fix(terminal): strip AppImage runtime env from spawned terminals#3108
Conversation
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
ApprovabilityVerdict: Approved Self-contained bug fix that strips AppImage runtime environment variables from spawned terminals to prevent tools from resolving against AppImage mounts. The change is defensively gated (only activates in AppImage context), well-documented, and includes comprehensive test coverage. You can customize Macroscope's approvability policy. Learn more. |
On Linux AppImage builds the runtime injects APPIMAGE/APPDIR/ARGV0/OWD and prepends its temporary mount onto PATH/LD_LIBRARY_PATH. The backend inherits this from Electron and the integrated terminal inherits it from the backend, so tools inside the PTY resolve against the AppImage mount instead of the user's real environment (e.g. php reporting PHP_BINARY as the AppImage path). Scrub the AppImage runtime markers and drop only the mount segments from PATH/LD_LIBRARY_PATH in createTerminalSpawnEnv, gated on an actual AppImage launch so other environments are untouched. Fixes pingdotgg#1699
4920951 to
9c48faf
Compare
Co-authored-by: codex <codex@users.noreply.github.com>
* [codex] Expand real-route app store screenshot harness (pingdotgg#4014) Co-authored-by: codex <codex@users.noreply.github.com> * fix(server): use CLAUDE_CONFIG_DIR instead of HOME for Claude instanc… (pingdotgg#4017) Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * feat: show nightly update changelog tooltip (pingdotgg#3832) Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * fix(git): treat selected commit paths literally (pingdotgg#3998) * fix(server): stabilize non-repository Git diagnostics (pingdotgg#4077) * Refresh app icons across release variants (pingdotgg#4080) Co-authored-by: codex <codex@users.noreply.github.com> * Update marketing GitHub star count (pingdotgg#4088) * fix(marketing): correct Cursor icon color (pingdotgg#4090) * Normalize protocol-relative remote host input as https (pingdotgg#3971) * fix(cursor): default binary path to cursor-agent (avoid path conflict w/ grok) (pingdotgg#4094) * Fix documented task-runner commands (bun run -> vp) (pingdotgg#3965) Co-authored-by: Julius Marminge <julius0216@outlook.com> * Allow preview panel to grow on wide displays (pingdotgg#4044) * fix: prevent initial right-click from selecting a context menu item (pingdotgg#3877) * Fix duplicate keybinding rule when replacing with an existing rule (pingdotgg#3969) Co-authored-by: Julius Marminge <julius0216@outlook.com> * fix(server): image upload crashed dispatchCommand with a stack overflow (pingdotgg#3952) Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Julius Marminge <julius0216@outlook.com> * Remove unused code parameter from describePreviewError (pingdotgg#3970) Co-authored-by: Julius Marminge <julius0216@outlook.com> Co-authored-by: Julius Marminge <jmarminge@gmail.com> * [codex] prevent ACP assistant ID collisions after restarts (pingdotgg#3932) Co-authored-by: Julius Marminge <julius0216@outlook.com> * fix(web): inset Windows desktop scrollbars from resize edge (pingdotgg#4097) Co-authored-by: Julius Marminge <julius0216@outlook.com> Co-authored-by: Julius Marminge <jmarminge@gmail.com> * [codex] fix mobile composer Enter behavior (pingdotgg#3930) Co-authored-by: Julius Marminge <julius0216@outlook.com> Co-authored-by: codex <codex@users.noreply.github.com> * feat(server): include runtime model and effort in Codex developer instructions (pingdotgg#3948) Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Julius Marminge <julius0216@outlook.com> * fix(ux): spamming cmd + , no longer stack opening settings (pingdotgg#2757) Co-authored-by: Julius Marminge <julius0216@outlook.com> * fix(terminal): strip AppImage runtime env from spawned terminals (pingdotgg#3108) Co-authored-by: Julius Marminge <julius0216@outlook.com> Co-authored-by: codex <codex@users.noreply.github.com> * fix(server): thread cwd through Claude capability probe (pingdotgg#2048) (pingdotgg#2124) Co-authored-by: Julius Marminge <julius0216@outlook.com> * [codex] fix: guard invalid web timestamps (pingdotgg#3515) Co-authored-by: Codex <codex@openai.com> Co-authored-by: Julius Marminge <julius0216@outlook.com> * [codex] fix: tolerate invalid latest user message timestamps (pingdotgg#3521) Co-authored-by: Codex <codex@openai.com> Co-authored-by: Julius Marminge <julius0216@outlook.com> * [codex] Fix provider update checks restore defaults (pingdotgg#3531) Co-authored-by: Codex <codex@openai.com> Co-authored-by: Julius Marminge <julius0216@outlook.com> * fix(server): skip undecodable provider runtime rows when listing sessions (pingdotgg#3951) Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Julius Marminge <julius0216@outlook.com> Co-authored-by: Julius Marminge <jmarminge@gmail.com> Co-authored-by: codex <codex@users.noreply.github.com> * Share MCP OAuth locks across Codex shadow homes (pingdotgg#4104) * Preserve T3 Code identity in macOS development launcher (pingdotgg#4102) * fix(web): increase contrast of question option descriptions (pingdotgg#3867) Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Julius Marminge <julius0216@outlook.com> * fix(sync): reconcile fork divergences after upstream cherry-picks Post-cherry-pick fixups for the 20260718 upstream sync: - ElectronUpdater: restore setAllowDowngrade key dropped during pingdotgg#3832 conflict resolution - AcpSessionRuntime: thread assistantItemRuntimeId through the fork's session/load replay path (observeSessionLoadAssistantSegments + ensureActiveAssistantSegmentState) to match upstream pingdotgg#3932's collision-safe assistant item id scheme - Update fork tests asserting the old assistant item id format to the runtime-scoped format (AcpJsonRpcConnection, CursorAdapter) - GitVcsDriverCore test: expect the fork's for-each-ref listRefs command under pingdotgg#4077's stable-diagnostics assertion - showcasePendingTasks test: add fork-required dataAudience to EnvironmentProject fixtures Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * style: format GitVcsDriverCore.test.ts (vp check --fix) * fix(sync): coerce optional itemId to string in CursorAdapter.test asserts * style: format CursorAdapter.test.ts --------- Co-authored-by: Julius Marminge <julius0216@outlook.com> Co-authored-by: codex <codex@users.noreply.github.com> Co-authored-by: Dimitar Stoykov <mitkostoikov1988@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: Hugo Vizcaino Santana <42343504+HugoVizcainoSantana@users.noreply.github.com> Co-authored-by: Eric Tsai <52527831+EricTsai83@users.noreply.github.com> Co-authored-by: Manuel De Ceglie <80224270+AmoonPod@users.noreply.github.com> Co-authored-by: Kriday Dave <technocratix902@gmail.com> Co-authored-by: BunnyGamezsc <146652788+BunnyGamezsc@users.noreply.github.com> Co-authored-by: Olivier Melcher <olivier.melcher@gmail.com> Co-authored-by: Fazal Kadivar <fazalkadivar7@gmail.com> Co-authored-by: Theo Browne <me@t3.gg> Co-authored-by: Julius Marminge <jmarminge@gmail.com> Co-authored-by: Maxwell Young <maxtheyoung@gmail.com> Co-authored-by: Yukun Shan <92423096+nateEc@users.noreply.github.com> Co-authored-by: James <105842516+jamesx0416@users.noreply.github.com> Co-authored-by: Leonel Rivas <herial_vi@icloud.com> Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com> Co-authored-by: Wout Stiens <71498452+StiensWout@users.noreply.github.com> Co-authored-by: Codex <codex@openai.com> Co-authored-by: xxashxx-svg <xxanshxx9@gmail.com> Co-authored-by: wizzoapp[bot] <254688279+wizzoapp[bot]@users.noreply.github.com> Co-authored-by: Wizzo Bot <wizzoapp@users.noreply.github.com>
* Use client-side fallbacks for missing project favicons (pingdotgg#3959) * Skip stale working-task notifications (pingdotgg#3961) * Prepare Android beta branding and review diff UI (pingdotgg#3967) * perf(web): duty-cycle status animations and remove fixed noise overlay (pingdotgg#3978) * fix(docs): correct CI task-runner commands in ci.md (pingdotgg#3990) * fix(docs): repair broken source links in architecture overview (pingdotgg#3991) * fix(docs): replace stale codething-mvp absolute paths with repo-relative links (pingdotgg#3992) * docs: Add T3 Code Legal Docs (pingdotgg#3972) Co-authored-by: codex <codex@users.noreply.github.com> * Fix Legal modal header crash (pingdotgg#4000) Co-authored-by: codex <codex@users.noreply.github.com> * [codex] Fix onboarding connection status (pingdotgg#4001) Co-authored-by: codex <codex@users.noreply.github.com> * Isolate native diff highlight grammar state (pingdotgg#4029) * Fix macOS fullscreen titlebar spacing (pingdotgg#4019) * Prevent duplicate project workspace roots (pingdotgg#3829) Co-authored-by: codex <codex@users.noreply.github.com> * Normalize over-indented markdown list items (pingdotgg#4020) Co-authored-by: codex <codex@users.noreply.github.com> * Resolve localhost preview URLs for remote environments (pingdotgg#4011) Co-authored-by: codex <codex@users.noreply.github.com> * fix(mobile): Send composer images in upload wire format (pingdotgg#4035) * Fix iOS terminal Enter input encoding (pingdotgg#4043) * Add native mobile share target support (pingdotgg#4021) Co-authored-by: codex <codex@users.noreply.github.com> * [codex] Expand real-route app store screenshot harness (pingdotgg#4014) Co-authored-by: codex <codex@users.noreply.github.com> * fix(server): use CLAUDE_CONFIG_DIR instead of HOME for Claude instanc… (pingdotgg#4017) Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * Fix dropped events during initial thread snapshot (pingdotgg#4079) * feat: show nightly update changelog tooltip (pingdotgg#3832) Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * fix(git): treat selected commit paths literally (pingdotgg#3998) * fix(server): stabilize non-repository Git diagnostics (pingdotgg#4077) * Refresh app icons across release variants (pingdotgg#4080) Co-authored-by: codex <codex@users.noreply.github.com> * Update marketing GitHub star count (pingdotgg#4088) * fix(marketing): correct Cursor icon color (pingdotgg#4090) * Normalize protocol-relative remote host input as https (pingdotgg#3971) * fix(cursor): default binary path to cursor-agent (avoid path conflict w/ grok) (pingdotgg#4094) * Fix documented task-runner commands (bun run -> vp) (pingdotgg#3965) Co-authored-by: Julius Marminge <julius0216@outlook.com> * Allow preview panel to grow on wide displays (pingdotgg#4044) * fix: prevent initial right-click from selecting a context menu item (pingdotgg#3877) * Fix duplicate keybinding rule when replacing with an existing rule (pingdotgg#3969) Co-authored-by: Julius Marminge <julius0216@outlook.com> * fix(server): image upload crashed dispatchCommand with a stack overflow (pingdotgg#3952) Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Julius Marminge <julius0216@outlook.com> * Remove unused code parameter from describePreviewError (pingdotgg#3970) Co-authored-by: Julius Marminge <julius0216@outlook.com> Co-authored-by: Julius Marminge <jmarminge@gmail.com> * [codex] prevent ACP assistant ID collisions after restarts (pingdotgg#3932) Co-authored-by: Julius Marminge <julius0216@outlook.com> * fix(web): inset Windows desktop scrollbars from resize edge (pingdotgg#4097) Co-authored-by: Julius Marminge <julius0216@outlook.com> Co-authored-by: Julius Marminge <jmarminge@gmail.com> * [codex] fix mobile composer Enter behavior (pingdotgg#3930) Co-authored-by: Julius Marminge <julius0216@outlook.com> Co-authored-by: codex <codex@users.noreply.github.com> * feat(server): include runtime model and effort in Codex developer instructions (pingdotgg#3948) Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Julius Marminge <julius0216@outlook.com> * fix(ux): spamming cmd + , no longer stack opening settings (pingdotgg#2757) Co-authored-by: Julius Marminge <julius0216@outlook.com> * fix(terminal): strip AppImage runtime env from spawned terminals (pingdotgg#3108) Co-authored-by: Julius Marminge <julius0216@outlook.com> Co-authored-by: codex <codex@users.noreply.github.com> * fix(server): thread cwd through Claude capability probe (pingdotgg#2048) (pingdotgg#2124) Co-authored-by: Julius Marminge <julius0216@outlook.com> * [codex] fix: guard invalid web timestamps (pingdotgg#3515) Co-authored-by: Codex <codex@openai.com> Co-authored-by: Julius Marminge <julius0216@outlook.com> * [codex] fix: tolerate invalid latest user message timestamps (pingdotgg#3521) Co-authored-by: Codex <codex@openai.com> Co-authored-by: Julius Marminge <julius0216@outlook.com> * [codex] Fix provider update checks restore defaults (pingdotgg#3531) Co-authored-by: Codex <codex@openai.com> Co-authored-by: Julius Marminge <julius0216@outlook.com> * fix(server): skip undecodable provider runtime rows when listing sessions (pingdotgg#3951) Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Julius Marminge <julius0216@outlook.com> Co-authored-by: Julius Marminge <jmarminge@gmail.com> Co-authored-by: codex <codex@users.noreply.github.com> * Share MCP OAuth locks across Codex shadow homes (pingdotgg#4104) * Preserve T3 Code identity in macOS development launcher (pingdotgg#4102) * fix(web): increase contrast of question option descriptions (pingdotgg#3867) Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Julius Marminge <julius0216@outlook.com> --------- Co-authored-by: Julius Marminge <julius0216@outlook.com> Co-authored-by: Theo