Keep rustc on the sanitized packaging PATH.

Native desktop failed after the window suite: applicationNotices
spawns rustc --version --verbose, but applyPackagingPath only kept
target/, Node, and /usr/bin. Add CARGO_HOME, ~/.cargo/bin, and any
safe PATH directory that already has rustc/cargo. Still reject
/usr/local/bin and Hermes.

Co-authored-by: Bob Corbin <ShadowfetchLinux@users.noreply.github.com>

Author: cursoragent

scripts/native-packaging-env.mjs

@@ -56,11 +56,45 @@ export function isUnsafePackagingDir(dir) {
   );
 }
 
+function dirContains(dir, name) {
+  try {
+    statSync(path.join(dir, name));
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// rustc/cargo live on the caller PATH (rustup ~/.cargo/bin, CARGO_HOME).
+// linuxdeploy still must not see /usr/local/bin or Hermes; keep only the
+// toolchain directories themselves when they pass the same safety checks.
+function rustToolchainDirs() {
+  const candidates = [];
+  if (process.env.CARGO_HOME) {
+    candidates.push(path.join(process.env.CARGO_HOME, "bin"));
+  }
+  if (process.env.HOME) {
+    candidates.push(path.join(process.env.HOME, ".cargo", "bin"));
+  }
+  for (const dir of (process.env.PATH || "").split(path.delimiter)) {
+    if (!dir) continue;
+    const resolved = resolveExistingDir(dir);
+    if (
+      resolved &&
+      (dirContains(resolved, "rustc") || dirContains(resolved, "cargo"))
+    ) {
+      candidates.push(resolved);
+    }
+  }
+  return candidates;
+}
+
 export function packagingDirs(root, options = {}) {
   const execDir = options.execDir ?? path.dirname(process.execPath);
   const extras = [
     path.join(root, "tools/rust-dev/extracted/usr/bin"),
     path.join(root, "..", "tools/rust-dev/extracted/usr/bin"),
+    ...rustToolchainDirs(),
     path.join(root, "target/release"),
     path.join(root, "target/debug"),
     path.join(root, "target/.tauri"),

scripts/test-native-packaging-env.mjs

@@ -38,6 +38,12 @@ test("packaging PATH is constructed, not inherited", () => {
   assert.doesNotMatch(joined, /\.hermes/);
   const rustDev = path.resolve(root, "../tools/rust-dev/extracted/usr/bin");
   if (existsSync(rustDev)) assert.ok(dirs.includes(rustDev));
+  const rustcDir = dirs.find((dir) => existsSync(path.join(dir, "rustc")));
+  assert.ok(
+    rustcDir,
+    "sanitized PATH must still find rustc for dependency notices",
+  );
+  assert.notEqual(path.resolve(rustcDir), "/usr/local/bin");
   const tauriTools = path.join(root, "target/.tauri");
   if (existsSync(tauriTools)) assert.ok(dirs.includes(tauriTools));
 });
@@ -64,6 +70,10 @@ test("applyPackagingPath overwrites a dirty process PATH", () => {
     assert.doesNotMatch(next, /(^|:)\/usr\/local\/bin(:|$)/);
     assert.match(next, /(^|:)\/usr\/bin(:|$)/);
     assert.notEqual(next, dirtyPath);
+    assert.ok(
+      next.split(path.delimiter).some((dir) => existsSync(path.join(dir, "rustc"))),
+      "dirty caller PATH must not drop rustc",
+    );
   } finally {
     process.env.PATH = previous;
   }