v0.9.3 macOS release cannot launch: zero-byte shared chunk in app.asar

[CAN230921]

Summary

The published macOS arm64 build for v0.9.3 is unusable on launch. Electron aborts while loading the main process because a shared ESM chunk is empty but several generated files still import named exports from it.

SyntaxError: The requested module './lib-WNnjYEnG.js' does not provide an export named 'ot'

Evidence from the published app

I inspected Contents/Resources/app.asar from the installed v0.9.3 app:

• out/main/chunks/lib-WNnjYEnG.js has size 0 bytes.
• Its recorded SHA-256 is e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855, the hash of an empty file.
• It is imported by at least:
  • out/main/index.js
  • out/main/agentHostSessionServer.js
  • out/main/chunks/agent-host-runtime-BDksCuY1.js
  • out/main/chunks/dist-D9rcy96Z.js
• The app bundle passes codesign --verify --deep --strict, so this appears to be a bad signed release artifact rather than damage after installation.

Clean-tag comparison

I checked out tag v0.9.3 (e3a75e244ceae5e1f2660ba4d3671a6c736ab704), installed the frozen lockfile with the repository-pinned Bun 1.3.11, and ran the Electron Vite build through both Node and Bun.

Both builds completed successfully and produced no zero-byte JavaScript chunks. The clean build's main-process chunk graph and hashes are also different from the published app. This makes the current release artifact non-reproducible from a clean v0.9.3 checkout.

Release-pipeline concern

The v0.9.3 tag workflow failed during source verification and never reached build/sign/upload:

https://github.com/tanRdev/pi-desktop/actions/runs/30301066095

The failures include a missing root-level effect dependency in integration tests and a terminal test requiring a pi CLI on the runner. However, public v0.9.3 assets still exist, so they were not produced by this workflow or any successful end-to-end run shown for the tag.

The current release verifier checks signing, notarization, stapling, and Gatekeeper, but does not launch the app or inspect the ASAR/module graph:

https://github.com/tanRdev/pi-desktop/blob/v0.9.3/scripts/verify-macos-release.mjs

Suggested actions

1. Mark or remove the current v0.9.3 macOS assets because the app cannot start.
2. Rebuild from a clean checkout in CI only after all source gates pass.
3. Before publishing, extract/inspect app.asar and fail on any zero-byte .js file or missing relative ESM import target.
4. Launch the signed packaged app in mock-agent mode as a release smoke test and verify that the main process remains alive.
5. Consider building the main process and agent session-server entry as independent bundles without cross-entry shared chunks.
6. Investigate the Vite 8/Rolldown chunking path. Rolldown has an open issue with the same general symptom—an empty chunk that remains imported: empty chunk generated and imported when using advancedChunks rolldown/rolldown#6677

Environment

• Pi Desktop 0.9.3 arm64 DMG from GitHub Releases
• macOS arm64