craft-native 0.0.185 → 0.0.187

package/dist/index.js

@@ -17,9 +17,8 @@ var __require = import.meta.require;
 
 // src/index.ts
 import { execFile as execFile2, spawn as spawn4 } from "child_process";
-import { mkdtempSync as mkdtempSync3, writeFileSync as writeFileSync3 } from "fs";
-import { tmpdir as tmpdir4 } from "os";
-import { join as join4 } from "path";
+import { writeFileSync as writeFileSync4 } from "fs";
+import { join as join5 } from "path";
 import { promisify as promisify2 } from "util";
 
 // src/binary-resolver.ts
@@ -58,11 +57,125 @@ function craftBinaryNotFoundMessage(triedPath) {
 `);
 }
 // package.json
-var version = "0.0.185";
+var version = "0.0.187";
 
 // src/sdk-version.ts
 var SDK_VERSION = version;
 
+// src/temp-dir.ts
+import { existsSync as existsSync2, mkdtempSync, readdirSync, rmSync, statSync, writeFileSync } from "fs";
+import { constants as osConstants, tmpdir } from "os";
+import { join } from "path";
+var OWNED_NAME = /^craft-(?:.+-)?p(\d+)-[A-Za-z0-9]{6}$/;
+var KEEP_MARKER = ".craft-keep";
+var SWEEP_MIN_AGE_MS = 60000;
+var SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];
+var live = new Set;
+var hooked = false;
+var swept = false;
+function removeQuietly(dir) {
+  try {
+    rmSync(dir, { recursive: true, force: true });
+  } catch {}
+}
+function removeAllTempDirs() {
+  for (const dir of live)
+    removeQuietly(dir);
+  live.clear();
+  unhook();
+}
+function onExit() {
+  for (const dir of live)
+    removeQuietly(dir);
+  live.clear();
+}
+function onSignal(signal) {
+  removeAllTempDirs();
+  if (process.listenerCount(signal) === 0)
+    process.exit(128 + (osConstants.signals[signal] ?? 1));
+}
+var signalHandlers = new Map(SIGNALS.map((signal) => [signal, () => onSignal(signal)]));
+function hook() {
+  if (hooked)
+    return;
+  hooked = true;
+  process.on("exit", onExit);
+  for (const [signal, handler] of signalHandlers) {
+    try {
+      process.on(signal, handler);
+    } catch {}
+  }
+}
+function unhook() {
+  if (!hooked)
+    return;
+  hooked = false;
+  process.off("exit", onExit);
+  for (const [signal, handler] of signalHandlers)
+    process.off(signal, handler);
+}
+function pidIsAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+function sweepOrphanedTempDirs(options = {}) {
+  const root = options.root ?? tmpdir();
+  const isAlive = options.isAlive ?? pidIsAlive;
+  const minAge = options.minAgeMs ?? SWEEP_MIN_AGE_MS;
+  const now = options.now ?? Date.now();
+  const removed = [];
+  let names;
+  try {
+    names = readdirSync(root);
+  } catch {
+    return removed;
+  }
+  for (const name of names) {
+    const match = OWNED_NAME.exec(name);
+    if (!match)
+      continue;
+    const pid = Number(match[1]);
+    if (pid === process.pid || isAlive(pid))
+      continue;
+    const path = join(root, name);
+    try {
+      if (now - statSync(path).mtimeMs < minAge)
+        continue;
+      if (existsSync2(join(path, KEEP_MARKER)))
+        continue;
+    } catch {
+      continue;
+    }
+    removeQuietly(path);
+    removed.push(path);
+  }
+  return removed;
+}
+function tempDirPrefix(label) {
+  const bare = label.replace(/^craft-/, "").replace(/-+$/, "");
+  return bare ? `craft-${bare}-p${process.pid}-` : `craft-p${process.pid}-`;
+}
+function createTempDir(label, root = tmpdir()) {
+  if (!swept) {
+    swept = true;
+    sweepOrphanedTempDirs({ root });
+  }
+  hook();
+  const dir = mkdtempSync(join(root, tempDirPrefix(label)));
+  live.add(dir);
+  return dir;
+}
+function removeTempDir(dir) {
+  removeQuietly(dir);
+  live.delete(dir);
+  if (live.size === 0)
+    unhook();
+}
+
 // src/package.ts
 import { spawn } from "child_process";
 import { createHash } from "crypto";
@@ -70,17 +183,16 @@ import {
   chmodSync,
   copyFileSync,
   cpSync,
-  existsSync as existsSync2,
+  existsSync as existsSync3,
   lstatSync,
   mkdirSync,
-  mkdtempSync,
   readFileSync,
-  readdirSync,
-  rmSync,
-  writeFileSync
+  readdirSync as readdirSync2,
+  rmSync as rmSync2,
+  writeFileSync as writeFileSync2
 } from "fs";
-import { homedir, tmpdir } from "os";
-import { basename, join } from "path";
+import { homedir } from "os";
+import { basename, join as join2 } from "path";
