Codex IPC socket directory /tmp/codex-ipc is not per-user, blocking other users on shared hosts (EACCES)

What version of the IDE extension are you using?

openai.chatgpt 26.5602.40724 (VSCode extension, Linux x64) VSCode running through vscode-server on a shared Linux login node (HPC cluster, multi-user environment).

What subscription do you have?

3rd party

Which IDE are you using?

VS Code

What platform is your computer?

Linux 6.1.0-48-amd64 x86_64 unknown

What issue are you seeing?

The Codex extension panel fails to load. The extension host logs the following error on startup:

[IpcRouterManager] Server error
  errorCode=EACCES
  errorMessage="listen EACCES: permission denied /tmp/codex-ipc/ipc-1021.sock"
  errorName=Error
  errorStack=
    Error: listen EACCES: permission denied /tmp/codex-ipc/ipc-1021.sock
      at Server.setupListenHandle [as _listen2] (node:net:1986:21)
      at listenInCluster (node:net:2065:12)
      at Server.listen (node:net:2187:5)
      at cg.startRouterIfNeeded (.../out/extension.js:480:16899)
      at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
      at async pl.connect (.../out/extension.js:480:18911)

Inspecting /tmp/codex-ipc/ shows the directory is owned by a different user who used Codex on the same shared host earlier:

$ ls -la /tmp/codex-ipc/
drwxr-xr-x  2 otheruser otheruser   60 Jun  6 13:02 .
drwxrwxrwt 70 root      root      1560 Jun  6 16:51 ..
srwxr-xr-x  1 otheruser otheruser    0 Jun  6 13:02 ipc-1046.sock

My UID cannot write into a directory owned by otheruser (mode 0755), so net.Server.listen() on /tmp/codex-ipc/ipc-<myuid>.sock fails with EACCES. The IPC router never starts and the extension panel cannot connect.

What steps can reproduce the bug?

1. On a shared Linux host, have User A open VSCode (with vscode-server) and use the Codex extension. This creates /tmp/codex-ipc/ owned by User A with mode 0755, and a socket file ipc-<A_UID>.sock inside it.
2. User A disconnects, but the directory remains in /tmp (it is not cleaned up on exit).
3. User B connects to the same host with their own vscode-server session and opens the Codex extension.

The extension tries to create /tmp/codex-ipc/ipc-<B_UID>.sock and fails with EACCES.

The socket filename is namespaced by UID (ipc-${uid}.sock), but the parent directory (codex-ipc) is not. Whichever user creates it first owns it, and mkdirSync does not adjust permissions or fall back when the existing directory is unwritable. So on any multi-user host where os.tmpdir() resolves to a shared /tmp, only one user at a time can use the extension until the directory is manually removed.

What is the expected behavior?

_No response_

Additional information

_No response_