Skip to content

fix(desktop): bundle a single pi-ai copy so OAuth refresh works when packaged - #438

Merged
bubbleptr merged 1 commit into
mainfrom
fix/dedupe-pi-sdk-oauth
Oct 7, 2026
Merged

bubbleptr merged 1 commit into
mainfrom
fix/dedupe-pi-sdk-oauth

Conversation

@bubbleptr

@bubbleptr bubbleptr commented Oct 6, 2026 •

Copy link
Copy Markdown
Owner

Summary

  • Root cause: in the shipped v0.1.0, once an OAuth token expired, every request failed with OAuth refresh failed for radius: Cannot find module '.../app.asar/out/main/chunks/radius.js', and the UI showed it as "Provider authentication failed". With bun's isolated install, Pace's direct import of @earendil-works/pi-ai and pi-coding-agent's own pi-ai resolved to two different peer-hash copies (0.99.1+c02ada… vs 0.99.1+d95c98…). registerBunOAuthFlows() registered on copy A, which nothing reads, so rollup tree-shook the call entirely. Copy B's bundledLoaders was never assigned, so it fell back to the runtime import("./radius.js"), and that file is not in the asar. This hits every OAuth provider: Radius, Codex, ChatGPT, Copilot, OpenRouter, Kimi, Meta, xAI, Anthropic.
  • Reproduced by building v0.1.0 locally (bun install --frozen-lockfile). The OAuth loader in the output is identical line-for-line to the shipped asar, and there are 0 registration symbols.
  • Fix: dedupePiPackages() resolves every @earendil-works/* import as if pi-coding-agent made it, so the whole graph shares one copy per package. Package exports subpaths keep working.
  • Guard: assertSinglePiPackageCopy() fails the build if a Pi package is bundled from more than one directory, or if the OAuth loader registry is missing from the emitted code. The moduleId check alone does not catch the v0.1.0 failure, so the emitted-code markers are required. Confirmed on v0.1.0: the build fails without dedupe and passes with it.
  • Regression test: added to scripts/test-bundled-runtime.mjs, which runs in build:release. It sets up an expired Radius OAuth credential plus a mock gateway, prompts in the session process, and asserts: the refresh_token grant reaches the gateway, nothing says "Cannot find module", the chat request carries the new token, and auth.json is updated.

Test plan

  • With registerBunOAuthFlows() commented out, the new test fails with exactly the production error (red)
  • node --test scripts/test-bundled-runtime.mjs 4/4 (green)
  • bun run build / typecheck / lint

…packaged

bun's isolated install can give Pace's direct pi-ai import and
pi-coding-agent's pi-ai different peer-hash directories. In v0.1.0 the
registerBunOAuthFlows() call landed on the copy nobody read, rollup
tree-shook it, and pi-coding-agent's loaders fell back to a runtime
import("./radius.js") that does not exist in app.asar, so every expired
OAuth token (Radius, Codex, Copilot, ...) failed with "Cannot find module".

Resolve every @earendil-works import through pi-coding-agent so the graph
shares one copy, fail the build if a Pi package is duplicated or the OAuth
loader registry is tree-shaken out, and cover the refresh path end to end
in the shipped-bundle suite.
@bubbleptr
bubbleptr added this pull request to stack #440 October 6, 2026 20:45
@bubbleptr bubbleptr mentioned this pull request Oct 6, 2026
4 tasks done

@devin-ai-integration devin-ai-integration Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔍 Devin Review: 1 flag

Not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)

Devin Review

@bubbleptr
bubbleptr merged commit 5c17015 into main Oct 7, 2026
2 checks passed
@bubbleptr
bubbleptr deleted the fix/dedupe-pi-sdk-oauth branch October 7, 2026 04:14
@bubbleptr bubbleptr mentioned this pull request Oct 7, 2026
3 tasks done
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant