fix(desktop): unbreak OAuth in Linux AppImage by de-polluting child env (#49)

* fix(desktop): unbreak OAuth in Linux AppImage by de-polluting child env

GitHub & Azure OAuth (and all forge HTTP traffic) shell out to the system
`curl` via `hidden_cmd`. In the released Linux AppImage, AppRun rewrites
`LD_LIBRARY_PATH` (and friends) to the bundle's libs; the spawned `curl`
inherits them, loads ABI-incompatible bundled libssl/libcurl, and dies at
TLS init. With `-s` and an unread stderr, that produced an empty body which
reached serde_json as the cryptic "Failed to parse device-code response:
EOF while parsing a value at line 1 column 0" (issue #48). It worked under
`tauri dev` because no AppImage wrapper polluted the env.

- `appimage_env_fixes()` (pure, injected env lookup): inside an AppImage
  (APPDIR/APPIMAGE set), restore each polluted var from AppRun's `<VAR>_ORIG`
  or drop the override; no-op otherwise so a legitimate LD_LIBRARY_PATH on a
  normal install is untouched. Applied in `hidden_cmd` for every spawn
  (curl, gh, git).
- `curl_with_status`: add `-S`/--show-error and a `curl_transport_check`
  that maps a non-zero curl exit to an explicit transport error carrying
  curl's stderr, instead of letting an empty body surface as a JSON parse
  error.

Tests: 7 new unit tests over the pure helpers (no global env mutation).

* test(desktop): headless repro harness for AppImage curl env pollution (#48)

Linux-only shell harness that reproduces issue #48 and proves the fix
without the GUI, the Tauri toolchain, or an AppImage build:

  1. CLEAN    — curl with a normal env succeeds
  2. POLLUTED — simulate AppRun (APPDIR + a bundle dir whose libcurl/libssl
                sonames are deliberately broken on LD_LIBRARY_PATH): curl
                fails with an empty body == the user-visible EOF parse error
  3. SCRUBBED — apply hidden_cmd's env fix (restore <VAR>_ORIG / unset):
                curl succeeds again

Exits non-zero unless all stages behave as expected, so it works as a
regression test in any Linux env (OrbStack/Lima/UTM/CI). Refuses to run
on non-Linux to avoid false results.

* docs+ci: CHANGELOG entry for #48 fix + run repro harness in CI

- CHANGELOG.md: document the Linux AppImage OAuth fix under [Unreleased].
- ci.yml: new lightweight `appimage-env-repro` job (bash + curl only, no
  Tauri toolchain) that runs scripts/repro-issue-48-appimage-curl.sh on
  every push/PR, keeping the regression covered.

---------

Co-authored-by: Laurent Guitton <laurent.guitton@dendreo.com>

Author: devlint

.github/workflows/ci.yml

@@ -31,6 +31,19 @@ jobs:
 
       - run: pnpm test
 
+  appimage-env-repro:
+    name: AppImage curl env repro (#48)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      # Headless regression check: reproduces issue #48 (AppRun's
+      # LD_LIBRARY_PATH pollution breaking the spawned curl) and verifies the
+      # hidden_cmd env scrub resolves it. Needs only bash + curl, both present
+      # on ubuntu-latest — no Tauri toolchain or AppImage build required.
+      - name: Reproduce issue #48 and verify the fix
+        run: bash scripts/repro-issue-48-appimage-curl.sh
+
   desktop:
     name: Desktop Build (${{ matrix.platform }})
     needs: test

CHANGELOG.md

@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- **GitHub & Azure OAuth in the Linux AppImage** — sign-in failed in the released AppImage with `Failed to parse device-code response: EOF while parsing a value at line 1 column 0` (worked under `pnpm tauri dev`). The forge HTTP transport shells out to the system `curl`, which inherited the AppImage `AppRun`'s `LD_LIBRARY_PATH` pollution and loaded ABI-incompatible bundled libs, dying before the TLS request completed (empty body → JSON parse error). `hidden_cmd` now de-pollutes the child environment inside an AppImage (restore each `<VAR>_ORIG` saved by AppRun, else drop the override; no-op outside an AppImage), and the curl transport now adds `--show-error` and reports a non-zero curl exit as an explicit transport error instead of a misleading parse error. Reproduced and verified end-to-end on Linux via `scripts/repro-issue-48-appimage-curl.sh`. (#48)
+
 ## [2.20.0] - 2026-06-17
 
 ### Added

apps/desktop/src-tauri/src/commands/curl_util.rs

@@ -51,6 +51,33 @@ pub(crate) fn run_curl(
         .map_err(|e| format!("curl failed: {}", e))
 }
 