 import { deflateRawSync } from "zlib";
 var DEFAULT_DEB_DEPENDENCIES = ["libgtk-3-0", "libwebkit2gtk-4.1-37", "libnotify-bin"];
 var CRC32_TABLE = (() => {
@@ -165,12 +277,12 @@ function formatPackagingCommandError(tool, code, stdout, stderr) {
 }
 async function packageApp(config) {
   const results = [];
-  if (!config.binaryPath || !existsSync2(config.binaryPath)) {
+  if (!config.binaryPath || !existsSync3(config.binaryPath)) {
     throw new Error(`Binary not found: ${config.binaryPath}`);
   }
   const platforms = config.platforms || [detectPlatform()];
-  const outDir = config.outDir || join(process.cwd(), "dist");
-  if (!existsSync2(outDir)) {
+  const outDir = config.outDir || join2(process.cwd(), "dist");
+  if (!existsSync3(outDir)) {
     mkdirSync(outDir, { recursive: true });
   }
   for (const platform of platforms) {
@@ -193,7 +305,7 @@ async function packageMacOS(config, outDir) {
   const { name, version: version2, bundleId = `com.myapp.${name.toLowerCase()}` } = config;
   const opts = config.macos || {};
   const hardenedRuntime = !opts.appStore;
-  const appBundlePath = join(outDir, `${name}.app`);
+  const appBundlePath = join2(outDir, `${name}.app`);
   const appBundle = createMacOSAppBundle({
     name,
     version: version2,
@@ -240,7 +352,7 @@ async function packageMacOS(config, outDir) {
   }
   results.push({ success: true, platform: "macos", format: "app", outputPath: appBundlePath });
   if (opts.dmg !== false) {
-    const outputPath = join(outDir, `${name}-${version2}.dmg`);
+    const outputPath = join2(outDir, `${name}-${version2}.dmg`);
     const dmgResult = await createDMG({ appBundlePath, outputPath, volumeName: name });
     results.push({
       success: dmgResult.success,
@@ -253,7 +365,7 @@ async function packageMacOS(config, outDir) {
       results.push(...await notarizeIfRequested(opts, outputPath, "dmg"));
   }
   if (opts.pkg || opts.appStore) {
-    const outputPath = join(outDir, `${name}-${version2}.pkg`);
+    const outputPath = join2(outDir, `${name}-${version2}.pkg`);
     const pkgResult = await createPKG({
       appBundlePath,
       outputPath,
@@ -311,7 +423,7 @@ async function packageWindows(config, outDir) {
       name,
       version: version2,
       binaryPath: config.binaryPath,
-      outputPath: join(outDir, `${name}-${version2}.msi`),
+      outputPath: join2(outDir, `${name}-${version2}.msi`),
       manufacturer: config.author || "Unknown",
       architecture: opts.architecture || windowsArchitecture(process.arch),
       additionalFiles: opts.additionalFiles,
@@ -335,7 +447,7 @@ async function packageWindows(config, outDir) {
       manufacturer: config.author || "Unknown",
       binaryPath: config.binaryPath,
       additionalFiles: opts.additionalFiles,
-      outputPath: join(outDir, `${name}-${version2}-windows.zip`)
+      outputPath: join2(outDir, `${name}-${version2}-windows.zip`)
     });
     results.push({
       success: zipResult.success,
@@ -356,7 +468,7 @@ async function packageLinux(config, outDir) {
       name,
       version: version2,
       binaryPath: config.binaryPath,
-      outputPath: join(outDir, `${name}_${version2}_amd64.deb`),
+      outputPath: join2(outDir, `${name}_${version2}_amd64.deb`),
       description: config.description || "",
       maintainer: config.author || "Unknown",
       dependencies: opts.debDependencies || [...DEFAULT_DEB_DEPENDENCIES],
@@ -376,7 +488,7 @@ async function packageLinux(config, outDir) {
       name,
       version: version2,
       binaryPath: config.binaryPath,
-      outputPath: join(outDir, `${name}-${version2}-1.x86_64.rpm`),
+      outputPath: join2(outDir, `${name}-${version2}-1.x86_64.rpm`),
       description: config.description || "",
       requires: opts.rpmDependencies || ["gtk3", "webkit2gtk3"]
     });
@@ -393,7 +505,7 @@ async function packageLinux(config, outDir) {
       name,
       version: version2,
       binaryPath: config.binaryPath,
-      outputPath: join(outDir, `${name}-${version2}-x86_64.AppImage`),
+      outputPath: join2(outDir, `${name}-${version2}-x86_64.AppImage`),
       iconPath: config.iconPath
     });
     results.push({
@@ -538,32 +650,32 @@ function notarytoolArguments(opts) {
 function createMacOSAppBundle(opts) {
   try {
     const { name, binaryPath, iconPath, provisioningProfile, additionalExecutables, outputPath } = opts;
-    const contents = join(outputPath, "Contents");
-    const macOS = join(contents, "MacOS");
+    const contents = join2(outputPath, "Contents");
+    const macOS = join2(contents, "MacOS");
     mkdirSync(macOS, { recursive: true });
-    mkdirSync(join(contents, "Resources"), { recursive: true });
-    copyFileSync(binaryPath, join(macOS, name));
-    chmodSync(join(macOS, name), 493);
+    mkdirSync(join2(contents, "Resources"), { recursive: true });
+    copyFileSync(binaryPath, join2(macOS, name));
+    chmodSync(join2(macOS, name), 493);
     for (const executable of additionalExecutables || []) {
-      if (!existsSync2(executable))
+      if (!existsSync3(executable))
         return { success: false, error: `Additional executable not found: ${executable}` };
-      const destination = join(macOS, basename(executable));
+      const destination = join2(macOS, basename(executable));
       copyFileSync(executable, destination);
       chmodSync(destination, 493);
     }
     let iconName;
     if (iconPath) {
-      if (!existsSync2(iconPath))
+      if (!existsSync3(iconPath))
         return { success: false, error: `Icon not found: ${iconPath}` };
       iconName = basename(iconPath).replace(/\.icns$/i, "");
-      copyFileSync(iconPath, join(contents, "Resources", `${iconName}.icns`));
+      copyFileSync(iconPath, join2(contents, "Resources", `${iconName}.icns`));
     }
     if (provisioningProfile) {
-      if (!existsSync2(provisioningProfile))
+      if (!existsSync3(provisioningProfile))
         return { success: false, error: `Provisioning profile not found: ${provisioningProfile}` };
-      copyFileSync(provisioningProfile, join(contents, "embedded.provisionprofile"));
+      copyFileSync(provisioningProfile, join2(contents, "embedded.provisionprofile"));
     }
-    writeFileSync(join(contents, "Info.plist"), macOSInfoPlist({ ...opts, iconName }));
+    writeFileSync2(join2(contents, "Info.plist"), macOSInfoPlist({ ...opts, iconName }));
     return { success: true };
   } catch (error) {
     return { success: false, error: error.message };
@@ -574,7 +686,7 @@ function pathContentBytes(path) {
   const stat = lstatSync(path);
   if (!stat.isDirectory())
     return stat.size;
-  return readdirSync(path).reduce((total, entry) => total + pathContentBytes(join(path, entry)), 0);
+  return readdirSync2(path).reduce((total, entry) => total + pathContentBytes(join2(path, entry)), 0);
 }
 function dmgCapacityMegabytes(contentBytes) {
   if (!Number.isSafeInteger(contentBytes) || contentBytes < 0)
@@ -637,7 +749,7 @@ async function createDMG(opts) {
     if (!shouldRetryHdiutil(result.error, attempt))
       return { success: false, error: failures.join(`
 `) };
-    rmSync(opts.outputPath, { force: true });
+    rmSync2(opts.outputPath, { force: true });
     await new Promise((resolve) => setTimeout(resolve, attempt * 2000));
   }
   return { success: false, error: failures.join(`
@@ -695,16 +807,16 @@ async function createPKG(opts) {
     }));
     return built.success ? { success: true, outputPath: opts.outputPath } : { success: false, error: built.error };
   }
-  const tempDir = mkdtempSync(join(tmpdir(), "craft-pkg-"));
+  const tempDir = createTempDir("craft-pkg-");
   try {
-    const root = join(tempDir, "root");
-    const appsDir = join(root, "Applications");
+    const root = join2(tempDir, "root");
+    const appsDir = join2(root, "Applications");
     mkdirSync(appsDir, { recursive: true, mode: 493 });
     chmodSync(root, 493);
     const bundleName = basename(opts.appBundlePath);
-    cpSync(opts.appBundlePath, join(appsDir, bundleName), { recursive: true });
-    const componentPlistPath = join(tempDir, "component.plist");
-    writeFileSync(componentPlistPath, pkgbuildComponentPlist(`Applications/${bundleName}`));
+    cpSync(opts.appBundlePath, join2(appsDir, bundleName), { recursive: true });
+    const componentPlistPath = join2(tempDir, "component.plist");
+    writeFileSync2(componentPlistPath, pkgbuildComponentPlist(`Applications/${bundleName}`));
