fix(update): avoid PATH lookup for systemd-run

src/server/management/config-routes.ts

@@ -772,7 +772,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
   }
 
   if (url.pathname === "/api/update/run" && req.method === "POST") {
-    const { normalizeUpdateChannel, startUpdateJob, UpdateJobError } = await import("../../update/job");
+    const { normalizeUpdateChannel, startUpdateJob, UpdateJobError, spawnGuiUpdateWorker } = await import("../../update/job");
     let body: { tag?: unknown; restart?: unknown };
     try { body = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid JSON body" }, 400); }
     if (body.tag !== undefined && body.tag !== "latest" && body.tag !== "preview") {
@@ -785,8 +785,17 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       const channel = normalizeUpdateChannel(body.tag as string | undefined);
       const { packageRefresh } = await import("../../update/refresh-scheduler");
       const checked = await (deps.checkPackageUpdate ?? packageRefresh.check)(channel);
+      // Resolve the systemd-scope launcher before spawning: the first request
+      // would otherwise run up to four sequential five-second probes inside
+      // spawnSync on the shared event loop.
+      const { resolveSystemdRunAsync } = await import("../../update/worker-launch");
+      const systemdRun = process.platform === "linux" && process.env.INVOCATION_ID
+        ? await resolveSystemdRunAsync()
+        : undefined;
       return jsonResponse({ ok: true, job: startUpdateJob(channel, body.restart !== false, {
         checkForUpdateFn: () => checked,
+        spawnWorkerFn: (jobId, runChannel, runRestart) =>
+          spawnGuiUpdateWorker(jobId, runChannel, runRestart, { resolveSystemdRun: () => systemdRun }),
       }) });
     } catch (err) {
       if (err instanceof UpdateJobError) {

src/update/job.ts

@@ -61,6 +61,7 @@ import {
   type NpmCachePreflightReason,
 } from "./npm-cache-preflight.mjs";
 import { guiUpdateWorkerCommand } from "./worker-launch";
+import type { WorkerLaunchContext } from "./worker-launch";
 import { withoutSiblingMarker } from "../codex/sibling-start";
 
 const RELEASE_NOTES_URL = "https://github.com/lidge-jun/opencodex/releases/latest";
@@ -568,6 +569,7 @@ export function spawnGuiUpdateWorker(
   jobId: string,
   channel: Channel,
   restart: boolean,
+  context: WorkerLaunchContext = {},
 ): UpdateWorkerProcess {
   const args = selfLaunchArgv([
     "__gui-update-worker",
@@ -576,7 +578,7 @@ export function spawnGuiUpdateWorker(
     restart ? "restart" : "no-restart",
   ]);
   if (process.platform !== "win32") {
-    const launch = guiUpdateWorkerCommand(process.execPath, args);
+    const launch = guiUpdateWorkerCommand(process.execPath, args, context);
     return spawn(launch.command, launch.argv, {
       detached: true,
       stdio: "ignore",

src/update/worker-launch.ts

@@ -1,4 +1,6 @@
-import { spawnSync } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
+import { accessSync, constants, realpathSync, statSync } from "node:fs";
+import { dirname, isAbsolute } from "node:path";
 
 /**
  * How to launch the dashboard update worker on POSIX.
@@ -16,19 +18,157 @@ export const SYSTEMD_SCOPE_ARGS = ["--user", "--scope", "--quiet", "--collect",
 export interface WorkerLaunchContext {
   platform?: NodeJS.Platform;
   env?: NodeJS.ProcessEnv;
-  hasSystemdRun?: () => boolean;
+  resolveSystemdRun?: () => string | undefined;
 }
 
-let systemdRunProbe: boolean | undefined;
+// Absolute install paths only — PATH is never consulted, so a caller-controlled entry cannot
+// redirect the launch. `/usr/local/bin` is where systemd lands when built or stowed outside the
+// distro layout, and `/run/current-system/sw/bin` is the NixOS layout, where the binary lives
+// nowhere else even though the user bus works. A candidate only counts when the binary and its
+// directory are root-owned and not group/world-writable, so a lower-trust local actor cannot
+// plant the launcher the scope probe execs.
+const TRUSTED_SYSTEMD_RUN_PATHS = [
+  "/usr/bin/systemd-run", "/bin/systemd-run", "/usr/local/bin/systemd-run",
+  "/run/current-system/sw/bin/systemd-run",
+] as const;
 
