78:T2596,## The problem: no Electrobun app can ship on the Mac App Store Not "is awkward to ship" — **cannot launch at all**. Any Electrobun app signed with `com.apple.security.app-sandbox`, which the Mac App Store requires, dies during startup: ``` Sandbox: bun(20707) deny(1) mach-lookup com.apple.coreservices.launchservicesd _RegisterApplication(), unable to get application ASN from launchservicesd, and this application requires an ASN, so aborting. ``` Nothing in the tracker covers this, so I assume nobody has tried to put an Electrobun app in the App Store yet. The fix is one file. ## Root cause: AppKit **load order**, not process topology macOS hands an app its ASN while the bundle's main executable starts. A normally-built Cocoa app links AppKit at load time, so `_LSApplicationCheckIn` runs during dyld initialization while the launch context still exists — the process is *handed* its ASN and never performs a lookup. The launcher links no AppKit (`build.zig` has no framework linkage at all), so AppKit only arrives later, when the runtime `dlopen`s the native wrapper. By then the launch window has closed, `_RegisterApplication` has to ask `launchservicesd` for an ASN, and App Sandbox denies that mach-lookup. AppKit treats it as fatal. Outside the sandbox the lookup is permitted, which is why this has never surfaced. ## Reproduction — no Electrobun, no Bun, no Zig Two arms from the same two source files, differing in **one link flag on the main executable**. This is the whole bug in 30 lines.

repro.sh (verified on macOS 26.6.1, Apple silicon)

```bash #!/bin/bash set -euo pipefail cat > wrapper.m <<'EOF' #import __attribute__((visibility("default"))) int wrapper_start(void) { [NSApplication sharedApplication]; // needs an ASN [NSApp setActivationPolicy:NSApplicationActivationPolicyRegular]; return 0; } EOF cat > host.c <<'EOF' #include #include #include int main(void) { const char *home = getenv("HOME"); char p[1024]; snprintf(p, sizeof p, "%s/repro.log", home ? home : "/tmp"); FILE *f = fopen(p, "a"); if (!f) return 70; void *h = dlopen("@executable_path/libwrapper.dylib", RTLD_NOW); if (!h) { fprintf(f, "%s: dlopen failed\n", VARIANT); return 71; } int (*start)(void) = dlsym(h, "wrapper_start"); fprintf(f, "%s: before NSApplication\n", VARIANT); fflush(f); start(); fprintf(f, "%s: SURVIVED\n", VARIANT); fflush(f); fclose(f); return 0; } EOF cat > ent.plist <<'EOF' com.apple.security.app-sandbox com.apple.security.network.client com.apple.security.network.server com.apple.security.cs.allow-jit EOF build_arm() { # $1 = arm name, $2... = extra link flags for the MAIN executable local arm="$1"; shift local id="sh.example.lsrepro.$arm" app="out/$arm/Repro.app" rm -rf "out/$arm"; mkdir -p "$app/Contents/MacOS" rm -f "$HOME/Library/Containers/$id/Data/repro.log" 2>/dev/null || true xcrun clang -O2 -dynamiclib -framework Cocoa \ -install_name @executable_path/libwrapper.dylib \ -o "$app/Contents/MacOS/libwrapper.dylib" wrapper.m xcrun clang -O2 -DVARIANT="\"$arm\"" "$@" -o "$app/Contents/MacOS/host" host.c cat > "$app/Contents/Info.plist" < CFBundleExecutablehost CFBundleIdentifier$id CFBundlePackageTypeAPPL PLIST codesign --force --sign - "$app/Contents/MacOS/libwrapper.dylib" >/dev/null 2>&1 codesign --force --sign - --entitlements ent.plist "$app" >/dev/null 2>&1 open -n "$app"; sleep 3 echo "--- $arm : $(otool -L "$app/Contents/MacOS/host" | grep -c Cocoa) Cocoa load command(s)" cat "$HOME/Library/Containers/$id/Data/repro.log" 2>/dev/null || echo "(no log)" pkill -f "$app/Contents/MacOS" >/dev/null 2>&1 || true } build_arm no-cocoa build_arm with-cocoa -Wl,-needed_framework,Cocoa ```