     const built = await runTool("pkgbuild", pkgbuildArguments({
       root,
       componentPlistPath,
@@ -715,7 +827,7 @@ async function createPKG(opts) {
     }));
     return built.success ? { success: true, outputPath: opts.outputPath } : { success: false, error: built.error };
   } finally {
-    rmSync(tempDir, { recursive: true, force: true });
+    removeTempDir(tempDir);
   }
 }
 function xml(value) {
@@ -812,7 +924,7 @@ function windowsCompanionFiles(paths, executableName) {
     if (seen.has(name.toLowerCase()))
       throw new Error(`Duplicate Windows package file: ${name}`);
     seen.add(name.toLowerCase());
-    if (!existsSync2(path) || lstatSync(path).isDirectory())
+    if (!existsSync3(path) || lstatSync(path).isDirectory())
       throw new Error(`Windows companion file not found: ${path}`);
     return { path, name };
   });
@@ -835,18 +947,18 @@ function runCommand(command, args, cwd) {
   });
 }
 async function createMSI(opts) {
-  const tempDir = mkdtempSync(join(tmpdir(), "craft-msi-"));
+  const tempDir = createTempDir("craft-msi-");
   try {
     const binaryName = windowsExecutableName(opts.name);
     const additionalFiles = windowsCompanionFiles(opts.additionalFiles, binaryName);
-    const sourcePath = join(tempDir, binaryName);
-    const wxsPath = join(tempDir, "installer.wxs");
-    const wixobjPath = join(tempDir, "installer.wixobj");
+    const sourcePath = join2(tempDir, binaryName);
+    const wxsPath = join2(tempDir, "installer.wxs");
+    const wixobjPath = join2(tempDir, "installer.wixobj");
     copyFileSync(opts.binaryPath, sourcePath);
-    writeFileSync(join(tempDir, WINDOWS_NOTIFICATION_ID_FILE), windowsNotificationAppId(opts.name, opts.manufacturer));
+    writeFileSync2(join2(tempDir, WINDOWS_NOTIFICATION_ID_FILE), windowsNotificationAppId(opts.name, opts.manufacturer));
     for (const file of additionalFiles)
-      copyFileSync(file.path, join(tempDir, file.name));
-    writeFileSync(wxsPath, renderWixSource(opts, binaryName, additionalFiles.map((file) => file.name)));
+      copyFileSync(file.path, join2(tempDir, file.name));
+    writeFileSync2(wxsPath, renderWixSource(opts, binaryName, additionalFiles.map((file) => file.name)));
     await runCommand("candle.exe", candleArguments(opts.architecture, wixobjPath, wxsPath), tempDir);
     await runCommand("light.exe", ["-nologo", "-sval", "-out", opts.outputPath, wixobjPath], tempDir);
     if (opts.certificatePath) {
@@ -863,7 +975,7 @@ async function createMSI(opts) {
     const missingTool = /ENOENT|not found/i.test(message);
     return { success: false, error: missingTool ? `WiX Toolset not found: ${message}` : message };
   } finally {
-    rmSync(tempDir, { recursive: true, force: true });
+    removeTempDir(tempDir);
   }
 }
 async function createZIP(opts) {
@@ -875,7 +987,7 @@ async function createZIP(opts) {
     for (const file of additionalFiles)
       entries.push({ name: file.name, data: new Uint8Array(readFileSync(file.path)) });
     const zip = buildZip(entries);
-    writeFileSync(opts.outputPath, zip);
+    writeFileSync2(opts.outputPath, zip);
     return { success: true, outputPath: opts.outputPath };
   } catch (err) {
     return { success: false, error: `Failed to write ZIP: ${err.message}` };
@@ -883,6 +995,7 @@ async function createZIP(opts) {
 }
 async function createDEB(opts) {
   return new Promise((resolve) => {
+    let staging;
     try {
       const sanitizedName = opts.name.toLowerCase();
       const safeDebName = /^[a-z0-9._+-]+$/;
@@ -905,16 +1018,17 @@ async function createDEB(opts) {
         }
       }
       const desktopContent = linuxDesktopEntry(opts.name, sanitizedName, opts.urlSchemes, opts.launchUrl);
-      const tempDir = mkdtempSync(join(tmpdir(), "craft-deb-"));
-      const debianDir = join(tempDir, "DEBIAN");
-      const binDir = join(tempDir, "usr", "bin");
-      const applicationsDir = join(tempDir, "usr", "share", "applications");
+      const tempDir = createTempDir("craft-deb-");
+      staging = tempDir;
+      const debianDir = join2(tempDir, "DEBIAN");
+      const binDir = join2(tempDir, "usr", "bin");
+      const applicationsDir = join2(tempDir, "usr", "share", "applications");
       mkdirSync(debianDir, { recursive: true });
