@stacksjs/defaults 0.73.2 → 0.74.0

package/ai/skills/stacks-desktop/SKILL.md

@@ -149,6 +149,62 @@ Application data belongs in `~/Library/Application Support/<AppName>`, never
 inside the bundle — `/Applications` is not writable by the user, and the bundle
 is replaced wholesale on update.
 
+## Helper processes: one binary, not three
+
+An app that owns its launcher usually needs more than the launcher — an agent
+serving on loopback, a worker doing something slow out of process. Compile each
+as its own binary and the bundle gets very large very quietly.
+
+`bun build --compile` embeds the entire Bun runtime in **every** executable it
+writes. `console.log("hi")` measures **60.5 MB**. So three binaries means three
+copies of the same runtime, and nothing says so — the bundle is simply big, and
+a big desktop app looks unremarkable. One real app shipped 230 MB this way, of
+which about 180 MB was the runtime repeated; its own code plus the native Craft
+runtime came to under 40 MB.
+
+Compile **one** binary and dispatch on a subcommand. The helpers stay separate
+*processes* — which is what actually matters for isolation and for killing one
+that wedges — they just stop being separate *files*.
+
+```ts
+// app/Desktop/launcher.ts — before anything else at module scope
+const subcommand = process.argv[2]
+
+if (subcommand === 'agent' || subcommand === 'scan') {
+  if (subcommand === 'agent') {
+    const { runAgent } = await import('./server')
+    await runAgent()
+  }
+  else {
+    const { runScannerCli } = await import('../Workers/scan')
+    await runScannerCli(process.argv[3] ?? '')
+  }
+
+  // Park. Everything below is the launcher, and a subcommand reaching it would
+  // spawn a second agent and open a second window.
+  await new Promise(() => {})
+}
+```
+
+Then spawn `process.execPath` instead of a sibling path:
+
+```ts
+const agent = Bun.spawn([process.execPath, 'agent'], { stdout: 'pipe' })
+```
+
+Two things that bite, both silently:
+
+- **The dispatch must come first.** A launcher's body is top-level code that
+  starts a server and opens a window as a side effect of loading.
+- **Do not `process.exit()` after starting a server.** A `runAgent()` that
+  returns once `Bun.serve` is listening has not finished — `Bun.serve` is what
+  holds the process open. Exiting after it kills the agent one line after it
+  printed the port the launcher is still waiting for, and the launcher reports
+  a timeout that says nothing about the cause.
+
+`buddy build:dmg` warns when a finished bundle contains more than one
+Bun-compiled executable, naming them and what the repetition costs.
+
 ## CLI Commands
 
 ```bash

package/app/Actions/Auth/GenerateTwoFactorSecretAction.ts

@@ -2,7 +2,6 @@ import { Action } from '@stacksjs/actions'
 import { generateTwoFactorSetup, stashPendingTwoFactorSecret } from '@stacksjs/auth'
 import { config } from '@stacksjs/config'
 import { response } from '@stacksjs/router'
-import { toSvg } from 'ts-qr-codes'
 
 export default new Action({
   name: 'GenerateTwoFactorSecretAction',
@@ -14,7 +13,11 @@ export default new Action({
       return response.unauthorized('Unauthorized')
 
     const appName = config.app?.name || 'Stacks'
-    const { secret, uri } = generateTwoFactorSetup(user.email ?? '', appName)
+
+    // `qr` is an SVG string of `uri`, rendered by @stacksjs/auth so an app that
+    // overrides this action still gets one. Clients that render their own QR
+    // code have `uri`; clients that offer manual entry have `secret`.
+    const { secret, uri, qr } = generateTwoFactorSetup(user.email ?? '', appName)
 
     // Not persisted to users.two_factor_secret until EnableTwoFactorAction
     // verifies a code produced from it — but stashed server-side now so
@@ -22,15 +25,6 @@ export default new Action({
     // two-factor.ts's doc comment for why.
     await stashPendingTwoFactorSecret(user.id as number, secret)
 
-    // Rendered here rather than left to the client. Every authenticator flow
-    // needs the URI as a QR code, and a caller that has to find its own
-    // encoder either ships one to the browser or, more often, falls back to
-    // asking the user to type a 32-character secret by hand.
-    //
-    // SVG so it stays sharp at any size and can be inlined into a page or an
-    // email; the URI is still returned for clients that render their own.
-    const qr = toSvg(uri, { size: 240, title: 'Two-factor authentication setup' })
-
     return response.json({ secret, uri, qr })
   },
 })

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.73.2",
+  "version": "0.74.0",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.73.2",
+  "version": "0.74.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -48,14 +48,14 @@
       "default": "./dist/*.js"
     }
   },
+  "scripts": {
+    "build": "bun build.ts"
+  },
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.27",
-    "@stacksjs/mobile": "^0.73.2",
+    "@stacksjs/mobile": "^0.74.0",
     "@stacksjs/sanitizer": "^0.2.113",
     "ts-qr-codes": "^0.1.8"
-  },
-  "scripts": {
-    "build": "bun build.ts"
   }
 }