``` --- no-cocoa : 0 Cocoa load command(s) no-cocoa: before NSApplication <- aborts here --- with-cocoa : 1 Cocoa load command(s) with-cocoa: before NSApplication with-cocoa: SURVIVED ``` ## Measured against Electrobun's own launcher I built the launcher from this branch's parent (`v1.18.4-beta.21`) with the pinned Zig 0.16.0, put the real binary in a sandboxed `.app` as `CFBundleExecutable`, and gave it a stand-in runtime that `dlopen`s a Cocoa-linked dylib and calls `NSApplication` — the same load-order shape as `bun` → `libElectrobunCore`. Ad-hoc signed, **shippable entitlements only**, fresh bundle id per run, two rounds: | Launcher | Cocoa linked | Process model | Result | |---|---|---|---| | upstream as-is | no | fork + wait | **abort**, `deny(1) mach-lookup ...launchservicesd` | | **this PR** | **yes** | **fork + wait** | **boots**, window visible, `NSApp` active, 0 denials | | exec-in-place only | no | `execve` in place | abort, same denial | | exec-in-place + Cocoa | yes | `execve` in place | boots | Then the same two-arm test against a **real Electrobun application bundle** — real `bun`, real `libNativeWrapper`, real `main.js`/`app.asar`, only the launcher binary swapped and the bundle id neutralised: ``` stock launcher -> deny(1) mach-lookup com.apple.coreservices.launchservicesd _RegisterApplication() ... so aborting. [no processes alive] patched launcher-> launcher(20751) + bun(20755) alive, zero launchservicesd denials ``` Rows 3 and 4 are there so nobody has to re-derive them. I first assumed the launcher also had to `execve` in place so the pid carried the registration into the runtime. **It does not.** Row 4 works but row 3 does not, and row 2 shows the Cocoa link alone is sufficient with the fork intact — so exec-in-place is neither necessary nor sufficient, and I dropped it. That matters, because exec-in-place would have cost you child supervision, exit-code propagation and the `SIGINT`/`SIGALRM` handling on macOS. ## What this changes `package/src/launcher/build.zig`, +17 lines, macOS only. ## What this does not change - **Nothing about the process model.** Still fork + wait, still supervises the child, still propagates exit codes, still runs `linux_dependencies.shouldDiagnoseChildExit`. No trade-off to weigh. - **Nothing off macOS.** The Linux and Windows launchers are *byte-identical* to upstream — I built both trees at `ReleaseSmall` for `x86_64-linux-gnu`, `aarch64-linux-gnu` and `x86_64-windows` and compared SHA-256; all three match. The macOS guard means `xcrun` is never invoked on other hosts. - **Nothing about `Updater`.** `applyUpdate`'s macOS relaunch (`open` from a detached shell polling `process.pid`) and `resolve(dirname(process.execPath), "..", "..")` behave exactly as before, since the topology is unchanged. - **Deployment target.** `LC_BUILD_VERSION minos` stays 14.0. Cost: one extra `LC_LOAD_DYLIB`, +32 bytes, and ~2 ms of AppKit load at launch (30-run mean, 4.3 ms → 6.3 ms for the launcher process itself). ## Deliberately not using the temporary exception `com.apple.security.temporary-exception.mach-lookup.global-name` also makes the error go away. It is not in this PR and should not be suggested: apps using it get rejected under App Review Guideline 2.4.5(i) (see AvaloniaUI/Avalonia#6529). A workaround that guarantees rejection does not unlock the App Store. ## Build requirement Linking a framework needs the macOS SDK, resolved via `std.zig.system.darwin.getSdk` (`xcrun --show-sdk-path`) — already a hard dependency of the macOS build, which shells out to `xcrun --sdk macosx clang++` for the native wrapper. CI builds darwin on `macos-14`, so it is unaffected. Cross-compiling the launcher to macOS *from* a non-macOS host now needs an SDK and fails with an explicit message instead of a link error. ## Tests `zig build test` in `package/src/launcher` passes (I added none; the change is build-configuration only). As far as I can tell CI never runs the launcher's Zig tests. If you want a guard so this line cannot be quietly dropped, the natural home is a Mach-O load-command assertion beside `verify-macho-code-signing` / `verify-macho-deployment-target` — say the word and I will add it rather than guessing at