       mkdirSync(binDir, { recursive: true });
       mkdirSync(applicationsDir, { recursive: true });
       const binaryName = sanitizedName;
-      copyFileSync(opts.binaryPath, join(binDir, binaryName));
-      chmodSync(join(binDir, binaryName), 493);
+      copyFileSync(opts.binaryPath, join2(binDir, binaryName));
+      chmodSync(join2(binDir, binaryName), 493);
       const controlContent = `Package: ${sanitizedName}
 Version: ${opts.version}
 Section: utils
@@ -924,11 +1038,11 @@ Depends: ${opts.dependencies.join(", ")}
 Maintainer: ${maintainer}
 Description: ${description || opts.name}
 `;
-      writeFileSync(join(debianDir, "control"), controlContent);
-      writeFileSync(join(applicationsDir, `${binaryName}.desktop`), desktopContent);
+      writeFileSync2(join2(debianDir, "control"), controlContent);
+      writeFileSync2(join2(applicationsDir, `${binaryName}.desktop`), desktopContent);
       const proc = spawn("dpkg-deb", ["--build", tempDir, opts.outputPath]);
       proc.on("close", (code) => {
-        rmSync(tempDir, { recursive: true, force: true });
+        removeTempDir(tempDir);
         if (code === 0) {
           resolve({ success: true, outputPath: opts.outputPath });
         } else {
@@ -936,10 +1050,12 @@ Description: ${description || opts.name}
         }
       });
       proc.on("error", (err) => {
-        rmSync(tempDir, { recursive: true, force: true });
+        removeTempDir(tempDir);
         resolve({ success: false, error: err.message });
       });
     } catch (error) {
+      if (staging)
+        removeTempDir(staging);
       resolve({ success: false, error: error.message });
     }
   });
@@ -947,11 +1063,11 @@ Description: ${description || opts.name}
 async function createRPM(opts) {
   return new Promise((resolve) => {
     try {
-      const buildRoot = join(homedir(), "rpmbuild");
-      const specDir = join(buildRoot, "SPECS");
-      const sourcesDir = join(buildRoot, "SOURCES");
-      const buildDir = join(buildRoot, "BUILD");
-      const rpmsDir = join(buildRoot, "RPMS");
+      const buildRoot = join2(homedir(), "rpmbuild");
+      const specDir = join2(buildRoot, "SPECS");
+      const sourcesDir = join2(buildRoot, "SOURCES");
+      const buildDir = join2(buildRoot, "BUILD");
+      const rpmsDir = join2(buildRoot, "RPMS");
       mkdirSync(specDir, { recursive: true });
       mkdirSync(sourcesDir, { recursive: true });
       mkdirSync(buildDir, { recursive: true });
@@ -975,7 +1091,7 @@ async function createRPM(opts) {
         }
         return r;
       }).join(", ");
-      copyFileSync(opts.binaryPath, join(sourcesDir, sanitizedName));
+      copyFileSync(opts.binaryPath, join2(sourcesDir, sanitizedName));
       const specContent = `Name: ${sanitizedName}
 Version: ${opts.version}
 Release: 1%{?dist}
@@ -993,13 +1109,13 @@ install -m 755 %{SOURCE0} %{buildroot}/usr/bin/${sanitizedName}
 %files
 /usr/bin/${sanitizedName}
 `;
-      const specPath = join(specDir, `${opts.name.toLowerCase()}.spec`);
-      writeFileSync(specPath, specContent);
+      const specPath = join2(specDir, `${opts.name.toLowerCase()}.spec`);
+      writeFileSync2(specPath, specContent);
       const proc = spawn("rpmbuild", ["-bb", specPath]);
       proc.on("close", (code) => {
         if (code === 0) {
           const rpmName = `${opts.name.toLowerCase()}-${opts.version}-1.x86_64.rpm`;
-          const builtRpmPath = join(rpmsDir, "x86_64", rpmName);
+          const builtRpmPath = join2(rpmsDir, "x86_64", rpmName);
           try {
             copyFileSync(builtRpmPath, opts.outputPath);
             resolve({ success: true, outputPath: opts.outputPath });
@@ -1020,24 +1136,26 @@ install -m 755 %{SOURCE0} %{buildroot}/usr/bin/${sanitizedName}
 }
 async function createAppImage(opts) {
   return new Promise((resolve) => {
+    let staging;
     try {
-      const appDir = mkdtempSync(join(tmpdir(), "craft-appimage-"));
-      const appDirPath = join(appDir, `${opts.name}.AppDir`);
-      const binDir = join(appDirPath, "usr", "bin");
-      const shareDir = join(appDirPath, "usr", "share");
+      const appDir = createTempDir("craft-appimage-");
+      staging = appDir;
