[Bug]: Linux AppImage crashes with ICU SIGTRAP when enabling Network access #16629

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

The matching proposed fix is #15681, which is open and unmerged. This issue records the observed failure and independent reproduction for maintainer triage; it does not request approval of a particular implementation. Related reports and their differences are listed below.

Area

apps/desktop

Steps to reproduce

1. On Fedora 44 x86-64 / KDE / Wayland, launch the official T3 Code 0.0.45 x86_64 AppImage with --no-sandbox. Start with Network access disabled (serverExposureMode: "local-only").
2. Open Settings → Connections and enable Network access; allow the requested desktop restart.
3. The existing process exits, but the replacement does not return to a usable window. Inspect coredumpctl for the replacement process: it has SIGTRAP.

An empty isolated profile reproduces the failure, so no project, chat history, active agent turn, or long-running session is required. To start a separate test instance from a writable directory:

# Set this to the downloaded 0.0.45 x86_64 AppImage.
appimage_path=/absolute/path/T3-Code-0.0.45-x86_64.AppImage
trial_dir=$(mktemp -d "$PWD/t3-repro.XXXXXX")
# Choose an unused backend port.
trial_port=43773

env -u APPIMAGE -u APPDIR -u ELECTRON_RUN_AS_NODE -u NODE_OPTIONS \
  T3CODE_HOME="$trial_dir/t3-home" \
  XDG_CONFIG_HOME="$trial_dir/config" \
  XDG_DATA_HOME="$trial_dir/data" \
  XDG_CACHE_HOME="$trial_dir/cache" \
  T3CODE_DISABLE_AUTO_UPDATE=true \
  T3CODE_PORT="$trial_port" \
  "$appimage_path" --no-sandbox > "$trial_dir/startup.log" 2>&1

# After triggering the restart in that test window:
coredumpctl list --since "5 minutes ago"

How the controlled reproduction was operated: the unmodified packaged AppImage was launched with the separate paths above and a dynamically selected unused port. A loopback Node inspector invoked the main window's webContents.executeJavaScript with:

window.desktopBridge.setServerExposureMode("network-accessible")

This is the renderer bridge for the setting's desktop:set-server-exposure-mode IPC method. The test first confirmed the initial mode was local-only and the main window had finished loading. The automated reproduction directly exercised that setting action; manual clicks through its confirmation dialog were not recorded.

Expected behavior

The setting is saved, the desktop restarts successfully, and the replacement opens a usable window with Network access enabled.

Actual behavior

The setting is saved, the old process exits normally, and the replacement crashes during Chromium/ICU startup with SIGTRAP / int3. Both the original crash core and the reproduced crash core contain:

ERROR:base/i18n/icu_util.cc:237
Invalid file descriptor to ICU data received.

The evidence strongly isolates the failure to the packaged AppImage restart/resource lifetime:

Relevant shipped source: DesktopLifecycle.ts at commit 6c8fed35dded, lines 165–169 calls:

electronApp.relaunch({
  execPath: process.execPath,
  args: process.argv.slice(1),
});
electronApp.exit(0);

The bundled main.cjs was checked against that source. In the AppImage reproduction, process.execPath pointed to /tmp/.mount_T3-CodDGCtZU/t3code, while APPIMAGE pointed to the durable outer AppImage. The temporary mount disappeared after the old process exited.

Interpretation and limits: relaunching inside the outgoing AppImage mount is consistent with loss of icudtl.dat and the matching startup crash. The successful persistent-directory control and minimal missing-ICU test support that diagnosis. The precise native ordering of unmount, exec, and ICU file lookup was not captured with strace, and the original unsymbolized frames were not mapped to native function names. This report does not establish that simply changing the execPath passed to Electron's native relauncher is a sufficient fix; #15681 also addresses inherited descriptors and no_new_privs.

Impact

Major degradation or frequent failure

The settings restart terminates the desktop instead of returning a usable replacement. The original setting change affected the running desktop session; controlled reproductions used empty profiles. Whether in-progress provider turns recover after this failure was not tested.

