@floless/app 0.6.1 → 0.6.3

package/launch.mjs

@@ -123,7 +123,11 @@ function startServerDetached() {
 }
 
 function openBrowser(url) {
-  if (isWin) spawn('cmd', ['/c', 'start', '', url], { windowsHide: true, detached: true }).unref();
+  // NO `detached` on Windows: Node #21825 makes `detached` defeat `windowsHide` for a CUI
+  // child (cmd.exe), flashing a console window. Without it, windowsHide hides cmd; `start`
+  // hands the URL to the browser via ShellExecute (independent of cmd's tree), so the browser
+  // still survives this launcher exiting. unref() keeps it from holding the event loop.
+  if (isWin) spawn('cmd', ['/c', 'start', '', url], { windowsHide: true }).unref();
   else spawn(process.platform === 'darwin' ? 'open' : 'xdg-open', [url], { detached: true }).unref();
 }
 
@@ -312,16 +316,32 @@ function enumerateProcesses() {
   }
 }
 
+// Build the `taskkill` argv for one pid. `tree` (default true) adds /T to also kill the
+// target's whole child-process tree — correct for teardown/uninstall, where the
+// supervisor's spawned --serve child must die WITH it. The update-apply path running
+// inside the SERVE passes tree:false: there the caller IS the supervisor's --serve child
+// (and the process that must survive to launch Update.exe), so a /T tree-kill of the
+// supervisor would also kill the caller itself. tree:false kills ONLY the supervisor and
+// lets the serve exit on its own. Pure + exported so the /T decision is unit-tested.
+export function taskkillArgs(pid, { tree = true } = {}) {
+  return tree ? ['/PID', String(pid), '/T', '/F'] : ['/PID', String(pid), '/F'];
+}
+
 // Kill the --supervise watchdog FIRST (Codex B1) so it can't respawn the server in
 // the gap before stopServer(). Matches THIS app's exe + the supervise action, never
 // process.pid (self-kill guard lives in supervisorPidsToKill). Idempotent; win32-only.
 //
+// `tree` (default true) tree-kills (/T) — teardown/uninstall, where the supervisor's
+// --serve child must die too. The update-apply path INSIDE the serve passes {tree:false}
+// (the serve is itself the supervisor's child and must survive to launch Update.exe, then
+// exit on its own) — see taskkillArgs above and index.ts /api/update/apply.
+//
 // SAFETY (review #1): in the npm channel process.execPath is the GENERIC node.exe, so
 // matching on it alone could kill ANY `node … supervise` process (e.g. a third-party
 // watchdog). When we detect that channel, also require the launcher script (this
 // launch.mjs) in the command line — our supervisor runs `node … launch.mjs supervise`.
 // The packaged exe (unique FlolessApp.exe) passes no scriptMatch — its match is exact.
-function killSupervisor() {
+export function killSupervisor({ tree = true } = {}) {
   if (!isWin) return;
   const isNpmChannel = /^node(\.exe)?$/i.test(basename(process.execPath));
   const scriptMatch = isNpmChannel ? basename(fileURLToPath(import.meta.url)) : undefined; // 'launch.mjs'
@@ -339,7 +359,7 @@ function killSupervisor() {
     log(`stopping supervisor (pid ${pid})…`);
     // execFileSync (no shell) with an argv array — pid is already Number()-coerced in
     // parseProcessList, and avoiding the shell rules out any injection entirely.
-    try { execFileSync('taskkill', ['/PID', String(pid), '/T', '/F'], { stdio: 'ignore', windowsHide: true }); } catch { /* already gone */ }
+    try { execFileSync('taskkill', taskkillArgs(pid, { tree }), { stdio: 'ignore', windowsHide: true }); } catch { /* already gone */ }
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floless/app",
-  "version": "0.6.1",
+  "version": "0.6.3",
   "type": "module",
   "description": "Thin localhost host for floless.app — serves web/ and shells the aware CLI. No engine, no LLM.",
   "bin": {