fix(app/security): restore trusted automation contracts

flake.nix

@@ -134,10 +134,10 @@
 
         chatgptDmg = pkgs.fetchurl {
           url = "https://persistent.oaistatic.com/codex-app-prod/ChatGPT.dmg";
-          hash = "sha256-7P+2/AIXozb8zrh1jwpUzDoGSBFWGKhr3czByxj7SKQ=";
+          hash = "sha256-QF22NyzBPHnSkcIaMRWXcmMhXC28uoOMdsk1JC1GxKA=";
         };
 
-        chatgptVersion = "26.810.52044";
+        chatgptVersion = "26.814.41407";
         electronVersion = "42.3.0";
         electronPlatform =
           {
@@ -248,23 +248,30 @@
         };
 
         browserUseNodeReplRuntime = pkgs.fetchurl {
-          url = "https://persistent.oaistatic.com/codex-primary-runtime/26.426.12240/codex-primary-runtime-linux-x64-26.426.12240.tar.xz";
-          hash = "sha256-21Yk6276NrZuxvbdBIjO+5ZuSWNoYqq2IJpDNsHKkMQ=";
+          url = "https://persistent.oaistatic.com/codex-app-prod/linux/deb/pool/main/c/chatgpt/chatgpt_26.814.41407_amd64.deb";
+          hash = "sha256-BT1azpHEihcUau8Cykq7AKKx6U/9FcoBiR/YSoInyoA=";
         };
 
         browserUseNodeRepl = if system == "x86_64-linux" then pkgs.stdenv.mkDerivation {
           pname = "codex-browser-use-node-repl";
-          version = "26.426.12240";
+          version = "26.814.41407";
           src = browserUseNodeReplRuntime;
 
+          nativeBuildInputs = [ pkgs.binutils pkgs.xz ];
+
+          dontUnpack = true;
           dontConfigure = true;
           dontBuild = true;
 
           installPhase = ''
             runHook preInstall
             mkdir -p "$out/bin"
-            tar -xJf "$src" -C "$TMPDIR" codex-primary-runtime/dependencies/bin/node_repl
-            install -m 0755 "$TMPDIR/codex-primary-runtime/dependencies/bin/node_repl" "$out/bin/node_repl"
+            ar p "$src" data.tar.xz > "$TMPDIR/chatgpt-data.tar.xz"
+            tar -xJf "$TMPDIR/chatgpt-data.tar.xz" -C "$TMPDIR" ./usr/lib/chatgpt/resources/cua_node/bin/node_repl
+            grep -aFq 'NODE_REPL_TRUSTED_SERVICES' "$TMPDIR/usr/lib/chatgpt/resources/cua_node/bin/node_repl"
+            grep -aFq 'NODE_REPL_TRUSTED_RPC_ENABLED' "$TMPDIR/usr/lib/chatgpt/resources/cua_node/bin/node_repl"
+            grep -aFq 'nodeRepl.rpc = function rpc' "$TMPDIR/usr/lib/chatgpt/resources/cua_node/bin/node_repl"
+            install -m 0755 "$TMPDIR/usr/lib/chatgpt/resources/cua_node/bin/node_repl" "$out/bin/node_repl"
             runHook postInstall
           '';
         } else null;
@@ -1246,25 +1253,41 @@ PY
               "$resources_dir/node_repl.chatgpt-linux-original"; do
               if [ -f "$node_repl_binary" ] \
                   && [ "$(dd if="$node_repl_binary" bs=1 count=4 2>/dev/null | od -An -tx1 | tr -d ' \n')" = "7f454c46" ]; then
-                patchelf --set-interpreter "$(cat ${pkgs.stdenv.cc}/nix-support/dynamic-linker)" \
-                  --set-rpath "${pkgs.lib.makeLibraryPath [ pkgs.stdenv.cc.cc.lib pkgs.glibc ]}" \
-                  "$node_repl_binary"
+                node_repl_interpreter="$(patchelf --print-interpreter "$node_repl_binary" 2>/dev/null || true)"
+                node_repl_rpath="$(patchelf --print-rpath "$node_repl_binary" 2>/dev/null || true)"
+                node_repl_needed="$(patchelf --print-needed "$node_repl_binary" 2>/dev/null || true)"
+                if [ -n "$node_repl_interpreter" ]; then
+                  patchelf --set-interpreter "$(cat ${pkgs.stdenv.cc}/nix-support/dynamic-linker)" \
+                    --set-rpath "${pkgs.lib.makeLibraryPath [ pkgs.stdenv.cc.cc.lib pkgs.glibc ]}" \
+                    "$node_repl_binary"
+                elif [ -n "$node_repl_needed" ] || [ -n "$node_repl_rpath" ]; then
+                  echo "node_repl has dynamic dependencies without an interpreter: $node_repl_binary" >&2
+                  exit 1
+                fi
               fi
             done
 
