Isolate nested IPC sockets and define session ownership policy

portal/src/bridge.rs

@@ -24,10 +24,7 @@ struct BridgeInner {
 
 impl Bridge {
     pub(crate) fn connect() -> Result<Self, String> {
-        let path = std::env::var_os("XDG_RUNTIME_DIR")
-            .map(std::path::PathBuf::from)
-            .ok_or("Missing runtime directory")?
-            .join("ferese/control.sock");
+        let path = ferese_ipc::socket::resolve(None).map_err(|error| error.to_string())?;
         let stream = UnixStream::connect(path).map_err(|error| error.to_string())?;
         Self::from_stream(stream, Duration::from_secs(2))
     }

portal/src/desktop.rs

@@ -236,10 +236,7 @@ pub(crate) async fn ipc(command: &'static str, args: serde_json::Value) -> Resul
 }
 
 pub(crate) fn ipc_sync(command: &'static str, args: serde_json::Value) -> Result<serde_json::Value, String> {
-    let path = std::env::var_os("XDG_RUNTIME_DIR")
-        .map(PathBuf::from)
-        .ok_or("Missing runtime directory")?
-        .join("ferese/control.sock");
+    let path = ferese_ipc::socket::resolve(None).map_err(|error| error.to_string())?;
     let mut stream = UnixStream::connect(path).map_err(|error| error.to_string())?;
     stream
         .set_read_timeout(Some(Duration::from_secs(15)))