Codex app-server leaks unified-computer-use node helper processes, exhausting per-user io_uring budget

Environment

• Arch Linux, kernel 7.2.3
• ChatGPT desktop (chatgpt-desktop 26.901.51231-1)
• Codex app-server launched by the desktop app: /usr/lib/chatgpt/resources/codex app-server
• Plugin: openai-bundled/unified-computer-use 26.901.51231

What happens
Every Codex session spawns a pair of node processes under the app-server:
/usr/lib/chatgpt/resources/cua_node/bin/node ./server.mjs
/usr/lib/chatgpt/resources/cua_node/bin/node ~/.codex/plugins/cache/openai-bundled/unified-computer-use/26.901.51231/script
They are never terminated when the session ends. After two days I had 116 of them, all children of the single codex app-server pid, oldest from 48 hours earlier.

Why it matters
Each helper holds three io_uring instances (node/libuv). io_uring ring memory is accounted against the per-user RLIMIT_MEMLOCK budget (8 MiB default). With ~350 rings held, io_uring_setup() returns ENOMEM for every process running as my user. First visible symptom was Ghostty: new tabs and windows opened blank because its per-surface event loops could not create rings. Any other io_uring user would fail the same way.

Repro

1. Open the ChatGPT desktop app on Linux, run several Codex sessions that use computer use.
2. ps -eo pid,ppid,etimes,args | grep cua_node
   Count grows by two per session and never shrinks.
3. Once enough accumulate, a trivial io_uring_setup(256, ...) from any process fails with ENOMEM.

Expected
Helper processes exit when their session ends, or the app-server reaps them on idle.

Workaround
kill the stale helpers by hand, or raise DefaultLimitMEMLOCK for the user session.

Start at the Codex app-server process-management entry point and the unified-computer-use session lifecycle; the report does not name repository files or tests. Reproduce with several computer-use sessions and inspect whether the two cua_node children are reaped when sessions end. Done means helpers terminate or are reaped on idle and repeated sessions no longer exhaust per-user io_uring resources.