             if [ -f "$resources_dir/node_repl.chatgpt-linux-original" ]; then
               node_repl_interpreter="$(patchelf --print-interpreter \
-                "$resources_dir/node_repl.chatgpt-linux-original")"
+                "$resources_dir/node_repl.chatgpt-linux-original" 2>/dev/null || true)"
               node_repl_rpath="$(patchelf --print-rpath \
-                "$resources_dir/node_repl.chatgpt-linux-original")"
-              case "$node_repl_interpreter" in
-                /nix/store/*) ;;
-                *) echo "node_repl backup has non-Nix interpreter: $node_repl_interpreter" >&2; exit 1 ;;
-              esac
-              case "$node_repl_rpath" in
-                *"/nix/store/"*) ;;
-                *) echo "node_repl backup has non-Nix RPATH: $node_repl_rpath" >&2; exit 1 ;;
-              esac
+                "$resources_dir/node_repl.chatgpt-linux-original" 2>/dev/null || true)"
+              node_repl_needed="$(patchelf --print-needed \
+                "$resources_dir/node_repl.chatgpt-linux-original" 2>/dev/null || true)"
+              if [ -z "$node_repl_interpreter" ] \
+                  && [ -z "$node_repl_rpath" ] \
+                  && [ -z "$node_repl_needed" ]; then
+                : # The signed runtime is static PIE and needs no Nix ELF rewrite.
+              else
+                case "$node_repl_interpreter" in
+                  /nix/store/*) ;;
+                  *) echo "node_repl backup has non-Nix interpreter: $node_repl_interpreter" >&2; exit 1 ;;
+                esac
+                case "$node_repl_rpath" in
+                  *"/nix/store/"*) ;;
+                  *) echo "node_repl backup has non-Nix RPATH: $node_repl_rpath" >&2; exit 1 ;;
+                esac
+              fi
             fi
 
             ${patchNixInstalledApp "$out/opt/chatgpt"}

launcher/start.sh.template

@@ -2999,6 +2999,138 @@ recover_unhealthy_running_app() {
     rm -f "$APP_PID_FILE" "$WEBVIEW_PID_FILE" "$LAUNCH_ACTION_SOCKET"
 }
 