+/// Decide whether a finished `curl` invocation represents a transport failure
+/// and, if so, build a user-facing error.
+///
+/// curl exits non-zero only on *transport* problems (DNS, connection, TLS,
+/// library-load failures) — an HTTP 4xx/5xx still exits 0 and is handled by the
+/// caller via the response status. The empty-diagnostic branch is the AppImage
+/// bundled-library case from issue #48: without this, an empty body fell
+/// through to `serde_json` as a cryptic "EOF while parsing" error.
+///
+/// `code` is the process exit code (`None` if killed by a signal); `stderr` is
+/// curl's captured standard error (populated thanks to `--show-error`).
+fn curl_transport_check(success: bool, code: Option<i32>, stderr: &str) -> Result<(), String> {
+    if success {
+        return Ok(());
+    }
+    let code_str = code.map(|c| c.to_string()).unwrap_or_else(|| "signal".to_string());
+    let detail = stderr.trim();
+    if detail.is_empty() {
+        Err(format!(
+            "curl request failed (exit {code_str}) with no diagnostic output — \
+             this often means a bundled-library conflict in the packaged app"
+        ))
+    } else {
+        Err(format!("curl request failed (exit {code_str}): {detail}"))
+    }
+}
+
 /// Execute a curl request and return `(http_status, body_text)`.
 ///
 /// Appends `-w "\n__GW_HTTP_STATUS__%{http_code}"` so the HTTP status is
@@ -69,6 +96,7 @@ pub(crate) fn curl_with_status(
     const MARKER: &str = "\n__GW_HTTP_STATUS__";
     let mut args: Vec<String> = vec![
         "-s".to_string(),
+        "-S".to_string(), // --show-error: keep stderr diagnostics under -s
         "-X".to_string(), method.to_string(),
         "-H".to_string(), format!("Accept: {}", accept),
     ];
@@ -91,6 +119,14 @@ pub(crate) fn curl_with_status(
     args.push(url.to_string());
 
     let output = run_curl(&args, auth_config)?;
+    // A non-zero curl exit is a transport failure (DNS/TLS/connection/library
+    // load) — surface it instead of letting an empty body reach the JSON
+    // parser as a cryptic "EOF" error.
+    curl_transport_check(
+        output.status.success(),
+        output.status.code(),
+        &String::from_utf8_lossy(&output.stderr),
+    )?;
     // Consume the Vec<u8> in-place — zero copy on the valid-UTF-8 fast path.
     let combined = String::from_utf8(output.stdout)
         .map_err(|e| format!("curl returned invalid UTF-8: {}", e))?;
@@ -100,3 +136,41 @@ pub(crate) fn curl_with_status(
     };
     Ok((status, body))
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn transport_ok_when_curl_succeeds() {
+        assert!(curl_transport_check(true, Some(0), "").is_ok());
+        // A non-empty stderr is irrelevant when curl exited successfully.
+        assert!(curl_transport_check(true, Some(0), "Note: using HTTP/2").is_ok());
+    }
+
+    #[test]
+    fn transport_error_surfaces_curl_stderr() {
+        let err = curl_transport_check(
+            false,
+            Some(35),
+            "curl: (35) OpenSSL/3.0: error:0A000086:SSL routines",
+        )
+        .unwrap_err();
+        assert!(err.contains("exit 35"), "got: {err}");
+        assert!(err.contains("error:0A000086"), "got: {err}");
+    }
+
+    #[test]
+    fn transport_error_explains_empty_diagnostic() {
+        // The AppImage bundled-library case: curl dies with no stderr at all.
+        let err = curl_transport_check(false, Some(127), "  \n").unwrap_err();
+        assert!(err.contains("exit 127"), "got: {err}");
+        assert!(err.contains("bundled-library"), "got: {err}");
+    }
+
+    #[test]
+    fn transport_error_handles_signal_kill() {
+        let err = curl_transport_check(false, None, "").unwrap_err();
+        assert!(err.contains("signal"), "got: {err}");
+    }
+}