+      const appDirPath = join2(appDir, `${opts.name}.AppDir`);
+      const binDir = join2(appDirPath, "usr", "bin");
+      const shareDir = join2(appDirPath, "usr", "share");
       mkdirSync(binDir, { recursive: true });
       mkdirSync(shareDir, { recursive: true });
       const binaryName = opts.name.toLowerCase();
-      copyFileSync(opts.binaryPath, join(binDir, binaryName));
-      chmodSync(join(binDir, binaryName), 493);
+      copyFileSync(opts.binaryPath, join2(binDir, binaryName));
+      chmodSync(join2(binDir, binaryName), 493);
       const appRunContent = `#!/bin/bash
 SELF=$(readlink -f "$0")
 HERE=\${SELF%/*}
 export PATH="\${HERE}/usr/bin/:\${PATH}"
 exec "\${HERE}/usr/bin/${binaryName}" "$@"
 `;
-      writeFileSync(join(appDirPath, "AppRun"), appRunContent);
-      chmodSync(join(appDirPath, "AppRun"), 493);
+      writeFileSync2(join2(appDirPath, "AppRun"), appRunContent);
+      chmodSync(join2(appDirPath, "AppRun"), 493);
       const desktopContent = `[Desktop Entry]
 Type=Application
 Name=${opts.name}
@@ -1046,9 +1164,9 @@ Terminal=false
 Categories=Utility;
 Icon=${binaryName}
 `;
-      writeFileSync(join(appDirPath, `${binaryName}.desktop`), desktopContent);
-      if (opts.iconPath && existsSync2(opts.iconPath)) {
-        copyFileSync(opts.iconPath, join(appDirPath, `${binaryName}.png`));
+      writeFileSync2(join2(appDirPath, `${binaryName}.desktop`), desktopContent);
+      if (opts.iconPath && existsSync3(opts.iconPath)) {
+        copyFileSync(opts.iconPath, join2(appDirPath, `${binaryName}.png`));
       } else {
         const placeholderPng = Buffer.from([
           137,
@@ -1121,13 +1239,13 @@ Icon=${binaryName}
           96,
           130
         ]);
-        writeFileSync(join(appDirPath, `${binaryName}.png`), placeholderPng);
+        writeFileSync2(join2(appDirPath, `${binaryName}.png`), placeholderPng);
       }
       const proc = spawn("appimagetool", [appDirPath, opts.outputPath], {
         env: { ...process.env, ARCH: "x86_64" }
       });
       proc.on("close", (code) => {
-        rmSync(appDir, { recursive: true, force: true });
+        removeTempDir(appDir);
         if (code === 0) {
           chmodSync(opts.outputPath, 493);
           resolve({ success: true, outputPath: opts.outputPath });
@@ -1136,10 +1254,12 @@ Icon=${binaryName}
         }
       });
       proc.on("error", (err) => {
-        rmSync(appDir, { recursive: true, force: true });
+        removeTempDir(appDir);
         resolve({ success: false, error: `appimagetool not found: ${err.message}` });
       });
     } catch (error) {
+      if (staging)
+        removeTempDir(staging);
       resolve({ success: false, error: error.message });
     }
   });
@@ -9996,18 +10116,17 @@ __export(exports_updater, {
   DeltaGenerator: () => DeltaGenerator,
   AutoUpdater: () => AutoUpdater
 });
-import { createReadStream, createWriteStream, existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmdirSync, rmSync as rmSync3, statSync as statSync2, unlinkSync, writeFileSync as writeFileSync2 } from "fs";
-import { join as join3, basename as basename3, dirname as dirname2 } from "path";
-import { tmpdir as tmpdir3 } from "os";
+import { createReadStream, createWriteStream, existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmdirSync, statSync as statSync3, unlinkSync, writeFileSync as writeFileSync3 } from "fs";
+import { join as join4, basename as basename3, dirname as dirname2 } from "path";
+import { tmpdir as tmpdir2 } from "os";
 import { execFileSync as execFileSync2, spawn as spawn3 } from "child_process";
 import { createHash as createHash2 } from "crypto";
 import { EventEmitter as EventEmitter3 } from "events";
 
 // src/updater/macos-bundle.ts
 import { execFile, execFileSync } from "child_process";
-import { accessSync, constants, existsSync as existsSync3, mkdtempSync as mkdtempSync2, renameSync, rmSync as rmSync2, statSync } from "fs";
-import { tmpdir as tmpdir2 } from "os";
-import { basename as basename2, dirname, join as join2 } from "path";
+import { accessSync, constants, existsSync as existsSync4, renameSync, rmSync as rmSync3, statSync as statSync2 } from "fs";
+import { basename as basename2, dirname, join as join3 } from "path";