+recover_stale_computer_use_sockets() {
+    if ! needs_cold_start; then
+        return 0
+    fi
+    if [ "$LAUNCHER_LOCK_HELD" -ne 1 ]; then
+        echo "WARN: refusing Computer Use socket recovery without the cold-start launcher lock" >&2
+        return 0
+    fi
+    if [ -z "${XDG_RUNTIME_DIR:-}" ]; then
+        return 0
+    fi
+
+    if ! python3 - "$XDG_RUNTIME_DIR" "$LAUNCH_ACTION_RUNTIME_DIR" <<'PY'
+import errno
+import os
+import socket
+import stat
+import sys
+
+runtime_root = os.path.abspath(sys.argv[1])
+runtime_dir = os.path.abspath(sys.argv[2])
+current_uid = os.getuid()
+
+
+def private_directory(path):
+    try:
+        metadata = os.lstat(path)
+    except OSError as exc:
+        print(f"WARN: preserving Computer Use sockets because {path} cannot be inspected: {exc}", file=sys.stderr)
+        return False
+    return (
+        stat.S_ISDIR(metadata.st_mode)
+        and not stat.S_ISLNK(metadata.st_mode)
+        and metadata.st_uid == current_uid
+        and stat.S_IMODE(metadata.st_mode) == 0o700
+    )
+
+
+try:
+    confined = os.path.commonpath((runtime_root, runtime_dir)) == runtime_root
+except ValueError:
+    confined = False
+if not confined or not private_directory(runtime_root):
+    print("WARN: preserving Computer Use sockets because XDG_RUNTIME_DIR is not a trusted private directory", file=sys.stderr)
+    sys.exit(0)
+
+relative_dir = os.path.relpath(runtime_dir, runtime_root)
+cursor = runtime_root
+if relative_dir != ".":
+    for component in relative_dir.split(os.sep):
+        if component in ("", ".", ".."):
+            print("WARN: preserving Computer Use sockets because the runtime path is not confined", file=sys.stderr)
+            sys.exit(0)
+        cursor = os.path.join(cursor, component)
+        if not private_directory(cursor):
+            print("WARN: preserving Computer Use sockets because the app runtime directory is not private", file=sys.stderr)
+            sys.exit(0)
+
+
+def recover_socket(name):
+    path = os.path.join(runtime_dir, name)
+    if len(os.fsencode(path)) > 100:
+        print(f"WARN: preserving Computer Use socket with an overlong path: {name}", file=sys.stderr)
+        return
+    try:
+        before = os.lstat(path)
+    except FileNotFoundError:
+        return
+    except OSError as exc:
+        print(f"WARN: preserving Computer Use socket {name}: {exc}", file=sys.stderr)
+        return
+
+    if not (
+        stat.S_ISSOCK(before.st_mode)
+        and before.st_uid == current_uid
+        and stat.S_IMODE(before.st_mode) == 0o600
+    ):
+        print(f"WARN: preserving untrusted Computer Use endpoint: {name}", file=sys.stderr)
+        return
+
+    client = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+    client.settimeout(0.15)
+    try:
+        client.connect(path)
+    except FileNotFoundError:
+        return
+    except OSError as exc:
+        if exc.errno != errno.ECONNREFUSED:
+            print(f"WARN: preserving Computer Use socket {name} after probe error: {exc}", file=sys.stderr)
+            return
+    else:
+        print(f"Preserving active Computer Use socket: {name}")
+        return
+    finally:
+        client.close()
+
+    try:
+        after = os.lstat(path)
+    except FileNotFoundError:
+        return
+    except OSError as exc:
+        print(f"WARN: preserving Computer Use socket {name} after revalidation error: {exc}", file=sys.stderr)
+        return
+
+    if not (
+        after.st_dev == before.st_dev
+        and after.st_ino == before.st_ino
+        and stat.S_ISSOCK(after.st_mode)
+        and after.st_uid == current_uid
+        and stat.S_IMODE(after.st_mode) == 0o600
+    ):
+        print(f"WARN: preserving Computer Use socket changed during recovery: {name}", file=sys.stderr)
+        return
+
+    try:
+        os.unlink(path)
+    except FileNotFoundError:
+        return
+    except OSError as exc:
+        print(f"WARN: could not remove stale Computer Use socket {name}: {exc}", file=sys.stderr)
+        return
+    print(f"Removed stale Computer Use socket: {name}")
+
+
+recover_socket("computer-use-authority.sock")
+recover_socket("computer-use-cursor.sock")
+PY
+    then
+        echo "WARN: Computer Use socket recovery failed closed; preserving existing endpoints" >&2
+    fi
+}
+
 send_warm_start_launch_action() {
     [ "$WARM_START" -eq 1 ] || return 1
     [ -S "$LAUNCH_ACTION_SOCKET" ] || return 1
@@ -4961,6 +5093,7 @@ log_phase "initial_launch_state_refreshed"
 
 recover_unhealthy_running_app
 prepare_launch_state_under_lock
+recover_stale_computer_use_sockets
 
 if send_warm_start_launch_action "${LAUNCHER_ARGS[@]}"; then
     echo "Sent launch args over warm-start IPC"

