-client.mjs" 'protocol==="file:"'
     assert_not_contains "$browser_dir/scripts/browser-client.mjs" 'protocol==="data:"'
     assert_contains "$marketplace" '"name": "browser"'
@@ -7944,7 +7946,7 @@ MD
 JSON
     cat > "$chrome_dir/scripts/browser-client.mjs" <<'JS'
 const browserPreference={};function preferredWindowIdFor(){}function getForUrl(){}const extensionInstanceId=null;
-var Cb=kE(hV.platform()),EV=()=>_P()==="win32"?TV():CV(),CV=async()=>(await yP(Cb)).map(e=>wP.resolve(Cb,e)),TV=async()=>[];
+var kE=t=>t==="win32"?"\\\\.\\pipe\\codex-browser-use":"/tmp/codex-browser-use";var Cb=kE(hV.platform()),EV=()=>_P()==="win32"?TV():CV(),CV=async()=>(await yP(Cb)).map(e=>wP.resolve(Cb,e)),TV=async()=>[];
 function lu(e){let t=globalThis.nodeRepl?.env[e];return typeof t=="string"?t:void 0}
 function Me(){let e=globalThis.nodeRepl;return e?.config==null?void 0:e}
 import{platform as yT}from"node:os";function eh(){return"privileged native pipe bridge is not available; browser-client is not trusted"}function th(){let e=globalThis.nodeRepl?.nativePipe;return e==null||typeof e.createConnection!="function"?null:e}var ml=class e{constructor(t){this.socket=t}static async create(t){let r=th();if(r!=null){let n=await r.createConnection(t);return new e(n)}throw new Error(eh())}};
@@ -8139,6 +8141,8 @@ test_chrome_plugin_staging() {
     assert_not_contains "$chrome_dir/scripts/browser-client.mjs" "codexLinuxNativePipeFallback"
     assert_not_contains "$chrome_dir/scripts/browser-client.mjs" 'await import("node:net")'
     assert_contains "$chrome_dir/scripts/browser-client.mjs" "codexLinuxSiteStatusAllowlistFallback"
+    assert_contains "$chrome_dir/scripts/browser-client.mjs" "codexLinuxPerUserBrowserSocketDir"
+    assert_not_contains "$chrome_dir/scripts/browser-client.mjs" '"/tmp/codex-browser-use"'
     assert_not_contains "$chrome_dir/scripts/browser-client.mjs" "codexLinuxIabSocketScope"
     assert_contains "$chrome_dir/skills/control-chrome/SKILL.md" "agent.browsers.list()"
     assert_contains "$chrome_dir/skills/control-chrome/SKILL.md" "browser.tabs.new()"