the shape. ## One remaining gap, for the record This fixes the launch gate only. A complete MAS submission also needs the child runtime signed with `com.apple.security.inherit` rather than the app's own entitlements, and `cli/index.ts` currently applies one entitlements file to every Mach-O it finds in `Contents/MacOS`. Out of scope here; happy to open an issue. ## Question, and honest expectation I can see that 1.x code PRs are generally triaged into 2.0 rather than merged, so the useful question is probably not "will you merge this": **Does the 2.0 launcher rewrite cover App Sandbox / Mac App Store distribution, and is the AppKit-link-order constraint already accounted for?** Knowing that is worth more to me than this merging. We are shipping a vendored patched launcher in the meantime, and if 2.0 lands with a different launcher I am happy to redo the work against it. Either way the repro above should save whoever hits this next a couple of days. 62:["$","$L75",null,{"entries":[{"key":["platform",{"userId":"anon"},"pulls","page",{"owner":"blackboardsh","repo":"electrobun","pullNumber":519}],"data":{"repositoryId":"322","detail":{"author":{"avatarUrl":"https://cdn.trylle.com/media/images/b57947e9f1584a42b83ef7b9140a1d76?key=AbnRvNGn%2BEMSz94fz2nQtZ3eTbXkKxg139hFZwyDYItY8OauaN7Fi6LS9lmOSEu36BL9rhDIoix54OtheHsh96EhiSkUkeWKzyY4n67x3NeaCR3hOci8CO%2BTlqLHHmXA4VDgX4Svc%2FLJPOTOkk%2FPzkNCtXXQV5uVRQbRHuIhcrCfNYTao0TImhj85yw%3D","externalProvider":"github","login":"arturs-fayns-eu","type":"User","url":"https://github.com/arturs-fayns-eu"},"authorId":"279209578","baseRefName":"main","closedAt":null,"comments":0,"createdAt":"2026-08-10T20:11:31Z","headRefName":"arturs-fayns-eu/fix/macos-app-sandbox-launch","id":"4784328","isDraft":false,"labels":[],"number":519,"repository":{"name":"electrobun","owner":"blackboardsh","provider":"forgejo"},"state":"open","title":"fix(launcher): link Cocoa on macOS so App Sandbox / Mac App Store builds can launch","updatedAt":"2026-08-10T20:11:31Z","url":"https://trylle.com/blackboardsh/electrobun/pulls/519","body":"$78","additions":17,"deletions":0,"changedFiles":1,"commits":1,"reviewComments":0,"headSha":"674d56274d5315f09968507e1afc06b5e6cb76dc","baseSha":"96eb7e77f47586c191140a14032edd2eac63d453","headRepoOwner":"blackboardsh","headRepoName":"electrobun","isMerged":false,"mergeCommitSha":null,"mergedBy":null,"mergeable":true,"mergeableState":"clean","conflictingFiles":null,"requestedTeams":[],"requestedReviewers":[],"graphqlId":"issue:519"},"comments":[],"commits":[{"sha":"674d56274d5315f09968507e1afc06b5e6cb76dc","message":"fix(launcher): link Cocoa on macOS so sandboxed apps can check in with LaunchServices\n\nApp Sandbox denies mach-lookup of com.apple.coreservices.launchservicesd, so an\napp must be checked in with LaunchServices during dyld initialization, while it\nstill holds its launch context. AppKit performs that check-in when it loads, but\nthe launcher links no AppKit and the runtime only meets it later through dlopen,\nwhich is past the launch window. _RegisterApplication then has to ask\nlaunchservicesd for an ASN, the sandbox denies the lookup, and AppKit aborts the\nprocess.\n\nLinking Cocoa into the bundle's main executable moves the check-in back inside\nthe launch window. The launcher never calls into Cocoa, so the framework is\nlinked as `needed` to keep the load command.\n\nmacOS only: the Linux and Windows launcher binaries are byte-identical to before.\n","createdAt":"2026-08-10T23:09:59+03:00","author":{"avatarUrl":"","login":"","name":"arturs-savickis","type":"User","url":""},"verification":{"verified":false,"reason":"gpg.error.not_signed_commit"}}],"events":[],"reviews":[],"stackEvents":[],"commentPagination":{"totalCount":0,"perPage":30,"loadedPages":[1]},"eventPagination":{"loadedPages":[1],"hasMore":false},"headRefDeleted":false},"fetchedAt":1793412625501}],"children":"$L79"}] 64:null 6b:[["$","title","0",{"children":"Commits · fix(launcher): link Cocoa on macOS so App Sandbox / Mac App Store builds can launch · blackboardsh/electrobun | Trylle"}],["$","meta","1",{"name":"description","content":"Commits on fix(launcher): link Cocoa on macOS so App Sandbox / Mac App Store builds can launch (#519) in blackboardsh/electrobun."