plugins/openai-bundled/plugins/computer-use/.mcp.json

@@ -3,7 +3,14 @@
     "computer-use": {
       "command": "./bin/chatgpt-computer-use-linux",
       "args": ["mcp"],
-      "cwd": "."
+      "cwd": ".",
+      "env_vars": [
+        "CODEX_HOME",
+        "XDG_RUNTIME_DIR",
+        "CHATGPT_LINUX_APP_ID",
+        "CHATGPT_APP_ID",
+        "CHATGPT_LINUX_INSTANCE_ID"
+      ]
     }
   }
 }

port-integrations/conversation-mode/patch.js

@@ -274,7 +274,7 @@ function applyDictationEndpointPatch(source) {
   const recorderCreationPattern =
     /let ([A-Za-z_$][\w$]*)=new MediaRecorder\(([A-Za-z_$][\w$]*)\);([A-Za-z_$][\w$]*)\.current=\1;let ([A-Za-z_$][\w$]*)=/gu;
   const recorderStartPattern =
-    /([A-Za-z_$][\w$]*)\.onstop=\(\)=>\{([A-Za-z_$][\w$]*)\(\)\},([A-Za-z_$][\w$]*)==null\?\1\.start\(\):\1\.start\(([A-Za-z_$][\w$]*)\),([A-Za-z_$][\w$]*)\.performance\.mark\(`recording_started`\),([A-Za-z_$][\w$]*)\(!0\)/gu;
+    /([A-Za-z_$][\w$]*)\.onstop=\(\)=>\{([A-Za-z_$][\w$]*)\(\)\},([A-Za-z_$][\w$]*)==null\?\1\.start\(\):\1\.start\(([A-Za-z_$][\w$]*)\),([A-Za-z_$][\w$]*)\(!0\),([A-Za-z_$][\w$]*)\.performance\.mark\(`recording_started`\),([A-Za-z_$][\w$]*)\(!0\)/gu;
   const transcriptPattern =
     /([A-Za-z_$][\w$]*)\.length>0&&\(([A-Za-z_$][\w$]*)==null\?([A-Za-z_$][\w$]*)\.getInstance\(\)\.dispatchMessage\(`global-dictation-record-history-item`,\{text:\1\}\):\2\.setTranscript\(\1\),([A-Za-z_$][\w$]*)\.performance\.mark\(`transcript_dispatched`\),([A-Za-z_$][\w$]*)\.action===`send`\?([A-Za-z_$][\w$]*)\.onTranscriptSend\(\1\):\6\.onTranscriptInsert\(\1\)\)/gu;
   const uniqueMatch = (pattern) => {
@@ -319,7 +319,7 @@ function applyDictationEndpointPatch(source) {
   patched = patched.replace(
     recorderStartMatch[0],
     () =>
-      `${recorderVar}.onstop=()=>{${recorderStartMatch[2]}()},${recorderVar}.chatgptLinuxConversationCleanup=globalThis.chatgptLinuxConversationEndpoint?.({stream:${streamVar},stop:()=>{${actionRef}.current=\`send\`;${recorderVar}.state!==\`inactive\`&&${recorderVar}.stop()},isActive:()=>${recorderRefVar}.current===${recorderVar}&&${recorderVar}.state!==\`inactive\`}),${recorderStartMatch[3]}==null?${recorderVar}.start():${recorderVar}.start(${recorderStartMatch[4]}),${recorderStartMatch[5]}.performance.mark(\`recording_started\`),${recorderStartMatch[6]}(!0)`,
+      `${recorderVar}.onstop=()=>{${recorderStartMatch[2]}()},${recorderVar}.chatgptLinuxConversationCleanup=globalThis.chatgptLinuxConversationEndpoint?.({stream:${streamVar},stop:()=>{${actionRef}.current=\`send\`;${recorderVar}.state!==\`inactive\`&&${recorderVar}.stop()},isActive:()=>${recorderRefVar}.current===${recorderVar}&&${recorderVar}.state!==\`inactive\`}),${recorderStartMatch[3]}==null?${recorderVar}.start():${recorderVar}.start(${recorderStartMatch[4]}),${recorderStartMatch[5]}(!0),${recorderStartMatch[6]}.performance.mark(\`recording_started\`),${recorderStartMatch[7]}(!0)`,
   );
   return patched.replace(
     transcriptMatch[0],