apps/desktop/src-tauri/src/git/cmd.rs

@@ -116,6 +116,61 @@ pub(crate) fn git_binary() -> String {
         .clone()
 }
 
+/// Environment variables an AppImage's `AppRun` rewrites to point at the
+/// bundle's own libraries. Any external process we spawn (`curl`, `gh`,
+/// `git`…) inherits them and then loads ABI-incompatible bundled libs — e.g.
+/// the system `curl` crashing at TLS init and emitting an empty body, which
+/// surfaced as the OAuth "Failed to parse device-code response: EOF" failure
+/// in the released Linux AppImage (GitHub issue #48). We undo the pollution
+/// for child processes so they pick up the *system* libraries.
+const APPIMAGE_POLLUTED_VARS: &[&str] = &[
+    "LD_LIBRARY_PATH",
+    "LD_PRELOAD",
+    "GTK_PATH",
+    "GIO_MODULE_DIR",
+    "GSETTINGS_SCHEMA_DIR",
+    "GDK_PIXBUF_MODULE_FILE",
+    "GDK_PIXBUF_MODULEDIR",
+    "GST_PLUGIN_SYSTEM_PATH",
+    "GST_PLUGIN_PATH",
+    "QT_PLUGIN_PATH",
+    "PYTHONPATH",
+    "PYTHONHOME",
+    "PERLLIB",
+];
+
+/// One fix to apply to a spawned child's environment.
+#[derive(Debug, PartialEq, Eq)]
+enum EnvFix {
+    /// Restore the value `AppRun` saved (in `<VAR>_ORIG`) before overriding it.
+    Restore(String),
+    /// No saved original — drop the override so the system default applies.
+    Remove,
+}
+
+/// Compute the environment fixes needed so a spawned process uses *system*
+/// libraries instead of the AppImage's bundled ones.
+///
+/// `get` is the environment lookup (injected for testability). Returns no
+/// fixes when not running inside an AppImage: on a normal install
+/// `LD_LIBRARY_PATH` and friends may be set intentionally and must be left
+/// untouched. AppImage's `AppRun` always exports `APPDIR`; `APPIMAGE` points at
+/// the `.AppImage` file — either marks the bundled runtime.
+fn appimage_env_fixes(get: &dyn Fn(&str) -> Option<String>) -> Vec<(&'static str, EnvFix)> {
+    if get("APPDIR").is_none() && get("APPIMAGE").is_none() {
+        return Vec::new();
+    }
+    let mut fixes = Vec::new();
+    for &var in APPIMAGE_POLLUTED_VARS {
+        match get(&format!("{var}_ORIG")) {
+            Some(orig) => fixes.push((var, EnvFix::Restore(orig))),
+            None if get(var).is_some() => fixes.push((var, EnvFix::Remove)),
+            None => {}
+        }
+    }
+    fixes
+}
+
 /// Builds a `Command` for any binary with CREATE_NO_WINDOW on Windows.
 /// Prevents black CMD console windows from flashing when spawning child processes.
 ///
@@ -142,6 +197,18 @@ pub(crate) fn hidden_cmd(bin: &str) -> std::process::Command {
         }
         cmd.env("PATH", enriched);
     }
+    // Undo AppImage library-path pollution so the spawned binary loads system
+    // libs, not the bundle's. No-op unless we're running inside an AppImage
+    // (gated by APPDIR/APPIMAGE), so it's safe to run on every platform. See
+    // `appimage_env_fixes` — this is the fix for the Linux OAuth failure in
+    // GitHub issue #48.
+    let get_env = |k: &str| std::env::var(k).ok();
+    for (var, fix) in appimage_env_fixes(&get_env) {
+        match fix {
+            EnvFix::Restore(value) => { cmd.env(var, value); }
+            EnvFix::Remove         => { cmd.env_remove(var); }
+        }
+    }
     // Defensive: propagate auth tokens explicitly to every subprocess so
     // `gh` (and any other CLI that respects these env vars) bypasses the
     // macOS keychain helper, which hangs ≥30s when called from a signed
@@ -215,4 +282,57 @@ pub(crate) fn resolve_git_dir(cwd: &str) -> Result<PathBuf, String> {
     Ok(path)
 }
 
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::collections::HashMap;
+
+    /// Build an env-lookup closure backed by a fixed map (no global state).
+    fn lookup<'a>(map: &'a HashMap<&'a str, &'a str>) -> impl Fn(&str) -> Option<String> + 'a {
+        move |k: &str| map.get(k).map(|s| s.to_string())
+    }
+
+    #[test]
+    fn appimage_env_fixes_left_alone_outside_appimage() {
+        // No APPDIR/APPIMAGE → a legitimately-set LD_LIBRARY_PATH is untouched.
+        let env: HashMap<&str, &str> = [("LD_LIBRARY_PATH", "/usr/lib/x86_64-linux-gnu")]
+            .into_iter()
+            .collect();
+        assert!(appimage_env_fixes(&lookup(&env)).is_empty());
+    }
+
+    #[test]
+    fn appimage_env_fixes_removes_polluted_var_without_orig() {
+        // Inside an AppImage, a bundled LD_LIBRARY_PATH with no saved original
+        // is dropped so the child falls back to the system default.
+        let env: HashMap<&str, &str> =
+            [("APPDIR", "/tmp/.mount_app"), ("LD_LIBRARY_PATH", "/tmp/.mount_app/usr/lib")]
+                .into_iter()
+                .collect();
+        assert_eq!(
+            appimage_env_fixes(&lookup(&env)),
+            vec![("LD_LIBRARY_PATH", EnvFix::Remove)]
+        );
+    }
+
+    #[test]
+    fn appimage_env_fixes_restores_apprun_saved_original() {
+        // AppRun stashes the pre-override value in <VAR>_ORIG; restore it.
+        let env: HashMap<&str, &str> = [
+            ("APPIMAGE", "/home/u/GitWand.AppImage"),
+            ("LD_LIBRARY_PATH", "/tmp/.mount_app/usr/lib"),
+            ("LD_LIBRARY_PATH_ORIG", "/usr/lib:/usr/local/lib"),
+        ]
+        .into_iter()
+        .collect();
+        assert_eq!(
+            appimage_env_fixes(&lookup(&env)),
+            vec![(
+                "LD_LIBRARY_PATH",
+                EnvFix::Restore("/usr/lib:/usr/local/lib".to_string())
+            )]
+        );
+    }
+}
+