Sync Linux-port upstream 1d2bd26

.github/workflows/ci.yml

@@ -13,6 +13,7 @@ permissions:
 
 env:
   CARGO_TERM_COLOR: always
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
   CI_PACKAGE_VERSION: 2026.04.28.000000+ci${{ github.run_number }}
 
 jobs:

.github/workflows/official-dmg-build-app.yml

@@ -31,6 +31,7 @@ permissions:
   contents: read
 
 env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
   OFFICIAL_DMG_URL: https://persistent.oaistatic.com/codex-app-prod/Codex.dmg
   OFFICIAL_DMG_PATH: /tmp/codex-official-dmg-ci/Codex.dmg
   DMG_CACHE_SCHEMA_VERSION: v1
@@ -65,9 +66,11 @@ jobs:
 
           curl -fsSLI "$OFFICIAL_DMG_URL" > "$headers_file"
 
-          last_modified="$(awk 'tolower($0) ~ /^last-modified:/ {sub(/\r$/,""); sub(/^[^:]+: /,""); value=$0} END{print value}' "$headers_file")"
-          etag="$(awk 'tolower($0) ~ /^etag:/ {sub(/\r$/,""); sub(/^[^:]+: /,""); gsub(/"/,""); value=$0} END{print value}' "$headers_file")"
-          content_length="$(awk 'tolower($0) ~ /^content-length:/ {sub(/\r$/,""); sub(/^[^:]+: /,""); value=$0} END{print value}' "$headers_file")"
+          # Match header names case-insensitively without gawk's IGNORECASE,
+          # which is a no-op under mawk (the default awk on ubuntu runners).
+          last_modified="$(awk 'tolower($0) ~ /^last-modified:/ {sub(/\r$/,""); sub(/^[^:]+:[[:space:]]*/,""); value=$0} END{print value}' "$headers_file")"
+          etag="$(awk 'tolower($0) ~ /^etag:/ {sub(/\r$/,""); sub(/^[^:]+:[[:space:]]*/,""); gsub(/"/,""); value=$0} END{print value}' "$headers_file")"
+          content_length="$(awk 'tolower($0) ~ /^content-length:/ {sub(/\r$/,""); sub(/^[^:]+:[[:space:]]*/,""); value=$0} END{print value}' "$headers_file")"
 
           if [ -z "$last_modified" ]; then
             last_modified="unknown"
@@ -141,10 +144,16 @@ jobs:
           node scripts/ci/validate-patch-report.js patch-report.json --profile official-dmg-build
 
       - name: Upload official DMG metadata artifact
+        # The build step aborts on critical patch failures; keep uploading the
+        # patch report so the failure is diagnosable from the artifact.
+        if: always()
         uses: actions/upload-artifact@v7
         with:
           name: official-dmg-metadata
-          path: official-dmg-metadata.json
+          path: |
+            official-dmg-metadata.json
+            patch-report.json
+          if-no-files-found: ignore
 
       - name: Write build summary
         run: |
@@ -160,4 +169,5 @@ jobs:
             echo "- Tested At (UTC): \`${{ steps.local-dmg.outputs.tested_at_utc }}\`"
             echo "- Cache Hit: \`${{ steps.dmg-cache.outputs.cache-hit || 'false' }}\`"
             echo "- Build command: \`make build-app DMG=$OFFICIAL_DMG_PATH\`"
+            echo "- Patch report: \`patch-report.json\`"
           } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/update-codex-hash.yml

@@ -22,6 +22,7 @@ jobs:
       NIX_CONFIG: experimental-features = nix-command flakes
       CACHIX_CACHE_NAME: codex-app-linux
       CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 

.gitignore

@@ -1,4 +1,5 @@
 *.dmg
+*.dmg.metadata
 node_modules/
 __pycache__/
 *.py[cod]

computer-use-linux/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "codex-computer-use-linux"
-version = "0.1.2-linux-alpha2"
+version = "0.2.6-linux-alpha1"
 edition = "2021"
 
 [[bin]]
@@ -18,13 +18,13 @@ base64 = "0.22.1"
 cosmic-protocols = { git = "https://github.com/pop-os/cosmic-protocols", rev = "160b086abe03cd34a8a375d7fbe47b24308d1f38", default-features = false, features = ["client"] }
 evdev = "0.13.2"
 futures-util = "0.3.32"
-image = { version = "0.25", default-features = false, features = ["png"] }
+image = { version = "0.25", default-features = false, features = ["jpeg", "png"] }
 libc = "0.2"
 rmcp = { version = "1.6.0", features = ["transport-io"] }
 schemars = "1.0"
 serde = { version = "1.0.228", features = ["derive"] }
 serde_json = "1.0.149"
-tokio = { version = "1.52.3", features = ["macros", "rt", "time"] }
+tokio = { version = "1.52.3", features = ["macros", "process", "rt", "time"] }
 wayland-client = "0.31.11"
 wayland-protocols = { version = "0.32.9", features = ["client", "staging"] }
 xkeysym = "0.2.1"

computer-use-linux/src/bin/codex-chrome-extension-host.rs

@@ -27,6 +27,7 @@ const OBSERVED_TURN_TTL: Duration = Duration::from_secs(6 * 60 * 60);
 const ROLLOUT_SEARCH_MAX_DEPTH: usize = 5;
 
 type SharedState = Arc<Mutex<HostState>>;
+type SharedChromeWriter = Arc<Mutex<Box<dyn Write + Send>>>;
 type SharedClientWriter = Arc<Mutex<UnixStream>>;
 