-function probeSystemdRun(): boolean {
+export interface SystemdRunHooks {
+  isExecutableFile: (path: string) => boolean;
+  probeScope: (path: string) => boolean;
+  /** Async variant of probeScope; resolveSystemdRunAsync prefers it when present. */
+  probeScopeAsync?: (path: string) => Promise<boolean>;
+}
+
+const GROUP_OR_WORLD_WRITE = 0o022;
+
+// stat (follow) rather than lstat: a root-owned symlink to a user-writable directory must fail
+// on the target's mode, not pass on the symlink's (mirrors isTrustedSystemPath in
+// src/codex/desktop-app/linux.ts).
+export interface SystemdRunTrustDeps {
+  /** Test seam: canonicalizes the candidate before its substitution chain is checked. */
+  realpathSync?: (path: string) => string;
+  /** Test seam: stats a resolved path for ownership and mode. */
+  statSync?: (path: string) => { isFile(): boolean; uid: number; mode: number };
+  /** Test seam: checks the candidate's executable bit. */
+  accessSync?: (path: string, mode: number) => void;
+}
+
+function rootOnlyWritable(path: string, stat: SystemdRunTrustDeps["statSync"] = statSync): boolean {
+  try {
+    const st = stat!(path);
+    return st.uid === 0 && (st.mode & GROUP_OR_WORLD_WRITE) === 0;
+  } catch {
+    return false;
+  }
+}
+
+// "Executable" here includes trust: the binary and its directory must be root-owned and not
+// group/world-writable. /usr/local/bin is group-writable on some systems, and a planted or
+// replaced systemd-run there would be exec'd by the scope probe under the service account;
+// the fallback is the plain detached spawn, so nothing breaks when it is skipped.
+// Exported for unit tests.
+export function isTrustedSystemdRunFile(path: string, deps: SystemdRunTrustDeps = {}): boolean {
+  try {
+    if (!isAbsolute(path)) return false;
+    (deps.accessSync ?? accessSync)(path, constants.X_OK);
+    // The lexical path may be a symlink. Checking the link's own parent only proves
+    // the *entry* is pinned; the file it resolves to — and every ancestor able to
+    // substitute that resolved file — is what the scope probe will actually exec.
+    const realpath = deps.realpathSync ?? realpathSync;
+    const resolved = realpath(path);
+    const stat = deps.statSync ?? statSync;
+    const st = stat(resolved);
+    if (!(st.isFile() && st.uid === 0 && (st.mode & GROUP_OR_WORLD_WRITE) === 0)) {
+      return false;
+    }
+    for (const start of [dirname(path), dirname(resolved)]) {
+      for (let dir = start, previous = ""; dir !== previous; previous = dir, dir = dirname(dir)) {
+        if (!rootOnlyWritable(dir, stat)) return false;
+      }
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** Scope discovery gets only user-bus identity, never inherited management credentials. */
+function scopeProbeEnvironment(): NodeJS.ProcessEnv {
+  const env: NodeJS.ProcessEnv = { PATH: "/usr/bin:/bin" };
+  for (const name of ["HOME", "USER", "LOGNAME", "XDG_RUNTIME_DIR", "DBUS_SESSION_BUS_ADDRESS"]) {
+    if (process.env[name] !== undefined) env[name] = process.env[name];
+  }
+  return env;
+}
+
+const systemdRunHooks: SystemdRunHooks = {
+  isExecutableFile: isTrustedSystemdRunFile,
+  // Run a real scope with the same absolute binary as its harmless version payload.
+  // Probing only the outer --version would not verify the user bus.
+  probeScope: path => {
+    const probe = spawnSync(path, [...SYSTEMD_SCOPE_ARGS, path, "--version"], { stdio: "ignore", timeout: 5_000, env: scopeProbeEnvironment() });
+    return !probe.error && probe.status === 0;
+  },
+  probeScopeAsync: path => new Promise<boolean>(resolve => {
+    const probe = spawn(path, [...SYSTEMD_SCOPE_ARGS, path, "--version"], { stdio: "ignore", env: scopeProbeEnvironment() });
+    probe.unref();
+    const timer = setTimeout(() => {
+      try { probe.kill("SIGKILL"); } catch { /* failed termination is not a successful probe */ }
+      resolve(false);
+    }, 5_000);
+    timer.unref();
+    probe.once("error", () => { clearTimeout(timer); resolve(false); });
+    probe.once("close", code => { clearTimeout(timer); resolve(code === 0); });
+  }),
+};
+
+let systemdRunProbe: string | null | undefined;
+let systemdRunProbePending: Promise<string | null> | undefined;
+
+export function resolveSystemdRun(hooks: SystemdRunHooks = systemdRunHooks): string | undefined {
   if (systemdRunProbe === undefined) {
-    // Run a real no-op scope rather than `--version`: a present binary without a reachable user
-    // bus would otherwise pass the probe and then fail to start the worker at all.
-    const probe = spawnSync("systemd-run", [...SYSTEMD_SCOPE_ARGS, "true"], { stdio: "ignore", timeout: 5_000 });
-    systemdRunProbe = !probe.error && probe.status === 0;
+    systemdRunProbe = null;
+    for (const command of TRUSTED_SYSTEMD_RUN_PATHS) {
+      if (!hooks.isExecutableFile(command)) continue;
+      if (hooks.probeScope(command)) {
+        systemdRunProbe = command;
+        break;
+      }
+    }
   }
-  return systemdRunProbe;
+  return systemdRunProbe ?? undefined;
+}
+
+/**
+ * Management-request path variant. The synchronous resolver blocks the shared
+ * event loop for up to four sequential five-second scope probes on first use;
+ * the dashboard update route awaits this instead, so probing overlaps other
+ * requests. Concurrent first callers share one probe pass.
+ */
+export async function resolveSystemdRunAsync(hooks: SystemdRunHooks = systemdRunHooks): Promise<string | undefined> {
+  if (systemdRunProbe !== undefined) return systemdRunProbe ?? undefined;
+  if (!systemdRunProbePending) {
+    systemdRunProbePending = (async () => {
+      const probeScope = hooks.probeScopeAsync ?? (async (path: string) => hooks.probeScope(path));
+      for (const command of TRUSTED_SYSTEMD_RUN_PATHS) {
+        if (!hooks.isExecutableFile(command)) continue;
+        if (await probeScope(command)) {
+          return command;
+        }
+      }
+      return null;
+    })();
+  }
+  const found = await systemdRunProbePending;
+  // Honor a cache the sync resolver may have filled while the probe ran — the
+  // older observation wins so every caller converges on one launcher.
+  if (systemdRunProbe === undefined) systemdRunProbe = found;
+  return systemdRunProbe ?? undefined;
+}
+
+export function resetSystemdRunProbeForTests(): void {
+  systemdRunProbe = undefined;
+  systemdRunProbePending = undefined;
 }
 