 import { promisify } from "util";
 var execFileAsync = promisify(execFile);
 function isMacOS() {
@@ -10045,7 +10164,7 @@ ${e.stdout ?? ""}`;
 async function verifyBundleTrust(appPath, policy = {}) {
   const identity = await readBundleIdentity(appPath);
   const requireNotarized = policy.requireNotarized ?? true;
-  if (!existsSync3(appPath)) {
+  if (!existsSync4(appPath)) {
     return { ok: false, identity, gatekeeperSource: null, reason: "unreadable", detail: `No such bundle: ${appPath}` };
   }
   try {
@@ -10104,17 +10223,19 @@ function findTopLevelApp(root) {
   return parts[0] ?? null;
 }
 async function extractBundleFromDmg(dmgPath, stagingDir) {
-  const staging = stagingDir ?? mkdtempSync2(join2(tmpdir2(), "craft-update-"));
-  const mountPoint = mkdtempSync2(join2(tmpdir2(), "craft-mount-"));
+  const staging = stagingDir ?? createTempDir("craft-update-");
+  const mountPoint = createTempDir("craft-mount-");
   let mounted = false;
+  let staged = false;
   try {
     await execFileAsync("hdiutil", ["attach", dmgPath, "-nobrowse", "-readonly", "-mountpoint", mountPoint]);
     mounted = true;
     const source = findTopLevelApp(mountPoint);
     if (!source)
       throw new Error(`No .app found in disk image: ${dmgPath}`);
-    const appPath = join2(staging, basename2(source));
+    const appPath = join3(staging, basename2(source));
     await dittoBundle(source, appPath);
+    staged = true;
     return { appPath, stagingDir: staging };
   } finally {
     if (mounted) {
@@ -10122,19 +10243,25 @@ async function extractBundleFromDmg(dmgPath, stagingDir) {
         await execFileAsync("hdiutil", ["detach", mountPoint, "-force"]);
       } catch {}
     }
-    try {
-      rmSync2(mountPoint, { recursive: true, force: true });
-    } catch {}
+    removeTempDir(mountPoint);
+    if (!staged && !stagingDir)
+      removeTempDir(staging);
   }
 }
 async function extractBundleFromZip(zipPath, stagingDir) {
-  const staging = stagingDir ?? mkdtempSync2(join2(tmpdir2(), "craft-update-"));
-  const unpacked = join2(staging, "payload");
-  await execFileAsync("ditto", ["-x", "-k", zipPath, unpacked]);
-  const source = findTopLevelApp(unpacked);
-  if (!source)
-    throw new Error(`No .app found in archive: ${zipPath}`);
-  return { appPath: source, stagingDir: staging };
+  const staging = stagingDir ?? createTempDir("craft-update-");
+  const unpacked = join3(staging, "payload");
+  try {
+    await execFileAsync("ditto", ["-x", "-k", zipPath, unpacked]);
+    const source = findTopLevelApp(unpacked);
+    if (!source)
+      throw new Error(`No .app found in archive: ${zipPath}`);
+    return { appPath: source, stagingDir: staging };
+  } catch (error) {
+    if (!stagingDir)
+      removeTempDir(staging);
+    throw error;
+  }
 }
 async function extractBundle(archivePath, stagingDir) {
   if (archivePath.endsWith(".dmg"))
@@ -10144,18 +10271,18 @@ async function extractBundle(archivePath, stagingDir) {
   throw new Error(`Cannot extract an app bundle from ${archivePath}`);
 }
 async function swapBundle(stagedPath, installedPath) {
-  if (!existsSync3(stagedPath))
+  if (!existsSync4(stagedPath))
     throw new Error(`Staged bundle is missing: ${stagedPath}`);
   const parent = dirname(installedPath);
   const stamp = `${Date.now()}.${process.pid}`;
-  const incoming = join2(parent, `.${basename2(installedPath)}.${stamp}.incoming`);
-  const retired = join2(parent, `.${basename2(installedPath)}.${stamp}.retired`);
+  const incoming = join3(parent, `.${basename2(installedPath)}.${stamp}.incoming`);
+  const retired = join3(parent, `.${basename2(installedPath)}.${stamp}.retired`);
   try {
     renameSync(stagedPath, incoming);
   } catch {
     await dittoBundle(stagedPath, incoming);
   }
-  const hadPrevious = existsSync3(installedPath);
+  const hadPrevious = existsSync4(installedPath);
   try {
     if (hadPrevious)
       renameSync(installedPath, retired);
@@ -10171,13 +10298,13 @@ async function swapBundle(stagedPath, installedPath) {
     }
   } catch (error) {
     try {
-      rmSync2(incoming, { recursive: true, force: true });
+      rmSync3(incoming, { recursive: true, force: true });
     } catch {}
     throw error;
   }
   if (hadPrevious) {