port-integrations/conversation-mode/test.js

@@ -176,7 +176,7 @@ const currentDictationAsset = currentAppInitialAsset;
 const currentAssistantAsset = "local-conversation-turn-current.js";
 
 const dictationSource =
-  "function Opt(){let C={current:null},z={current:null},O={current:[]},k={current:null};let pe=async e=>{let{analytics:t,audio:r,handlers:i,recordingPersistence:a}=e;let l=`hello`;l.length>0&&(a==null?_m.getInstance().dispatchMessage(`global-dictation-record-history-item`,{text:l}):a.setTranscript(l),t.performance.mark(`transcript_dispatched`),e.action===`send`?i.onTranscriptSend(l):i.onTranscriptInsert(l))},ge=async()=>{let e=k.current??`insert`,t={performance:{mark(){}}},n={onTranscriptInsert(){},onTranscriptSend(){}};k.current=null;let i=C.current,a=z.current;z.current=null;let o=O.current;if(O.current=[],i&&(i.ondataavailable=null,i.onstop=null),C.current=null,q(),a?.finalize(e===`abort`||o.length===0,100),e===`abort`||o.length===0)return;await pe({action:e,analytics:t,audio:o,handlers:n,recordingPersistence:a})};return{startDictation:async()=>{let a=wpt(null,null),t=await a.stream,n={performance:{mark(){}}};let c=new MediaRecorder(t);C.current=c;let l=Xit({createdAtMs:1});if(z.current=l,O.current=[],c.ondataavailable=e=>{e.data.size>0&&(O.current.push(e.data),l?.appendChunk(e.data,c.mimeType||e.data.type||`audio/webm`))},c.onstop=()=>{ge()},l==null?c.start():c.start(Zit),n.performance.mark(`recording_started`),_(!0),k.current!=null){c.stop();return}}}}function wpt(e,t){let n=!1,r=null,i=()=>{n=!0,r?.getTracks().forEach(e=>{e.stop()}),r=null};return{dispose:i,stream:(e==null?Udt({channelCount:1},t):Gdt({channelCount:1},e,t)).then(e=>(r=e,n&&i(),e))}}";
+  "function Opt(){let C={current:null},z={current:null},O={current:[]},k={current:null};let pe=async e=>{let{analytics:t,audio:r,handlers:i,recordingPersistence:a}=e;let l=`hello`;l.length>0&&(a==null?_m.getInstance().dispatchMessage(`global-dictation-record-history-item`,{text:l}):a.setTranscript(l),t.performance.mark(`transcript_dispatched`),e.action===`send`?i.onTranscriptSend(l):i.onTranscriptInsert(l))},ge=async()=>{let e=k.current??`insert`,t={performance:{mark(){}}},n={onTranscriptInsert(){},onTranscriptSend(){}};k.current=null;let i=C.current,a=z.current;z.current=null;let o=O.current;if(O.current=[],i&&(i.ondataavailable=null,i.onstop=null),C.current=null,q(),a?.finalize(e===`abort`||o.length===0,100),e===`abort`||o.length===0)return;await pe({action:e,analytics:t,audio:o,handlers:n,recordingPersistence:a})};return{startDictation:async()=>{let a=wpt(null,null),t=await a.stream,n={performance:{mark(){}}};let c=new MediaRecorder(t);C.current=c;let l=Xit({createdAtMs:1});if(z.current=l,O.current=[],c.ondataavailable=e=>{e.data.size>0&&(O.current.push(e.data),l?.appendChunk(e.data,c.mimeType||e.data.type||`audio/webm`))},c.onstop=()=>{ge()},l==null?c.start():c.start(Zit),ue(!0),n.performance.mark(`recording_started`),_(!0),k.current!=null){c.stop();return}}}}function wpt(e,t){let n=!1,r=null,i=()=>{n=!0,r?.getTracks().forEach(e=>{e.stop()}),r=null};return{dispose:i,stream:(e==null?Udt({channelCount:1},t):Gdt({channelCount:1},e,t)).then(e=>(r=e,n&&i(),e))}}";
 