}],["$","meta","2",{"name":"application-name","content":"Trylle"}],["$","link","3",{"rel":"manifest","href":"/manifest.json","crossOrigin":"$undefined"}],["$","meta","4",{"name":"keywords","content":"Commits · fix(launcher): link Cocoa on macOS so App Sandbox / Mac App Store builds can launch · blackboardsh/electrobun, blackboardsh/electrobun, blackboardsh/electrobun repository, electrobun, Zig repository, source code, trylle, agent-native git platform, git platform for agents and humans, git platform for ai agents, coding agent pull requests, ai code review, repository automation, stacked pull requests, two-way github sync, github-compatible actions, try cli"}],["$","meta","5",{"name":"robots","content":"index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1"}],["$","meta","6",{"name":"mobile-web-app-capable","content":"yes"}],["$","meta","7",{"name":"googlebot","content":"index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1"}],["$","meta","8",{"name":"twitter:domain","content":"trylle.com"}],["$","meta","9",{"name":"twitter:url","content":"https://trylle.com/blackboardsh/electrobun/pulls/519/commits"}],["$","link","10",{"rel":"canonical","href":"https://trylle.com/blackboardsh/electrobun/pulls/519/commits"}],["$","meta","11",{"name":"format-detection","content":"telephone=no"}],["$","meta","12",{"name":"mobile-web-app-capable","content":"yes"}],["$","meta","13",{"name":"apple-mobile-web-app-title","content":"Trylle"}],["$","meta","14",{"name":"apple-mobile-web-app-status-bar-style","content":"black-translucent"}],["$","meta","15",{"property":"og:title","content":"Commits · fix(launcher): link Cocoa on macOS so App Sandbox / Mac App Store builds can launch · blackboardsh/electrobun | Trylle"}],["$","meta","16",{"property":"og:description","content":"Commits on fix(launcher): link Cocoa on macOS so App Sandbox / Mac App Store builds can launch (#519) in blackboardsh/electrobun."}],["$","meta","17",{"property":"og:url","content":"https://trylle.com/blackboardsh/electrobun/pulls/519/commits"}],["$","meta","18",{"property":"og:site_name","content":"Trylle"}],["$","meta","19",{"property":"og:locale","content":"en_US"}],["$","meta","20",{"property":"og:image","content":"https://trylle.com/api/og.png?kind=repo&owner=blackboardsh&repo=electrobun"}],["$","meta","21",{"property":"og:image:secure_url","content":"https://trylle.com/api/og.png?kind=repo&owner=blackboardsh&repo=electrobun"}],["$","meta","22",{"property":"og:image:type","content":"image/png"}],["$","meta","23",{"property":"og:image:width","content":"1200"}],["$","meta","24",{"property":"og:image:height","content":"630"}],["$","meta","25",{"property":"og:image:alt","content":"blackboardsh/electrobun repository preview on Trylle"}],["$","meta","26",{"property":"og:type","content":"website"}],["$","meta","27",{"name":"twitter:card","content":"summary_large_image"}],["$","meta","28",{"name":"twitter:site","content":"@trylle"}],["$","meta","29",{"name":"twitter:title","content":"Commits · fix(launcher): link Cocoa on macOS so App Sandbox / Mac App Store builds can launch · blackboardsh/electrobun | Trylle"}],["$","meta","30",{"name":"twitter:description","content":"Commits on fix(launcher): link Cocoa on macOS so App Sandbox / Mac App Store builds can launch (#519) in blackboardsh/electrobun."}],["$","meta","31",{"name":"twitter:image","content":"https://trylle.com/api/og.png?kind=repo&owner=blackboardsh&repo=electrobun"}],["$","meta","32",{"name":"twitter:image:alt","content":"blackboardsh/electrobun repository preview on Trylle"}],"$L7a","$L7b","$L7c","$L7d"]

Commits on Mon, Aug 10, 2026