fix(session): resolve user shell env for sidecar spawning

Desktop-launched apps inherit a minimal environment from the display
manager, missing PATH entries (nvm/fnm/volta), LD_LIBRARY_PATH, and
API keys. This caused node/codex sidecars to fail with library
mismatches (e.g. nghttp2) or not be found at all.

Add shell_env module that runs the user's login shell once to capture
the real environment, caches it, and applies it to child processes.

Author: Swofty-Developments

crates/session/src/claude.rs

@@ -8,6 +8,7 @@ use tokio::process::{Child, Command};
 use tokio::sync::mpsc;
 use tracing::debug;
 
+use crate::shell_env;
 use crate::types::AgentEvent;
 
 /// Path to the agent sidecar script, relative to the workspace root.
@@ -136,15 +137,25 @@ impl ClaudeSession {
 
         debug!("Spawning agent sidecar: node {}", sidecar_path.display());
 
-        let mut child = Command::new("node")
-            .arg(&sidecar_path)
+        // Resolve `node` using the user's real shell PATH so that desktop-launched
+        // apps (which may have a minimal environment) find the correct binary and
+        // its matching shared libraries (e.g. libnghttp2).
+        let node_bin = shell_env::which("node")
+            .unwrap_or_else(|| std::path::PathBuf::from("node"));
+
+        let mut cmd = Command::new(&node_bin);
+        cmd.arg(&sidecar_path)
             .current_dir(cwd)
             .stdin(std::process::Stdio::piped())
             .stdout(std::process::Stdio::piped())
             .stderr(std::process::Stdio::piped())
-            .kill_on_drop(true)
-            .spawn()
-            .context("Failed to spawn node agent sidecar")?;
+            .kill_on_drop(true);
+        shell_env::apply(&mut cmd);
+
+        let mut child = cmd.spawn().context(format!(
+            "Failed to spawn node agent sidecar (node={})",
+            node_bin.display()
+        ))?;
 
         let stdout = child.stdout.take().context("Failed to capture stdout")?;
         let stdin = child.stdin.take().context("Failed to capture stdin")?;

crates/session/src/codex.rs

@@ -11,6 +11,7 @@ use tokio::sync::{mpsc, oneshot};
 use tracing::{debug, error, warn};
 
 use crate::protocol::{self, JsonRpcMessage, JsonRpcResponse};
+use crate::shell_env;
 use crate::types::AgentEvent;
 
 /// Message sent to the writer task.
@@ -47,15 +48,24 @@ impl CodexSession {
         cwd: &Path,
         model: &str,
     ) -> Result<(Self, mpsc::UnboundedReceiver<AgentEvent>)> {
-        let mut child = Command::new("codex")
-            .arg("app-server")
+        // Resolve `codex` using the user's real shell PATH so that desktop-launched
+        // apps find the correct binary with matching shared libraries.
+        let codex_bin = shell_env::which("codex")
+            .unwrap_or_else(|| std::path::PathBuf::from("codex"));
+
+        let mut cmd = Command::new(&codex_bin);
+        cmd.arg("app-server")
             .current_dir(cwd)
             .stdin(std::process::Stdio::piped())
             .stdout(std::process::Stdio::piped())
             .stderr(std::process::Stdio::piped())
-            .kill_on_drop(true)
-            .spawn()
-            .context("Failed to spawn codex app-server")?;
+            .kill_on_drop(true);
+        shell_env::apply(&mut cmd);
+
+        let mut child = cmd.spawn().context(format!(
+            "Failed to spawn codex app-server (codex={})",
+            codex_bin.display()
+        ))?;
 
         let stdout = child.stdout.take().context("Failed to capture codex stdout")?;
         let stderr = child.stderr.take().context("Failed to capture codex stderr")?;

crates/session/src/lib.rs

@@ -5,6 +5,7 @@ pub mod claude;
 pub mod codex;
 pub mod manager;
 pub mod protocol;
+pub mod shell_env;
 pub mod types;
 
 /// Unique identifier for a session.

