`/v1/apps/{appID}/sketch/libraries` endpoint causes panic when App doesn't contain sketch

[per1234]

Describe the problem

An App may consist of the following components:

• Python script
• Arduino sketch

It is only required that the App contain one of those two components.

🐛 If an App does not contain an Arduino sketch, a request to the /v1/apps/{appID}/sketch/libraries causes a panic.

To reproduce

$ arduino-app-cli app new FooApp

App created successfully: /home/arduino/ArduinoApps/fooapp (ok)

$ rm -r /home/arduino/ArduinoApps/fooapp/sketch

$ arduino-app-cli daemon &

[1] 3040

$ APP_ID="$(printf "user:fooapp" | base64)" && curl --silent "http://localhost:8080/v1/apps/${APP_ID//=}/sketch/libraries"

2025/11/15 21:36:16 ERROR handler panic err="runtime error: invalid memory address or nil pointer dereference" stacktrace="goroutine 23 [running]:\nruntime/debug.Stack()\n\t/usr/local/go/src/runtime/debug/stack.go:26 +0x64\ngithub.com/arduino/arduino-app-cli/cmd/arduino-app-cli/daemon.httpHandler.RecoverPanic.func3.1()\n\t/home/per/git/arduino/arduino-app-cli/internal/httprecover/httprecover.go:28 +0x50\npanic({0x21e7120?, 0x477d520?})\n\t/usr/local/go/src/runtime/panic.go:783 +0x120\ngithub.com/arduino/go-paths-helper.(*Path).String(...)\n\t/home/per/go/pkg/mod/github.com/arduino/go-paths-helper@v1.14.0/paths.go:543\ngithub.com/arduino/arduino-app-cli/internal/orchestrator.ListSketchLibraries({0x2ebd938, 0x40008fe500}, {{0x4000aea7f4, 0x6}, 0x4000aef280, 0x0, 0x4000aef070, {{0x4000aea7f4, 0x6}, {0x0, ...}, ...}})\n\t/home/per/git/arduino/arduino-app-cli/internal/orchestrator/sketch_libs.go:117 +0x3c\ngithub.com/arduino/arduino-app-cli/internal/api.NewHTTPRouter.HandleSketchListLibraries.func28({0x2ea8ed8, 0x400054d1d0}, 0x4000234280)\n\t/home/per/git/arduino/arduino-app-cli/internal/api/handlers/app_sketch_libs.go:123 +0xe4\nnet/http.HandlerFunc.ServeHTTP(0x40005243c0?, {0x2ea8ed8?, 0x400054d1d0?}, 0x1e3b3b4?)\n\t/usr/local/go/src/net/http/server.go:2322 +0x38\nnet/http.(*ServeMux).ServeHTTP(0x400070ca00?, {0x2ea8ed8, 0x400054d1d0}, 0x4000234280)\n\t/usr/local/go/src/net/http/server.go:2861 +0x190\ngithub.com/arduino/arduino-app-cli/cmd/arduino-app-cli/daemon.httpHandler.(*Middleware).Wrap.func2({0x2ea8ed8, 0x400054d1d0}, 0x4000234280)\n\t/home/per/go/pkg/mod/github.com/jub0bs/cors@v0.7.0/middleware.go:142 +0x1e4\nnet/http.HandlerFunc.ServeHTTP(0x4000693ae8?, {0x2ea8ed8?, 0x400054d1d0?}, 0x64668?)\n\t/usr/local/go/src/net/http/server.go:2322 +0x38\ngithub.com/arduino/arduino-app-cli/cmd/arduino-app-cli/daemon.httpHandler.RecoverPanic.func3({0x2ea8ed8?, 0x400054d1d0?}, 0x400012d580?)\n\t/home/per/git/arduino/arduino-app-cli/internal/httprecover/httprecover.go:38 +0x6c\nnet/http.HandlerFunc.ServeHTTP(0x0?, {0x2ea8ed8?, 0x400054d1d0?}, 0x4000693b50?)\n\t/usr/local/go/src/net/http/server.go:2322 +0x38\nnet/http.serverHandler.ServeHTTP({0x4000127480?}, {0x2ea8ed8?, 0x400054d1d0?}, 0x1?)\n\t/usr/local/go/src/net/http/server.go:3340 +0xb0\nnet/http.(*conn).serve(0x4000174c60, {0x2ebd900, 0x4000ae9b00})\n\t/usr/local/go/src/net/http/server.go:2109 +0x528\ncreated by net/http.(*Server).Serve in goroutine 22\n\t/usr/local/go/src/net/http/server.go:3493 +0x384\n" method=GET path=/v1/apps/dXNlcjpmb29hcHA/sketch/libraries
Internal Server Error

Expected behavior

Panics never occur under normal operating conditions. They should only occur when something "impossible" happens.

Arduino App CLI version

62e5944

Additional context

The panic occurs here:

arduino-app-cli/internal/orchestrator/sketch_libs.go

Line 117 in 62e5944

SketchPath: app.MainSketchPath.String(),

due to the fact that internal/orchestrator/app.ArduinoApp.MainSketchPath is nil when the App has no sketch. Perhaps a fix could be something like this:

--- a/internal/orchestrator/sketch_libs.go
+++ b/internal/orchestrator/sketch_libs.go
@@ -111,6 +111,9 @@ func RemoveSketchLibrary(ctx context.Context, app app.ArduinoApp, libRef Library
 }

 func ListSketchLibraries(ctx context.Context, app app.ArduinoApp) ([]LibraryReleaseID, error) {
+       if app.MainSketchPath == nil{
+               return []LibraryReleaseID{}, nil
+       }
+
        srv := commands.NewArduinoCoreServer()

        resp, err := srv.ProfileLibList(ctx, &rpc.ProfileLibListRequest{

---

Originally reported at https://forum.arduino.cc/t/app-lab-stopped-opening-system-resources-example/1414335

[rjtokenring]

same here. Adding full logs.

log.txt