Skip to content

Fix Chrome app-server proxy inheritance on Linux #1121

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ilysenko merged 7 commits into from
Jul 23, 2026
+419 −6
Merged

Fix Chrome app-server proxy inheritance on Linux #1121

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
073abea
test: reproduce Chrome native host missing proxy environment
Jul 22, 2026
ca5793f
fix: preserve proxy environment for Chrome app-server
Jul 22, 2026
e516b9b
Fix Chrome native host proxy wrapper
ilysenko Jul 23, 2026
2c589d9
Harden Chrome proxy probe watchdog
ilysenko Jul 23, 2026
bd26e88
Secure Chrome proxy watchdog state
ilysenko Jul 23, 2026
6a8cc5a
Make Chrome proxy probes fail safely
ilysenko Jul 23, 2026
acc0e37
Cover Chrome proxy wrapper edge cases
ilysenko Jul 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
82 changes: 80 additions & 2 deletions launcher/start.sh.template
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -958,6 +958,84 @@ chrome_extension_host_arch() {
esac
}

write_chrome_native_host_launcher() {
local cache_root="$1"
local launcher_path="$cache_root/native-host"
local tmp_path="$launcher_path.tmp.$$"

if [ -x "$launcher_path" ] && \
grep -q '^CODEX_CHROME_NATIVE_HOST_LAUNCHER_V1=1$' "$launcher_path" 2>/dev/null && \
! path_has_unsafe_write "$launcher_path"; then
printf '%s\n' "$launcher_path"
return 0
fi

make_path_owner_trusted "$cache_root" || return 1
if ! (umask 0077; printf '%s\n' \
'#!/usr/bin/env bash' \
'set -euo pipefail' \
'CODEX_CHROME_NATIVE_HOST_LAUNCHER_V1=1' \
'cache_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)"' \
'while IFS="=" read -r name value; do' \
' case "$name" in' \
' HTTP_PROXY|HTTPS_PROXY|ALL_PROXY|http_proxy|https_proxy|all_proxy)' \
' if [ -z "${!name+x}" ]; then' \
' export "$name=$value"' \
' fi' \
' ;;' \
' esac' \
'done < <(systemctl --user show-environment 2>/dev/null || true)' \
'copy_proxy_pair() {' \
' local upper_name="$1" lower_name="$2"' \
' if [ -z "${!upper_name+x}" ] && [ -n "${!lower_name+x}" ]; then' \
' export "$upper_name=${!lower_name}"' \
' elif [ -z "${!lower_name+x}" ] && [ -n "${!upper_name+x}" ]; then' \
' export "$lower_name=${!upper_name}"' \
' fi' \
'}' \
'read_gnome_proxy_value() {' \
' local schema="$1" key="$2" value' \
' value="$(gsettings get "$schema" "$key" 2>/dev/null)" || return 1' \
' value="$(printf "%s" "$value" | tr -d "\047")"' \
' printf "%s\\n" "$value"' \
'}' \
'set_gnome_proxy_pair() {' \
' local upper_name="$1" lower_name="$2" schema="$3" scheme="$4"' \
' local host port value' \
' [ -z "${!upper_name+x}" ] && [ -z "${!lower_name+x}" ] || return 0' \
' host="$(read_gnome_proxy_value "$schema" host)" || return 0' \
' port="$(read_gnome_proxy_value "$schema" port)" || return 0' \
' [ -n "$host" ] || return 0' \
' case "$port" in ""|*[!0-9]*) return 0 ;; esac' \
' [ "$port" -ge 1 ] && [ "$port" -le 65535 ] || return 0' \
' value="$scheme://$host:$port"' \
' [ "$scheme" != socks5 ] || value="$value/"' \
' export "$upper_name=$value" "$lower_name=$value"' \
'}' \
'copy_proxy_pair HTTP_PROXY http_proxy' \
'copy_proxy_pair HTTPS_PROXY https_proxy' \
'copy_proxy_pair ALL_PROXY all_proxy' \
'gnome_proxy_mode="$(read_gnome_proxy_value org.gnome.system.proxy mode 2>/dev/null || true)"' \
'if [ "$gnome_proxy_mode" = manual ]; then' \
' set_gnome_proxy_pair HTTP_PROXY http_proxy org.gnome.system.proxy.http http' \
' set_gnome_proxy_pair HTTPS_PROXY https_proxy org.gnome.system.proxy.https http' \
' set_gnome_proxy_pair ALL_PROXY all_proxy org.gnome.system.proxy.socks socks5' \
'fi' \
'case "$(uname -m)" in' \
' x86_64) extension_arch=x64 ;;' \
' aarch64|arm64) extension_arch=arm64 ;;' \
' *) exit 1 ;;' \
'esac' \
'host_path="$cache_root/latest/extension-host/linux/$extension_arch/extension-host"' \
'exec "$host_path" "$@"' > "$tmp_path"); then
rm -f "$tmp_path"
return 1
fi
chmod 0755 "$tmp_path" || return 1
mv -f "$tmp_path" "$launcher_path" || return 1
printf '%s\n' "$launcher_path"
}

write_chrome_native_host_manifests() {
local host_path="$1"
local plugin_dir="$2"
Expand Down Expand Up @@ -1194,8 +1272,8 @@ sync_chrome_bundled_plugin_cache() {
mkdir -p "$marketplace_plugins_dir" "$marketplace_root/plugins"
replace_symlink "$cache_root/latest" "$marketplace_plugin_link"

