[kawacukennedy]

What?

Add context timeouts to both OAuth subprocess calls (30s for token retrieval, 5 min for browser flow). Capture stderr into a buffer instead of leaking it to os.Stderr.

Why?

Both exec.Command calls suppressed the noctx linter and could hang indefinitely if the Python helper script stalled. Stderr was piped directly to os.Stderr, which could leak sensitive information (tokens, error traces) to logs.

[floatpanebot]

Benchmark report — no significant change

Metrics worse: 0 · better: 0 (threshold: ±3%).

benchstat output

goos: linux
goarch: amd64
pkg: github.com/floatpane/matcha/backend
cpu: AMD EPYC 7763 64-Core Processor                
                           │   old.txt    │               new.txt               │
                           │    sec/op    │    sec/op      vs base              │
ParseSearchQuery_Simple-4    3.094µ ± 90%    3.300µ ± 18%       ~ (p=0.240 n=6)
ParseSearchQuery_Complex-4   8.710µ ± 37%   10.132µ ± 50%       ~ (p=0.818 n=6)
TokenizeSearchQuery-4        4.419µ ± 46%    3.966µ ± 25%       ~ (p=1.000 n=6)
geomean                      4.920µ          5.099µ        +3.65%

                           │  old.txt   │              new.txt               │
                           │    B/op    │    B/op     vs base                │
ParseSearchQuery_Simple-4    26.00 ± 0%   26.00 ± 0%       ~ (p=1.000 n=6) ¹
ParseSearchQuery_Complex-4   762.0 ± 0%   762.0 ± 0%       ~ (p=1.000 n=6) ¹
TokenizeSearchQuery-4        176.0 ± 0%   176.0 ± 0%       ~ (p=1.000 n=6) ¹
geomean                      151.6        151.6       +0.00%
¹ all samples are equal

                           │  old.txt   │              new.txt               │
                           │ allocs/op  │ allocs/op   vs base                │
ParseSearchQuery_Simple-4    2.000 ± 0%   2.000 ± 0%       ~ (p=1.000 n=6) ¹
ParseSearchQuery_Complex-4   23.00 ± 0%   23.00 ± 0%       ~ (p=1.000 n=6) ¹
TokenizeSearchQuery-4        9.000 ± 0%   9.000 ± 0%       ~ (p=1.000 n=6) ¹
geomean                      7.453        7.453       +0.00%
¹ all samples are equal

pkg: github.com/floatpane/matcha/tui
                    │   old.txt    │              new.txt               │
                    │    sec/op    │    sec/op     vs base              │
LogPanelView-4        162.5µ ± 17%   167.4µ ± 14%       ~ (p=0.485 n=6)
SearchOverlayView-4   170.5µ ± 14%   181.6µ ±  6%       ~ (p=0.065 n=6)
InboxConstruction-4   963.9µ ±  9%   961.0µ ± 15%       ~ (p=0.818 n=6)
geomean               298.9µ         308.0µ        +3.04%

                    │    old.txt    │               new.txt               │
                    │     B/op      │     B/op       vs base              │
LogPanelView-4        44.67Ki ± 51%   44.67Ki ±  0%       ~ (p=1.000 n=6)
SearchOverlayView-4   56.15Ki ± 41%   56.15Ki ± 41%       ~ (p=0.729 n=6)
InboxConstruction-4   874.5Ki ±  0%   874.4Ki ±  0%       ~ (p=0.738 n=6)
geomean               129.9Ki         129.9Ki        -0.00%

                    │   old.txt   │              new.txt              │
                    │  allocs/op  │  allocs/op   vs base              │
LogPanelView-4         714.0 ± 0%    714.0 ± 0%       ~ (p=1.000 n=6)
SearchOverlayView-4    926.0 ± 0%    926.0 ± 0%       ~ (p=1.000 n=6)
InboxConstruction-4   3.483k ± 0%   3.482k ± 0%       ~ (p=0.738 n=6)
geomean               1.321k        1.320k       -0.00%

_{auto-generated by benchmarks.yml}

[floatpanebot]

This has had no activity for 45 days. It will be closed in 21 days unless updated. Comment or remove the stale label to keep it open.

[kawacukennedy]

Hi @andrinoff — this PR is still open and all CI checks are green; just keeping it off the stale queue. Happy to rebase/adjust if anything needs updating. Thanks!

[floatpanebot]

This has had no activity for 45 days. It will be closed in 21 days unless updated. Comment or remove the stale label to keep it open.

[andrinoff]

Hey, if you can make this PR on the new version, that'd be great!

[kawacukennedy]

Rebased onto the new v1.0.0 master — thanks for the nudge, @andrinoff! 🙌

The fix is unchanged in intent, just re-applied on top of the restructured tree:

• GetOAuth2Token now runs via exec.CommandContext with a 30s timeout.
• RunOAuth2Flow runs via exec.CommandContext with a 5m timeout (browser consent needs the headroom).
• Both capture stderr into a buffer and surface it in the returned error instead of leaking it straight to os.Stderr.

Also removes the two //nolint:noctx suppressions, so the noctx linter is satisfied for real.

go build ./..., go vet, make test and golangci-lint (incl. noctx/gosec) are all green locally. The PR is now MERGEABLE.

[kawacukennedy]

CI note: the only failing check here is govulncheck, and it's a pre-existing issue on master (not caused by this PR). A new Go stdlib advisory, GO-2026-6809, was published after go 1.26.9 and is fixed in go 1.26.10; the repo still pins 1.26.9.

I've opened #1749 to bump the toolchain (also reachable via fetch → pkcs7 → x509). Once that lands, this PR's govulncheck will go green. Everything else in the matrix is passing.