 const currentComposerControlSource =
   "function Vka(e){let{isResponseInProgress:x,onStop:T,submitBlockReason:E,voiceControls:A}=e,j=Nn(Bk),M=RZ(),N=Rk(j),P=LEa(j.value,t),{canRetryDictation:B,dictationShortcutLabel:V,isDictating:U,isDictationButtonVisible:W,isDictationSupported:G,isTranscribing:ee,isVoiceFooterVisible:te,recordingDurationMs:ne,retryDictation:K,startDictation:re,stopDictation:ie,realtimeSession:ae,waveformCanvasRef:oe}=A;let je=(0,x7.jsx)(_ka,{conversationId:N,hostId:g,cwdOverride:_}),ke=(0,x7.jsx)(Twe,{isTranscribing:ee,recordingDurationMs:ne,waveformCanvasRef:oe,stopDictation:ie});let Ae=(0,x7.jsx)(Ewe,{idleIcon:U,isVisible:W,disabled:!G,isTranscribing:ee,canRetryDictation:B,shortcutLabel:V,retryDictation:K,startDictation:re,stopDictation:ie});return Ae}";

port-integrations/project-group-last-updated-sort/patch.js

@@ -1,14 +1,14 @@
 "use strict";
 
 const currentGroupSorter =
-  "function ROn({groups:e,items:t,projectOrder:n}){let r=new Map(t.map(e=>[e.task.key,e.recencyAt]));return bEn(e.map((e,t)=>({group:e,index:t,recencyAt:e.threadKeys.reduce((e,t)=>Math.max(e,r.get(t)??0),e.projectUpdatedAt??0)})).sort((e,t)=>t.recencyAt-e.recencyAt||e.index-t.index).map(({group:e})=>e),n)}";
+  "function von({groups:e,projectOrder:t}){return sin(e,t)}";
 const patchedGroupSorter =
-  "function ROn({groups:e,items:t,projectOrder:n,sortMode:chatgptLinuxProjectSortMode}){let r=new Map(t.map(e=>[e.task.key,e.recencyAt]));return((chatgptLinuxRecencySortedGroups)=>chatgptLinuxProjectSortMode===`updated_at`?chatgptLinuxRecencySortedGroups:bEn(chatgptLinuxRecencySortedGroups,n))(e.map((e,t)=>({group:e,index:t,recencyAt:e.threadKeys.reduce((e,t)=>Math.max(e,r.get(t)??0),e.projectUpdatedAt??0)})).sort((e,t)=>t.recencyAt-e.recencyAt||e.index-t.index).map(({group:e})=>e))}";
+  "function von({groups:e,projectOrder:t,items:n,sortMode:r}){if(r!==`updated_at`)return sin(e,t);let i=new Map;for(let e of n??[]){let t=e.task?.key;t!=null&&i.set(t,Math.max(i.get(t)??0,e.recencyAt??0))}return e.map((e,t)=>({group:e,index:t,recencyAt:(e.threadKeys??[]).reduce((e,t)=>Math.max(e,i.get(t)??0),e.projectUpdatedAt??0)})).sort((e,t)=>t.recencyAt-e.recencyAt||e.index-t.index).map(({group:e})=>e)}";
 
 const currentGroupSorterCall =
-  "M=ROn({groups:k,items:f,projectOrder:cm(t,ru.PROJECT_ORDER)})";
+  "M=von({groups:k,projectOrder:im(t,tu.PROJECT_ORDER)})";
 const patchedGroupSorterCall =
-  "M=ROn({groups:k,items:f,projectOrder:cm(t,ru.PROJECT_ORDER),sortMode:j})";
+  "M=von({groups:k,projectOrder:im(t,tu.PROJECT_ORDER),items:f,sortMode:j})";
 
 function countOccurrences(source, needle) {
   return source.split(needle).length - 1;