host_path="$cache_root/latest/extension-host/linux/$extension_arch/extension-host"
[ -x "$host_path" ] || return 0
[ -x "$cache_root/latest/extension-host/linux/$extension_arch/extension-host" ] || return 0
host_path="$(write_chrome_native_host_launcher "$cache_root")" || return 0
write_chrome_native_host_manifests "$host_path" "$cache_root/latest" || \
echo "Chrome native host manifest sync failed; continuing with existing browser manifests."
}
Expand Down
72 changes: 70 additions & 2 deletions tests/scripts_smoke.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6359,6 +6359,13 @@ for name in (
raise SystemExit(f"missing {name}")
helpers.append(match.group(0))

native_launcher = re.search(
r"write_chrome_native_host_launcher\(\) \{[\s\S]*?\n\}\n",
launcher,
)
if native_launcher is not None:
helpers.append(native_launcher.group(0))

sync_match = re.search(
r"sync_chrome_bundled_plugin_cache\(\) \{[\s\S]*?\n\}\n\nsync_computer_use_bundled_plugin_cache\(\)",
launcher,
Expand Down Expand Up @@ -6387,7 +6394,7 @@ cache_plugin="$cache_root/26.test"
chrome_extension_host_arch() { printf '%s\n' x64; }
bundled_plugin_version() { printf '%s\n' 26.test; }
replace_symlink() { ln -sfnT "$1" "$2"; }
write_chrome_native_host_manifests() { :; }
write_chrome_native_host_manifests() { printf '%s\n' "$1" > "$root/native-host-path"; }

mkdir -p \
"$source_plugin/.codex-plugin" \
Expand All @@ -6397,7 +6404,12 @@ mkdir -p \
"$cache_plugin/extension-host/linux/x64" \
"$cache_plugin/scripts/node_modules"
printf '%s\n' '{"name":"chrome","version":"26.test"}' > "$source_plugin/.codex-plugin/plugin.json"
printf '%s\n' trusted-host > "$source_plugin/extension-host/linux/x64/extension-host"
cat > "$source_plugin/extension-host/linux/x64/extension-host" <<'HOST'
#!/usr/bin/env bash
printf '%s\n' \
"${HTTP_PROXY-}" "${HTTPS_PROXY-}" "${ALL_PROXY-}" \
"${http_proxy-}" "${https_proxy-}" "${all_proxy-}"
HOST
printf '%s\n' trusted-client > "$source_plugin/scripts/browser-client.mjs"
printf '%s\n' trusted-manifest > "$source_plugin/scripts/installManifest.mjs"
printf '%s\n' trusted-module > "$source_plugin/scripts/node_modules/classic-level.mjs"
Expand Down Expand Up @@ -6433,6 +6445,62 @@ if find "$cache_plugin" ! -type l -perm /022 -print -quit | grep -q .; then
fi
test -L "$cache_root/latest"
test "$(readlink "$cache_root/latest")" = 26.test

native_host_path="$(cat "$root/native-host-path")"
stub_bin="$root/stub-bin"
mkdir -p "$stub_bin"
cat > "$stub_bin/systemctl" <<'STUB'
#!/usr/bin/env bash
printf '%s\n' \
'HTTP_PROXY=http://127.0.0.1:7897' \
'HTTPS_PROXY=http://127.0.0.1:7897' \
'ALL_PROXY=socks5://127.0.0.1:7897/' \
'http_proxy=http://127.0.0.1:7897' \
'https_proxy=http://127.0.0.1:7897' \
'all_proxy=socks5://127.0.0.1:7897/'
STUB
cat > "$stub_bin/gsettings" <<'STUB'
#!/usr/bin/env bash
exit 1
STUB
chmod 0755 "$stub_bin/systemctl" "$stub_bin/gsettings"

proxy_output="$(env -u HTTP_PROXY -u HTTPS_PROXY -u ALL_PROXY \
-u http_proxy -u https_proxy -u all_proxy \
PATH="$stub_bin:$PATH" "$native_host_path")"
test "$proxy_output" = "$(printf '%s\n' \
'http://127.0.0.1:7897' \
'http://127.0.0.1:7897' \
'socks5://127.0.0.1:7897/' \
'http://127.0.0.1:7897' \
'http://127.0.0.1:7897' \
'socks5://127.0.0.1:7897/')"

cat > "$stub_bin/systemctl" <<'STUB'
#!/usr/bin/env bash
exit 0
STUB
cat > "$stub_bin/gsettings" <<'STUB'
#!/usr/bin/env bash
case "$2:$3" in
org.gnome.system.proxy:mode) printf "'manual'\n" ;;
org.gnome.system.proxy.http:host|org.gnome.system.proxy.https:host|org.gnome.system.proxy.socks:host) printf "'127.0.0.1'\n" ;;
org.gnome.system.proxy.http:port|org.gnome.system.proxy.https:port|org.gnome.system.proxy.socks:port) printf '7897\n' ;;
*) exit 1 ;;
esac
STUB
chmod 0755 "$stub_bin/systemctl" "$stub_bin/gsettings"

proxy_output="$(env -u HTTP_PROXY -u HTTPS_PROXY -u ALL_PROXY \
-u http_proxy -u https_proxy -u all_proxy \
PATH="$stub_bin:$PATH" "$native_host_path")"
test "$proxy_output" = "$(printf '%s\n' \
'http://127.0.0.1:7897' \
'http://127.0.0.1:7897' \
'socks5://127.0.0.1:7897/' \
'http://127.0.0.1:7897' \
'http://127.0.0.1:7897' \
'socks5://127.0.0.1:7897/')"
'''
)
PY
Expand Down