What causes "could not find laufey.app under {} to re-sign" in denoland/deno?

Treat it as a warning first: the install itself succeeded; only notification authorization may misbehave.

could not find laufey.app under

Error message

could not find laufey.app under {} to re-sign

What it means

After installing the downloaded laufey backend, deno best-effort re-signs laufey.app so each Mach-O's code-signing identifier matches the bundle's CFBundleIdentifier (otherwise macOS usernoted rejects notification authorization with UNErrorCodeNotificationsNotAllowed). This error says the expected laufey.app could not be located inside the install dir before any signing was attempted. Per the doc comment, failures on this path are logged, not fatal — desktop still works, minus notifications.

Solutions

Treat it as a warning first: the install itself succeeded; only notification authorization may misbehave.
Clear the laufey cache dir and re-run to rule out a truncated extraction.
List the cached archive to confirm whether laufey.app exists and where; if the layout changed, update deno to a build matching the pinned release.
File an issue with the archive listing so the locator is updated alongside the next pin bump.

Example fix

# before: warning at end of install
# [desktop] could not re-sign ... could not find laufey.app under ~/.cache/...

# after: refresh the cache and retry on macOS
rm -rf ~/.cache/deno/desktop/laufey/v1.2.3-aarch64-apple-darwin
deno desktop   # expect no re-sign warning

Defensive patterns

Strategy: fallback

Validate before calling

# After install, check the harmonization precondition yourself
find "$HOME/.cache/deno/desktop/laufey" -type d -name 'laufey.app' -print \
  | grep -q . || echo 'note: no laufey.app — notifications may not work'

Try / catch

The source already treats this as best-effort (logged, not fatal): mirror that by catching, logging 'notifications may be unavailable', and continuing the install; only investigate when the user actually needs notification authorization.

Prevention

Treat the warning as cosmetic first — most desktop features work without notifications.
After laufey version bumps, smoke-test that laufey.app still exists at the expected location inside the install dir.
Keep the cache clean so a truncated extraction cannot be mistaken for a layout change.

When it happens

Trigger: harmonize_cached_laufey_identifiers() runs locate_laufey_app_in_install() over the freshly extracted install dir and finds no laufey.app — archive layout changed upstream, or the backend for this target ships no .app (so harmonization is attempted only where it makes sense and this indicates a layout mismatch).

Common situations: A laufey release moved/renamed its .app inside the archive after a LAUFEY_VERSION bump; a truncated extraction dropped the bundle; running a non-macOS-backend artifact through the macOS path.

Related errors

AI-assisted analysis of denoland/deno@f7822238ca (2026-08-20). Data as JSON: /api/errors/7250a2f2ea4baa7f. Report an issue: GitHub.

Appendix: source

Thrown at cli/tools/desktop.rs:2812

  Ok(())
}

/// Re-sign the cached laufey.app's binaries so the running binary's
/// identifier matches its host bundle's `CFBundleIdentifier`. Run once
/// per fresh download; HMR mode runs laufey.app directly (no per-project
/// wrapper), so without this UN sees `Identifier=laufey` /
/// `CFBundleIdentifier=com.deno.desktop` and refuses notification
/// authorization. Best-effort: failures here are logged but don't
/// abort the install, since most desktop features still work without
/// notifications.
#[cfg(target_os = "macos")]
fn harmonize_cached_laufey_identifiers(
  install_dir: &Path,
  backend: &str,
) -> Result<(), AnyError> {
  let laufey_app = locate_laufey_app_in_install(install_dir, backend)
    .ok_or_else(|| {
      deno_core::anyhow::anyhow!(
        "could not find laufey.app under {} to re-sign",
        install_dir.display()
      )
    })?;
  harmonize_laufey_app_identifiers(&laufey_app)
}

/// Idempotently re-sign every Mach-O in `<laufey.app>/Contents/MacOS/` so
/// its code-signing identifier matches the bundle's `CFBundleIdentifier`.
/// macOS `usernoted` rejects UN authorization with
/// `UNErrorCodeNotificationsNotAllowed` when the running binary's
/// signed identifier disagrees with the bundle id ("Legacy client X
/// connecting to modern client" in the daemon log). The linker-signed
/// default for the laufey binary is `Identifier=laufey`, which never matches.
/// Safe to call on every launch — binaries already at the correct
/// identifier are skipped without a re-sign.
#[cfg(target_os = "macos")]
fn harmonize_laufey_app_identifiers(laufey_app: &Path) -> Result<(), AnyError> {

View on GitHub (pinned to f7822238ca)