Buckets:
| #!/usr/bin/env python3 | |
| """Run a command in this bundle's unprivileged, authenticated X11 desktop. | |
| Example: python3 run.py -- /absolute/path/to/node_repl | |
| Only the command inherits stdout/stdin; desktop diagnostics go to logs/. | |
| No OS package installation or elevated privilege is used at startup. | |
| """ | |
| import argparse | |
| import datetime | |
| import os | |
| from pathlib import Path | |
| import secrets | |
| import select | |
| import signal | |
| import stat | |
| import struct | |
| import subprocess | |
| import sys | |
| import tempfile | |
| import time | |
| ROOT = Path(__file__).resolve().parent | |
| def ensure_executables(): | |
| # This host preserves /data/home contents but may drop executable mode | |
| # bits when a task environment is refreshed. Repair only the exact owned | |
| # programs used by this bundle, never arbitrary files or system paths. | |
| expected = [ROOT / 'usr/bin' / name for name in ( | |
| 'Xvfb', 'xkbcomp', 'xdpyinfo', 'xprop', 'openbox', 'xterm', | |
| 'xdotool', 'xauth', 'xwininfo', 'fc-match', 'fc-cache', 'mkfontscale')] | |
| expected += [ROOT / 'start-terminal.py'] | |
| for path in expected: | |
| if os.access(path, os.X_OK): | |
| continue | |
| resolved = path.resolve(strict=True) | |
| info = resolved.stat() | |
| if (not resolved.is_relative_to(ROOT) or not stat.S_ISREG(info.st_mode) | |
| or info.st_uid != os.getuid()): | |
| raise RuntimeError('cannot repair unowned desktop executable: ' + str(path)) | |
| resolved.chmod(stat.S_IMODE(info.st_mode) | stat.S_IXUSR) | |
| def environment(): | |
| """Return process-local paths for the bundled Debian desktop libraries.""" | |
| ensure_executables() | |
| env = os.environ.copy() | |
| libraries = [ROOT / p for p in ( | |
| 'usr/lib/x86_64-linux-gnu', 'lib/x86_64-linux-gnu', 'usr/lib')] | |
| env['LD_LIBRARY_PATH'] = ':'.join(map(str, libraries)) + ( | |
| ':' + env['LD_LIBRARY_PATH'] if env.get('LD_LIBRARY_PATH') else '') | |
| env['PATH'] = str(ROOT / 'usr/bin') + ':' + env.get('PATH', '/usr/bin:/bin') | |
| env['FONTCONFIG_FILE'] = str(ROOT / 'config/fonts.conf') | |
| env['FONTCONFIG_PATH'] = str(ROOT / 'config') | |
| env['XDG_DATA_DIRS'] = str(ROOT / 'usr/share') + ':' + env.get( | |
| 'XDG_DATA_DIRS', '/usr/local/share:/usr/share') | |
| env['XDG_CONFIG_DIRS'] = str(ROOT / 'etc/xdg') + ':' + env.get( | |
| 'XDG_CONFIG_DIRS', '/etc/xdg') | |
| env['XAPPLRESDIR'] = str(ROOT / 'etc/X11/app-defaults') | |
| env['XLOCALEDIR'] = str(ROOT / 'usr/share/X11/locale') | |
| env['XKB_CONFIG_ROOT'] = str(ROOT / 'usr/share/X11/xkb') | |
| env['LIBGL_DRIVERS_PATH'] = str(ROOT / 'usr/lib/x86_64-linux-gnu/dri') | |
| return env | |
| def write_authority(path, display_number, cookie): | |
| # FamilyWild avoids hostname assumptions. The cookie is loaded by Xvfb | |
| # before the listening socket opens; the display field is then updated | |
| # for Xlib clients after Xvfb tells us the number it selected. | |
| fields = [b'', str(display_number).encode(), b'MIT-MAGIC-COOKIE-1', cookie] | |
| data = struct.pack('!H', 65535) | |
| data += b''.join(struct.pack('!H', len(item)) + item for item in fields) | |
| fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600) | |
| with os.fdopen(fd, 'wb') as file: | |
| file.write(data) | |
| def stop(child): | |
| if child.poll() is None: | |
| try: | |
| os.killpg(child.pid, signal.SIGTERM) | |
| child.wait(timeout=3) | |
| except subprocess.TimeoutExpired: | |
| os.killpg(child.pid, signal.SIGKILL) | |
| child.wait() | |
| except ProcessLookupError: | |
| pass | |
| def main(): | |
| parser = argparse.ArgumentParser(description=__doc__) | |
| parser.add_argument('--no-terminal', action='store_true', | |
| help='Start Xvfb and Openbox without the default xterm.') | |
| parser.add_argument('command', nargs=argparse.REMAINDER) | |
| args = parser.parse_args() | |
| command = args.command | |
| if command[:1] == ['--']: | |
| command = command[1:] | |
| if not command: | |
| parser.error('supply the command to run after --') | |
| if os.getuid() == 0: | |
| parser.error('this desktop is intended to run as the current unprivileged user') | |
| children = [] | |
| log_dir = ROOT / 'logs' | |
| log_dir.mkdir(exist_ok=True) | |
| stamp = datetime.datetime.now(datetime.timezone.utc).strftime('%Y%m%dT%H%M%SZ') | |
| log_path = log_dir / f'{stamp}-{os.getpid()}.log' | |