 #[derive(Clone)]
@@ -64,7 +65,7 @@ impl ChromeClientRouteError {
 }
 
 struct HostState {
-    stdout: Arc<Mutex<io::Stdout>>,
+    stdout: SharedChromeWriter,
     rollout_tracker: RolloutTracker,
     extension_id: Option<String>,
     clients: HashMap<usize, Client>,
@@ -77,7 +78,7 @@ struct HostState {
 
 impl HostState {
     fn new(
-        stdout: Arc<Mutex<io::Stdout>>,
+        stdout: SharedChromeWriter,
         rollout_tracker: RolloutTracker,
         extension_id: Option<String>,
     ) -> Self {
@@ -145,7 +146,7 @@ impl HostState {
 #[derive(Clone)]
 struct RolloutTracker {
     inner: Arc<Mutex<RolloutTrackerState>>,
-    stdout: Arc<Mutex<io::Stdout>>,
+    stdout: SharedChromeWriter,
     sessions_root: Option<PathBuf>,
 }
 
@@ -162,7 +163,7 @@ struct ObservedTurn {
 }
 
 impl RolloutTracker {
-    fn new(stdout: Arc<Mutex<io::Stdout>>) -> Self {
+    fn new(stdout: SharedChromeWriter) -> Self {
         let tracker = Self {
             inner: Arc::new(Mutex::new(RolloutTrackerState {
                 observed: HashMap::new(),
@@ -310,7 +311,7 @@ fn main() -> Result<()> {
     fs::set_permissions(&socket_path, fs::Permissions::from_mode(0o600))
         .with_context(|| format!("failed to chmod {}", socket_path.display()))?;
 
-    let stdout = Arc::new(Mutex::new(io::stdout()));
+    let stdout: SharedChromeWriter = Arc::new(Mutex::new(Box::new(io::stdout())));
     let rollout_tracker = RolloutTracker::new(Arc::clone(&stdout));
     let extension_id = extension_id_from_args();
     let state = Arc::new(Mutex::new(HostState::new(
@@ -1097,6 +1098,115 @@ mod tests {
         assert_eq!(state.next_chrome_id, 1);
     }
 
+    #[test]
+    fn forwards_client_raw_cdp_call_requests_to_chrome_without_filtering() {
+        let (mut host_state, output) = test_host_state_with_output();
+        host_state.clients.insert(1, test_client());
+        let state = Arc::new(Mutex::new(host_state));
+        let request = json!({
+            "jsonrpc": "2.0",
+            "id": "client-cdp-call-1",
+            "method": "tab_cdp_call",
+            "params": {
+                "browser_id": "browser-1",
+                "tab_id": "42",
+                "method": "Runtime.evaluate",
+                "params": {
+                    "expression": "document.title",
+                    "returnByValue": true
+                },
+                "target": {
+                    "target_id": "target-1"
+                },
+                "timeout_ms": 5000
+            }
+        });
+
+        handle_client_message(&state, 1, request.clone());
+
+        let chrome_id = format!("linux-{}-1", process::id());
+        let forwarded = read_captured_message(&output);
+        assert_eq!(forwarded["id"], chrome_id);
+        assert_eq!(forwarded["method"], "tab_cdp_call");
+        assert_eq!(forwarded["params"], request["params"]);
+
+        let state = state.lock().unwrap();
+        let pending = state.pending_chrome_requests.get(&chrome_id).unwrap();
+        assert_eq!(pending.client_id, 1);
+        assert_eq!(pending.client_request_id, json!("client-cdp-call-1"));
+        assert!(!pending.fallback_extension_info);
+    }
+
+    #[test]
+    fn forwards_client_raw_cdp_event_requests_to_chrome_without_filtering() {
+        let (mut host_state, output) = test_host_state_with_output();
+        host_state.clients.insert(1, test_client());
+        let state = Arc::new(Mutex::new(host_state));
+        let request = json!({
+            "jsonrpc": "2.0",
+            "id": "client-cdp-events-1",
+            "method": "tab_cdp_events",
+            "params": {
+                "after_sequence": 7,
+                "browser_id": "browser-1",
+                "limit": 25,
+                "methods": ["Runtime.consoleAPICalled", "Target.attachedToTarget"],
+                "tab_id": "42",
+                "target": {
+                    "session_id": "session-1"
+                },
+                "timeout_ms": 500
+            }
+        });
+
+        handle_client_message(&state, 1, request.clone());
+
+        let forwarded = read_captured_message(&output);
+        assert_eq!(forwarded["id"], format!("linux-{}-1", process::id()));
+        assert_eq!(forwarded["method"], "tab_cdp_events");
+        assert_eq!(forwarded["params"], request["params"]);
+    }
+
+    #[test]
+    fn forwards_chrome_raw_cdp_responses_to_the_requesting_client() {
+        let (client_writer, mut client_reader) = UnixStream::pair().unwrap();
+        let mut state = test_host_state();
+        state.clients.insert(
+            1,
+            Client {
+                writer: Arc::new(Mutex::new(client_writer)),
+            },
+        );
+        state.pending_chrome_requests.insert(
+            "linux-1-1".to_string(),
+            PendingChromeRequest {
+                client_id: 1,
+                client_request_id: json!("client-cdp-call-1"),
+                fallback_extension_info: false,
+            },
+        );
+        let state = Arc::new(Mutex::new(state));
+
+        handle_chrome_message(
+            &state,
+            json!({
+                "jsonrpc": "2.0",
+                "id": "linux-1-1",
+                "result": {
+                    "result": {
+                        "type": "string",
+                        "value": "Codex"
+                    }
+                }
+            }),
+        );
+
+        let message = read_frame(&mut client_reader).unwrap().unwrap();
+        assert_eq!(message["id"], "client-cdp-call-1");
+        assert_eq!(message["result"]["result"]["value"], "Codex");
+        assert!(state.lock().unwrap().pending_chrome_requests.is_empty());
+    }
+
     #[test]
     fn get_info_falls_back_when_runtime_get_version_is_missing() {
         let (client_writer, mut client_reader) = UnixStream::pair().unwrap();
@@ -1194,7 +1304,7 @@ mod tests {
     }
 
