fix(src-tauri): fix PATH inheritance for GUI-launched app (studio#119) - #122
Merged
Conversation
macOS/Linux GUI-launched apps don't inherit the user's shell-rc-configured PATH (only whatever launchd/the display manager hands them) — so exec-based kubeconfig auth plugins (e.g. gke-gcloud-auth-plugin, installed via a Homebrew-cask gcloud SDK that only adds itself to PATH via shell rc) are invisible to the spawned oab-mcp sidecar even when correctly installed on disk. Confirmed live with Brett: `which gke-gcloud-auth-plugin` found it at /opt/homebrew/share/google-cloud-sdk/bin, but the app's list_namespaces call failed with "unable to run auth exec: No such file or directory". Call fix_path_env::fix() at the very top of main(), before anything else (Tauri init, sidecar spawn) that could need a PATH-resolved binary. Pinned to a specific commit of the upstream git crate (not published to crates.io) for reproducibility. This is a general safety net for any exec-based kubeconfig provider (also covers e.g. Azure kubelogin, which has no pure-Rust in-process replacement unlike GKE/EKS — see #119's other items). Ref #119.
brettchien
added a commit
that referenced
this pull request
Aug 28, 2026
…(studio#119) (#123) k8s_client_for() previously left kube-rs to shell out to gke-gcloud-auth-plugin for GKE contexts. Even with fix-path-env (#122) fixing PATH inheritance in general, this still depends on the plugin binary being installed and PATH-resolvable at all. When the resolved kubeconfig context's exec command is exactly "gke-gcloud-auth-plugin", fetch the bearer token in-process via gcp_auth instead — it walks the same Application Default Credentials chain the plugin itself reads (gcloud user creds / GOOGLE_APPLICATION_CREDENTIALS / GCE-GKE metadata server) — and set it directly on AuthInfo.token, clearing the exec block. No subprocess, no PATH dependency, for GKE specifically. Other exec-based providers (e.g. Azure kubelogin) have no equivalent pure-Rust replacement identified, so they still rely on fix-path-env. Ref #119.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Item 2 of #119's runbook. macOS/Linux GUI-launched apps don't inherit the user's shell-rc-configured
PATH(only whatever launchd/the display manager hands them). Confirmed live with Brett:gke-gcloud-auth-pluginwas correctly installed (whichfound it at/opt/homebrew/share/google-cloud-sdk/bin/gke-gcloud-auth-plugin, added to PATH only via Homebrew-cask's shell-rc hook), but the spawnedoab-mcpsidecar couldn't find it —list_namespacesfailed withauth error: unable to run auth exec: No such file or directory (os error 2).Fix
Call
fix_path_env::fix()at the very top ofmain()insrc-tauri/src/main.rs, beforeapp_lib::run()(Tauri init, sidecar spawn) — the crate re-readsPATHfrom a spawned login shell ($SHELL -ilc 'echo ...; env; ...') and applies it to the process env. Added as a git dependency pinned to a specific commit (c4c45d503ea115a839aae718d02f79e7c7f0f673) since upstream doesn't publish it to crates.io.This is a general safety net, not GKE-specific — also covers e.g. Azure
kubelogin, which (unlike GKE/EKS) has no pure-Rust in-process replacement identified, per #119's scope notes.Verification
src-tauriisn't a root-workspace member and needs macOS system libs (glib-2.0/GTK for the Linux webview target) this sandbox doesn't have, same pre-existing limitation as the Tauri-bridge-layer work (studio#105-118). Read the dependency's source directly (fix_vars/fix()intauri-apps/fix-path-env-rs'ssrc/lib.rs) to confirm the exact API shape before using it.bundle-macosjob (real macOS runner) is the only signal for this crate.Ref #119.
🤖 Generated with Claude Code