Isolate Electron runtime temp files per user

docs/troubleshooting.md

@@ -6,6 +6,7 @@
 | Blank window | Check whether the configured webview port is already in use: `ss -tlnp \| grep -E '5175\|5176'` |
 | `ERR_CONNECTION_REFUSED` on the webview port | Ensure `python3` works and the configured port is free |
 | Stuck on Codex logo splash | Check `~/.cache/codex-desktop/launcher.log`; another process may be serving the webview port |
+| A second launch opens another app instance, or Remote Control immediately turns itself off with `EACCES ... /tmp/codex-ipc/ipc-<uid>.sock` in the logs | Update and fully restart Codex Desktop. The launcher gives Electron a private default `TMPDIR` under `$XDG_RUNTIME_DIR`, preventing another Linux user from owning the shared IPC directory. An explicitly configured `TMPDIR` remains unchanged. |
 | `CODEX_CLI_PATH` error | Reopen the app to retry automatic CLI install, or install manually with `npm i -g --include=optional @openai/codex` / `npm i -g --include=optional --prefix ~/.local @openai/codex` |
 | `Missing optional dependency @openai/codex-linux-x64` or malformed tool calls after a self-managed npm CLI install | Reinstall with optional dependencies: `npm i -g --include=optional @openai/codex`. To repair an existing nvm install, run `npm install --include=optional` from the installed `@openai/codex` package directory |
 | `codex-update-manager status --json` shows `cli_status: "update_required"` for `/usr/bin/codex` on Arch | Pacman itself has a newer package for the installed CLI. Update through pacman instead of npm, for example `sudo pacman -Syu`; pacman-managed CLI installs are intentionally not auto-updated through npm |

launcher/start.sh.template

@@ -32,6 +32,21 @@ CODEX_LINUX_SETTINGS_FILE="$APP_SETTINGS_FILE"
 CODEX_LINUX_FEATURES_DIR="$SCRIPT_DIR/.codex-linux/features"
 export CODEX_HOME CODEX_LINUX_APP_ID CODEX_LINUX_APP_DISPLAY_NAME CODEX_LINUX_WEBVIEW_PORT CODEX_LINUX_SETTINGS_FILE CODEX_LINUX_FEATURES_DIR
 APP_STATE_DIR="${XDG_STATE_HOME:-$HOME/.local/state}/$CODEX_LINUX_APP_ID"
+
+configure_runtime_tmpdir() {
+    [ -z "${TMPDIR:-}" ] || return 0
+
+    if [ -n "${XDG_RUNTIME_DIR:-}" ] && [ -d "$XDG_RUNTIME_DIR" ] && [ -w "$XDG_RUNTIME_DIR" ]; then
+        TMPDIR="$XDG_RUNTIME_DIR/$CODEX_LINUX_APP_ID/tmp"
+    else
+        TMPDIR="$APP_STATE_DIR/tmp"
+    fi
+    mkdir -p "$TMPDIR"
+    chmod 700 "$TMPDIR"
+    export TMPDIR
+}
+
+configure_runtime_tmpdir
 APP_PID_FILE="$APP_STATE_DIR/app.pid"
 WEBVIEW_PID_FILE="$APP_STATE_DIR/webview.pid"
 LAUNCH_ACTION_RUNTIME_DIR="${XDG_RUNTIME_DIR:-$APP_STATE_DIR}/$CODEX_LINUX_APP_ID"

tests/scripts_smoke.sh

@@ -3121,6 +3121,48 @@ SCRIPT
     [ ! -s "$launcher_stderr" ] || fail "Expected launcher leading-zero canonicalization to be quiet, got: $(cat "$launcher_stderr")"
 }
 
+test_launcher_uses_private_default_tmpdir() {
+    info "Checking launcher default TMPDIR isolation"
+    local workspace="$TMP_DIR/launcher-private-tmpdir"
+    local probe="$workspace/probe.sh"
+    local output="$workspace/output.log"
+    local runtime_dir="$workspace/runtime"
+    local state_dir="$workspace/state/codex-desktop"
+    local custom_tmp="$workspace/custom-tmp"
+
+    mkdir -p "$runtime_dir" "$state_dir" "$custom_tmp"
+    cat > "$probe" <<SCRIPT
+#!/bin/bash
+set -euo pipefail
+CODEX_LINUX_APP_ID=codex-desktop
+APP_STATE_DIR=$(printf '%q' "$state_dir")
+SCRIPT
+    awk '
+        /^configure_runtime_tmpdir\(\) \{/ { emit = 1 }
+        emit { print }
+        emit && /^}/ { exit }
+    ' "$REPO_DIR/launcher/start.sh.template" >> "$probe"
+    cat >> "$probe" <<'SCRIPT'
+configure_runtime_tmpdir
+printf '%s\n' "$TMPDIR"
+SCRIPT
+    chmod +x "$probe"
+
+    env -u TMPDIR XDG_RUNTIME_DIR="$runtime_dir" bash "$probe" > "$output"
+    [ "$(cat "$output")" = "$runtime_dir/codex-desktop/tmp" ] \
+        || fail "Expected runtime-scoped default TMPDIR, got: $(cat "$output")"
+    [ "$(stat -c '%a' "$runtime_dir/codex-desktop/tmp")" = "700" ] \
+        || fail "Expected runtime-scoped TMPDIR mode 700"
+
+    env -u TMPDIR -u XDG_RUNTIME_DIR bash "$probe" > "$output"
+    [ "$(cat "$output")" = "$state_dir/tmp" ] \
+        || fail "Expected state-scoped fallback TMPDIR, got: $(cat "$output")"
+
+    TMPDIR="$custom_tmp" XDG_RUNTIME_DIR="$runtime_dir" bash "$probe" > "$output"
+    [ "$(cat "$output")" = "$custom_tmp" ] \
+        || fail "Expected explicit TMPDIR to remain unchanged, got: $(cat "$output")"
+}
+
 test_managed_node_runtime_source_install() {
     info "Checking managed Node.js runtime source install"
     local workspace="$TMP_DIR/managed-node-runtime"
@@ -7529,6 +7571,7 @@ main() {
     test_installer_detects_electron_version_from_plist
     test_installer_keeps_electron_fallback_for_bad_metadata
     test_port_validation_rejects_oversized_numeric_values
+    test_launcher_uses_private_default_tmpdir
     test_managed_node_runtime_source_install
     test_managed_node_runtime_rejects_version_only_stub
     test_better_sqlite3_electron_42_source_patch