Version or commit

• Official T3-Code-0.0.45-x86_64.AppImage, stable release.
• Package commit: 6c8fed35dded.
• Bundled Electron: 44.4.2.
• AppImage SHA-256: ab7b0a86d1ea657ccc162b60b772c61f70bc7c8b9e259b46939d53bb38faa02a.
• The repository's latest stable release was still v0.0.45 when checked on 7 October 2026. No nightly build was tested in this investigation.

Environment

Fedora Linux 44 (KDE Plasma Desktop Edition), x86-64; kernel 7.2.4-200.fc44.x86_64; KDE / native Wayland; manual AppImage installation launched with --no-sandbox.

No particular provider or model is needed for the reproduction. The isolated-profile startup performed its normal provider discovery, but no user prompt or agent turn was started by the reproduction.

Logs or stack traces

Original incident, 7 October 2026, CEST (UTC+02:00); relevant lines only:

01:10:13.418  INFO: desktop relaunch requested
  channel: desktop:set-server-exposure-mode
  component: desktop-lifecycle
  reason: serverExposureMode=network-accessible

01:10:15  replacement PID 30875
  Signal: 5 (TRAP)
  Command Line: /t3code --no-sandbox
  kernel: trap int3

The crash occurred at 0x5736e5e relative to the executable. The independently reproduced replacement crash at 01:27:53 CEST, PID 35459, matches the first five original stack offsets:

Minimal missing-ICU GDB run:

ERROR:base/i18n/icu_util.cc:237] Invalid file descriptor to ICU data received.
Program received signal SIGTRAP, Trace/breakpoint trap.
CRASH_OFFSET 0x5736e5e

Shutdown also produced desktop:get-local-environment-enabled / ipcRenderer.sendSync() listener warnings. The same warning appeared in the successful extracted-directory control, so it does not by itself explain the native crash. No out-of-memory message was found in the original crash window.

Screenshots, recordings, or supporting files

All relevant text evidence is included above. No screenshot or recording was captured. Raw core dumps, complete process environments, usernames, home-directory paths, private host addresses, and full provider logs are deliberately excluded from this public report.

The original AppImage was read and extracted, not patched. Test processes were closed. A separate initial inspector-setup attempt caused a SIGBUS during forced test cleanup; that setup artifact is excluded from the matching setting-change reproduction and stack comparison above.

Workaround

Verified: run the same extracted AppImage files from a persistent directory; the setting restart succeeded in the isolated control. This was a diagnostic control, not a change to the reporter's installed application.

Manually reopening the outer AppImage after the failed automatic restart is a plausible recovery path, but was not verified against the reporter's existing profile. No source fix was applied or tested.

Related reports and proposed fixes

• fix(desktop): Linux AppImage settings restarts launch a fresh instance #15681 — exact failure class: open proposed fix for Linux AppImage settings restarts and ICU SIGTRAP. This issue adds independent evidence on the current stable release, including a matching native stack and a successful extracted-directory control.
• fix(desktop): make AppImage restarts come back on Linux #4918 and fix(desktop): surface Tailscale Serve failures and fix AppImage restarts on Linux #4698 — earlier repair attempts: both closed without merging; they describe restarting inside the outgoing FUSE mount and launching the durable outer AppImage instead.
• fix(desktop): relaunch on Linux without setting no_new_privs #15387 — overlapping Linux relaunch work: addresses Electron's no_new_privs behavior. Its reported .deb update failure differs from this settings-triggered ICU crash.
• [Bug]: Linux AppImage: desktop main process exits silently (no quit lifecycle, no core), AppImage mount disappears and all children die with SIGBUS #14259 — related, different trigger: the main process disappears without a documented settings restart, followed by mount loss and child SIGBUS crashes. Here the relaunch reason is logged and the replacement main process has a matching ICU SIGTRAP.

Investigated and drafted with Codex desktop at the reporter's request. Maintainer triage is requested for the observed failure; no particular implementation or PR approval is assumed.