crates/session/src/shell_env.rs

@@ -0,0 +1,108 @@
+//! Resolve the user's interactive shell environment.
+//!
+//! Desktop-launched apps (Tauri, Electron, etc.) often inherit a minimal
+//! environment that lacks PATH entries, LD_LIBRARY_PATH, nvm/fnm shims, etc.
+//! This module runs a one-shot shell to capture the real environment and
+//! caches it for the lifetime of the process.
+
+use std::collections::HashMap;
+use std::sync::OnceLock;
+
+use tracing::{debug, warn};
+
+/// Cached shell environment, resolved once per process.
+static SHELL_ENV: OnceLock<HashMap<String, String>> = OnceLock::new();
+
+/// Get the resolved shell environment.  The first call resolves it (blocking);
+/// subsequent calls return the cached result instantly.
+pub fn get() -> &'static HashMap<String, String> {
+    SHELL_ENV.get_or_init(resolve_shell_env)
+}
+
+/// Apply the resolved shell environment to a [`tokio::process::Command`].
+///
+/// This merges the resolved env on top of the command's existing environment
+/// rather than replacing it wholesale, so Tauri-specific vars are preserved.
+pub fn apply(cmd: &mut tokio::process::Command) {
+    for (key, value) in get() {
+        cmd.env(key, value);
+    }
+}
+
+/// Resolve the user's login-shell environment by running:
+///   $SHELL -l -i -c 'env -0'      (preferred, NUL-separated)
+///   $SHELL -l -c 'env'             (fallback)
+///
+/// On failure, falls back to the current process environment.
+fn resolve_shell_env() -> HashMap<String, String> {
+    let shell = std::env::var("SHELL").unwrap_or_else(|_| "/bin/sh".to_string());
+    debug!("Resolving shell environment using: {shell}");
+
+    // Try NUL-separated first (handles values with newlines).
+    if let Some(env) = run_shell_env(&shell, &["-l", "-i", "-c", "env -0"], true) {
+        debug!("Resolved {} env vars via `env -0`", env.len());
+        return env;
+    }
+
+    // Fallback: newline-separated.
+    if let Some(env) = run_shell_env(&shell, &["-l", "-c", "env"], false) {
+        debug!("Resolved {} env vars via `env` (newline-delimited)", env.len());
+        return env;
+    }
+
+    warn!("Could not resolve shell environment; falling back to process env");
+    std::env::vars().collect()
+}
+
+fn run_shell_env(
+    shell: &str,
+    args: &[&str],
+    nul_separated: bool,
+) -> Option<HashMap<String, String>> {
+    let output = std::process::Command::new(shell)
+        .args(args)
+        .stdin(std::process::Stdio::null())
+        .stdout(std::process::Stdio::piped())
+        .stderr(std::process::Stdio::null())
+        // Prevent rc files from prompting for input
+        .env("TERM", "dumb")
+        .output()
+        .ok()?;
+
+    if !output.status.success() {
+        return None;
+    }
+
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    let mut env = HashMap::new();
+
+    let entries: Box<dyn Iterator<Item = &str>> = if nul_separated {
+        Box::new(stdout.split('\0'))
+    } else {
+        Box::new(stdout.lines())
+    };
+
+    for entry in entries {
+        if let Some((key, value)) = entry.split_once('=') {
+            if !key.is_empty() && !key.contains(|c: char| c.is_whitespace()) {
+                env.insert(key.to_string(), value.to_string());
+            }
+        }
+    }
+
+    if env.is_empty() { None } else { Some(env) }
+}
+
+/// Resolve the full path to a command using the resolved shell PATH.
+/// Returns None if the command cannot be found.
+pub fn which(cmd: &str) -> Option<std::path::PathBuf> {
+    let env = get();
+    let path_var = env.get("PATH")?;
+    for dir in std::env::split_paths(path_var) {
+        let candidate = dir.join(cmd);
+        if candidate.is_file() {
+            return Some(candidate);
+        }
+    }
+    None
+}