| env = environment() | |
| def interrupted(signum, frame): | |
| raise SystemExit(128 + signum) | |
| for sig in (signal.SIGINT, signal.SIGTERM, signal.SIGHUP): | |
| signal.signal(sig, interrupted) | |
| try: | |
| with tempfile.TemporaryDirectory(prefix='codex-cua-') as temp: | |
| env['XAUTHORITY'] = str(Path(temp) / 'Xauthority') | |
| cookie = secrets.token_bytes(16) | |
| write_authority(env['XAUTHORITY'], 0, cookie) | |
| with log_path.open('a') as log: | |
| display_read, display_write = os.pipe() | |
| xvfb_env = env.copy() | |
| xvfb_env['CUA_XKB_BINDIR'] = str(ROOT / 'usr/bin') | |
| xvfb_env['LD_PRELOAD'] = str(ROOT / 'xvfb_xkbdir.so') | |
| try: | |
| xvfb = subprocess.Popen([ | |
| str(ROOT / 'usr/bin/Xvfb'), | |
| '-displayfd', str(display_write), | |
| '-screen', '0', '1280x800x24', '-nolisten', 'tcp', | |
| '-extension', 'GLX', | |
| '-auth', env['XAUTHORITY'], | |
| '-xkbdir', str(ROOT / 'usr/share/X11/xkb'), | |
| '-fp', str(ROOT / 'usr/share/fonts/X11/misc'), | |
| '-noreset', | |
| ], env=xvfb_env, stdin=subprocess.DEVNULL, | |
| stdout=log, stderr=log, pass_fds=(display_write,), | |
| start_new_session=True) | |
| children.append(xvfb) | |
| finally: | |
| os.close(display_write) | |
| try: | |
| ready, _, _ = select.select([display_read], [], [], 30) | |
| number = os.read(display_read, 32).decode().strip() if ready else '' | |
| finally: | |
| os.close(display_read) | |
| if not number.isdigit(): | |
| raise RuntimeError('Xvfb did not start; inspect ' + str(log_path)) | |
| env['DISPLAY'] = ':' + number | |
| write_authority(env['XAUTHORITY'], number, cookie) | |
| subprocess.run([str(ROOT / 'usr/bin/xdpyinfo')], env=env, | |
| stdout=log, stderr=log, check=True, timeout=15) | |
| wm = subprocess.Popen([ | |
| str(ROOT / 'usr/bin/openbox'), '--sm-disable', | |
| '--config-file', str(ROOT / 'config/rc.xml'), | |
| ], env=env, stdin=subprocess.DEVNULL, stdout=log, stderr=log, | |
| start_new_session=True) | |
| children.append(wm) | |
| deadline = time.monotonic() + 15 | |
| while time.monotonic() < deadline: | |
| if wm.poll() is not None: | |
| raise RuntimeError('Openbox stopped; inspect ' + str(log_path)) | |
| result = subprocess.run([ | |
| str(ROOT / 'usr/bin/xprop'), '-root', '_NET_SUPPORTING_WM_CHECK', | |
| ], env=env, capture_output=True, text=True, timeout=5) | |
| if 'window id #' in result.stdout: | |
| break | |
| time.sleep(0.1) | |
| else: | |
| raise RuntimeError('Openbox did not become ready; inspect ' + str(log_path)) | |
| if not args.no_terminal: | |
| term_env = dict(env, PS1='codex-desktop$ ', HISTFILE='/dev/null') | |
| terminal = subprocess.Popen([ | |
| str(ROOT / 'usr/bin/xterm'), '-T', 'Codex Computer Use', | |
| '-geometry', '106x32+40+40', '-u8', | |
| '-fa', 'DejaVu Sans Mono', '-fs', '12', | |
| '-xrm', 'XTerm*VT100.translations: #override Ctrl<Key>V: insert-selection(CLIPBOARD)', | |
| '-e', '/bin/bash', '--noprofile', '--norc', | |
| ], env=term_env, stdin=subprocess.DEVNULL, stdout=log, stderr=log, | |
| start_new_session=True) | |
| children.append(terminal) | |
| deadline = time.monotonic() + 15 | |
| while time.monotonic() < deadline: | |
| if terminal.poll() is not None: | |
| raise RuntimeError('xterm stopped; inspect ' + str(log_path)) | |
| result = subprocess.run([ | |
| str(ROOT / 'usr/bin/xdotool'), 'search', '--onlyvisible', | |
| '--name', '^Codex Computer Use$', | |
| ], env=env, capture_output=True, text=True, timeout=5) | |
| if result.returncode == 0 and result.stdout.strip(): | |
| break | |
| time.sleep(0.1) | |
| else: | |
| raise RuntimeError('xterm did not become ready; inspect ' + str(log_path)) | |
| # The MCP command retains its protocol streams verbatim. | |
| child = subprocess.Popen(command, env=env, start_new_session=True) | |
| children.append(child) | |
| return child.wait() | |
| except (OSError, RuntimeError, subprocess.SubprocessError) as error: | |
| print('computer-use desktop: ' + str(error), file=sys.stderr) | |
| return 1 | |
| finally: | |
| for child in reversed(children): | |
| stop(child) | |
| if __name__ == '__main__': | |
| raise SystemExit(main()) | |
Xet Storage Details
- Size:
- 9.58 kB
- Xet hash:
- be00d51d2ed024404738c89dd87240febd3696b3128411310cde5aecd1a10d0c
·
Xet efficiently stores files, intelligently splitting them into unique chunks and accelerating uploads and downloads. More info.