     fn test_host_state() -> HostState {
-        let stdout = Arc::new(Mutex::new(io::stdout()));
+        let stdout: SharedChromeWriter = Arc::new(Mutex::new(Box::new(io::stdout())));
         HostState::new(
             Arc::clone(&stdout),
             RolloutTracker {
@@ -1208,6 +1318,46 @@ mod tests {
         )
     }
 
+    fn test_host_state_with_output() -> (HostState, Arc<Mutex<Vec<u8>>>) {
+        let output = Arc::new(Mutex::new(Vec::new()));
+        let stdout: SharedChromeWriter = Arc::new(Mutex::new(Box::new(CaptureWriter {
+            output: Arc::clone(&output),
+        })));
+        let state = HostState::new(
+            Arc::clone(&stdout),
+            RolloutTracker {
+                inner: Arc::new(Mutex::new(RolloutTrackerState {
+                    observed: HashMap::new(),
+                })),
+                stdout,
+                sessions_root: None,
+            },
+            Some("abcdefghijklmnopabcdefghijklmnop".to_string()),
+        );
+        (state, output)
+    }
+
+    fn read_captured_message(output: &Arc<Mutex<Vec<u8>>>) -> Value {
+        let data = output.lock().unwrap().clone();
+        let mut cursor = io::Cursor::new(data);
+        read_frame(&mut cursor).unwrap().unwrap()
+    }
+
+    struct CaptureWriter {
+        output: Arc<Mutex<Vec<u8>>>,
+    }
+
+    impl Write for CaptureWriter {
+        fn write(&mut self, buffer: &[u8]) -> io::Result<usize> {
+            self.output.lock().unwrap().extend_from_slice(buffer);
+            Ok(buffer.len())
+        }
+
+        fn flush(&mut self) -> io::Result<()> {
+            Ok(())
+        }
+    }
+
     fn unique_test_dir(prefix: &str) -> PathBuf {
         let nonce = SystemTime::now()
             .duration_since(UNIX_EPOCH)

computer-use-linux/src/diagnostics.rs

@@ -80,6 +80,7 @@ pub struct PlatformReport {
     pub dbus_session_bus_address: Option<String>,
     pub xdg_runtime_dir: Option<String>,
     pub gnome_shell_version: Check,
+    pub gnome_screenshot: Check,
 }
 
 #[derive(Debug, Clone, Serialize, JsonSchema)]
@@ -218,6 +219,10 @@ fn capability_map(
     if portals.screenshot.ok {
         screenshot_backends.push("portal".to_string());
     }
+    // Subprocess fallback for background/systemd contexts the DBus paths reject.
+    if platform.gnome_screenshot.ok {
+        screenshot_backends.push("gnome_screenshot".to_string());
+    }
 
     let mut window_backends = Vec::new();
     if windowing.codex_gnome_shell_extension.ok {
@@ -519,6 +524,7 @@ fn platform_report() -> PlatformReport {
         dbus_session_bus_address: dbus_session_address(),
         xdg_runtime_dir: xdg_runtime_dir().map(|path| path.display().to_string()),
         gnome_shell_version: command_check("gnome-shell", &["--version"]),
+        gnome_screenshot: command_check("gnome-screenshot", &["--version"]),
     }
 }
 
@@ -979,6 +985,7 @@ mod tests {
             dbus_session_bus_address: Some("unix:path=/run/user/1000/bus".to_string()),
             xdg_runtime_dir: Some("/run/user/1000".to_string()),
             gnome_shell_version: Check::ok("GNOME Shell 46.0"),
+            gnome_screenshot: Check::ok("gnome-screenshot 41.0"),
         }
     }