 export function guiUpdateWorkerCommand(
@@ -39,8 +179,9 @@ export function guiUpdateWorkerCommand(
   const platform = context.platform ?? process.platform;
   const env = context.env ?? process.env;
   const underSystemd = platform === "linux" && Boolean(env.INVOCATION_ID);
-  if (underSystemd && (context.hasSystemdRun ?? probeSystemdRun)()) {
-    return { command: "systemd-run", argv: [...SYSTEMD_SCOPE_ARGS, execPath, ...args] };
+  const systemdRun = underSystemd ? (context.resolveSystemdRun ?? resolveSystemdRun)() : undefined;
+  if (systemdRun) {
+    return { command: systemdRun, argv: [...SYSTEMD_SCOPE_ARGS, execPath, ...args] };
   }
   return { command: execPath, argv: [...args] };
 }

structure/ops/service-and-sidecars.md

@@ -332,4 +332,4 @@ src/update/async-check.ts uses the existing owner-bound registry target with a b
 
 The desktop badge snapshot in src/update/desktop-badge.ts is process-local display state keyed by a Tauri session id. A 60-second shell heartbeat renews receipt time; entries expire after 180 seconds and the store retains at most 32 sessions. It is separate from the package version cache and from the updater job/ownership transaction. A proxy restart reports unknown until a bound desktop shell republishes; no update installation can be authorized by this snapshot.
 
-On Linux, a dashboard update worker started from the systemd user service is launched through `systemd-run --user --scope --quiet --collect` (`src/update/worker-launch.ts`), so it leaves the service cgroup before the updater stops `opencodex-proxy.service`; the default `KillMode=control-group` otherwise kills it with the proxy (#5750). The path applies only when `INVOCATION_ID` is set and a no-op scope probe succeeds; every other case keeps the plain detached spawn. `--scope` moves `systemd-run` itself into the scope and then execs the worker, so the recorded PID is the worker's (`tests/update/update-worker-launch.test.ts`).
+On Linux, a dashboard update worker started from the systemd user service is launched through an executable regular file at a trusted absolute path — `/usr/bin/systemd-run`, `/bin/systemd-run`, `/usr/local/bin/systemd-run` (local installs), or `/run/current-system/sw/bin/systemd-run` (the NixOS layout) — with `--user --scope --quiet --collect` (`src/update/worker-launch.ts`), so it leaves the service cgroup before the updater stops `opencodex-proxy.service`; the default `KillMode=control-group` otherwise kills it with the proxy (#5750). The inherited `PATH` is never searched, and each candidate's resolved target — plus every ancestor directory able to substitute it — must be root-owned and not group/world-writable: a trusted-path symlink into a user-replaceable directory is skipped, as is a group-writable `/usr/local/bin`, rather than exec'd under the service account. Candidates are tried in order and a path whose no-op scope probe fails falls through to the next trusted path; the probe applies only when `INVOCATION_ID` is set, and every other case keeps the plain detached spawn. The management route resolves the launcher with `resolveSystemdRunAsync` before spawning, so first-request probing overlaps other work instead of blocking the event loop for up to twenty seconds. `--scope` moves `systemd-run` itself into the scope and then execs the worker, so the recorded PID is the worker's (`tests/update/update-worker-launch.test.ts`).