Browne <me@t3.gg> Co-authored-by: Kriday Dave <technocratix902@gmail.com> Co-authored-by: codex <codex@users.noreply.github.com> Co-authored-by: Ishan <ishansachu1@gmail.com> Co-authored-by: Dimitar Stoykov <mitkostoikov1988@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: Hugo Vizcaino Santana <42343504+HugoVizcainoSantana@users.noreply.github.com> Co-authored-by: Eric Tsai <52527831+EricTsai83@users.noreply.github.com> Co-authored-by: Manuel De Ceglie <80224270+AmoonPod@users.noreply.github.com> Co-authored-by: BunnyGamezsc <146652788+BunnyGamezsc@users.noreply.github.com> Co-authored-by: Olivier Melcher <olivier.melcher@gmail.com> Co-authored-by: Fazal Kadivar <fazalkadivar7@gmail.com> Co-authored-by: Julius Marminge <jmarminge@gmail.com> Co-authored-by: Maxwell Young <maxtheyoung@gmail.com> Co-authored-by: Yukun Shan <92423096+nateEc@users.noreply.github.com> Co-authored-by: James <105842516+jamesx0416@users.noreply.github.com> Co-authored-by: Leonel Rivas <herial_vi@icloud.com> Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com> Co-authored-by: Wout Stiens <71498452+StiensWout@users.noreply.github.com> Co-authored-by: Codex <codex@openai.com> Co-authored-by: xxashxx-svg <xxanshxx9@gmail.com>
If you build T3 Code as a Linux AppImage and open the integrated terminal, the terminal ends up carrying the AppImage's own environment around. AppImage mounts the app under a temp dir like /tmp/.mount_T3-XXXX and sets APPIMAGE, APPDIR, ARGV0 and OWD, and it also prepends that mount onto PATH and LD_LIBRARY_PATH. Electron inherits all of that, the backend inherits it from Electron, and the terminal inherits it from the backend, so it leaks the whole way down into your shell.
The tricky part is that everything looks fine until something actually reads those variables. The case from the issue:
type phpreports /usr/bin/php like you'd expect, butphp -r 'echo PHP_BINARY;'prints the AppImage path instead, and PATH still has the /tmp/.mount_T3-... entries in it. Anything that trusts ARGV0 or those paths gets the wrong answer.So when we build the environment for a terminal session I strip the AppImage bits back out: drop the APPIMAGE/APPDIR/ARGV0/OWD markers, and remove just the mount segments from PATH and LD_LIBRARY_PATH while leaving the user's real entries alone. It only runs when we're actually launched from an AppImage, so a normal install isn't touched and someone's own LD_LIBRARY_PATH is never stripped.
I kept this in createTerminalSpawnEnv, right next to the env blocklist that's already there, since that's the one place the terminal environment gets curated. I scoped it to the terminal on purpose rather than scrubbing higher up, since that's what the issue is about and touching the shared backend env would also affect the agent CLIs.
Two tests come with it: one feeds in a fake AppImage environment and checks the markers and mount paths are gone while unrelated vars survive, and one checks that without an AppImage nothing changes at all.
Fixes #1699
Note
Low Risk
Change is limited to terminal PTY spawn env curation behind AppImage detection, with unit tests; server-wide env and non-AppImage sessions are unaffected.
Overview
Fixes integrated terminals on Linux AppImage builds inheriting the AppImage mount environment (
APPIMAGE,APPDIR,ARGV0,OWD, and mount segments onPATH/LD_LIBRARY_PATH), which could make tools resolve against the temporary mount instead of the user's real install.createTerminalSpawnEnvnow runsstripAppImageRuntimeEnvafter the existing blocklist: marker vars are dropped, path-like vars keep only segments outsideAPPDIR, and the scrub runs only whenAPPIMAGEorAPPDIRis present so normal installs (including a standaloneOWD) are unchanged.Tests cover a fake AppImage env and a non-AppImage case.
Reviewed by Cursor Bugbot for commit 95d7c70. Bugbot is set up for automated code reviews on this repo. Configure here.
Note
Strip AppImage runtime env variables from spawned terminals
stripAppImageRuntimeEnvin Manager.ts that removesAPPIMAGE,APPDIR,ARGV0, andOWDfrom the terminal spawn environment when the process was launched from an AppImage.PATHandLD_LIBRARY_PATHto remove any segments equal to or nested under the AppImage mount dir (APPDIR), deleting the variable entirely if no segments remain.createTerminalSpawnEnvnow pipes its output throughstripAppImageRuntimeEnvbefore returning; environments withoutAPPIMAGEorAPPDIRare passed through unchanged.Macroscope summarized 95d7c70.