     try {
-      rmSync2(retired, { recursive: true, force: true });
+      rmSync3(retired, { recursive: true, force: true });
       return { previousPath: null };
     } catch {
       return { previousPath: retired };
@@ -10189,8 +10316,8 @@ function canReplaceBundle(installedPath) {
   try {
     const parent = dirname(installedPath);
     accessSync(parent, constants.W_OK);
-    if (existsSync3(installedPath))
-      statSync(installedPath);
+    if (existsSync4(installedPath))
+      statSync2(installedPath);
     return true;
   } catch {
     return false;
@@ -10229,7 +10356,7 @@ class AutoUpdater extends EventEmitter3 {
   downloadDir() {
     if (this.config.downloadDir)
       return this.config.downloadDir;
-    return join3(tmpdir3(), "craft-updates", basename3(this.config.appPath) || "app");
+    return join4(tmpdir2(), "craft-updates", basename3(this.config.appPath) || "app");
   }
   getLastError() {
     return this.lastError;
@@ -10330,7 +10457,7 @@ class AutoUpdater extends EventEmitter3 {
     const downloadDir = this.downloadDir();
     mkdirSync2(downloadDir, { recursive: true });
     const fileName = basename3(url);
-    this.downloadPath = join3(downloadDir, fileName);
+    this.downloadPath = join4(downloadDir, fileName);
     try {
       const response = await fetch(url);
       if (!response.ok) {
@@ -10393,11 +10520,11 @@ class AutoUpdater extends EventEmitter3 {
         throw new Error("Download verification failed: hash mismatch");
       }
       if (deltaUpdate) {
-        if (!statSync2(this.config.appPath).isFile()) {
+        if (!statSync3(this.config.appPath).isFile()) {
           throw new Error("Delta updates require appPath to point to the installed bundle file");
         }
         const patchPath = this.downloadPath;
-        const reconstructedPath = join3(downloadDir, `reconstructed-${basename3(platformUpdate.url)}`);
+        const reconstructedPath = join4(downloadDir, `reconstructed-${basename3(platformUpdate.url)}`);
         await DeltaGenerator.apply(this.config.appPath, patchPath, reconstructedPath);
         const reconstructedHash = await this.computeFileHash(reconstructedPath);
         if (reconstructedHash !== platformUpdate.sha256) {
@@ -10435,7 +10562,7 @@ class AutoUpdater extends EventEmitter3 {
     }
   }
   async installUpdate(restartAfter = true) {
-    if (!this.downloadPath || !existsSync4(this.downloadPath)) {
+    if (!this.downloadPath || !existsSync5(this.downloadPath)) {
       throw new Error("No update downloaded");
     }
     if (this.updateInfo) {
@@ -10479,7 +10606,7 @@ class AutoUpdater extends EventEmitter3 {
           await this.installLinuxUpdate();
           break;
       }
-      if (this.downloadPath && existsSync4(this.downloadPath)) {
+      if (this.downloadPath && existsSync5(this.downloadPath)) {
         unlinkSync(this.downloadPath);
       }
       try {
@@ -10519,9 +10646,7 @@ class AutoUpdater extends EventEmitter3 {
         leftoverPath: previousPath
       });
     } finally {
-      try {
-        rmSync3(staged.stagingDir, { recursive: true, force: true });
-      } catch {}
+      removeTempDir(staged.stagingDir);
     }
   }
   async assertBundleTrusted(bundlePath) {
@@ -10682,7 +10807,7 @@ class DeltaGenerator {
   static async generate(oldPath, newPath, outputPath) {
     try {
       execFileSync2("bsdiff", [oldPath, newPath, outputPath]);
-      const stats = statSync2(outputPath);
+      const stats = statSync3(outputPath);
       const hash = await DeltaGenerator.computeHash(outputPath);
       return {
         size: stats.size,
@@ -10690,7 +10815,7 @@ class DeltaGenerator {
       };
     } catch {
       execFileSync2("xdelta3", ["-e", "-s", oldPath, newPath, outputPath]);
-      const stats = statSync2(outputPath);
+      const stats = statSync3(outputPath);
       const hash = await DeltaGenerator.computeHash(outputPath);
       return {
         size: stats.size,
@@ -10804,7 +10929,7 @@ ${update.releaseNotes}`);
         releaseDate: new Date().toISOString(),
         platforms: {}
       };
-      writeFileSync2(outputPath, JSON.stringify(manifest, null, 2));
+      writeFileSync3(outputPath, JSON.stringify(manifest, null, 2));
       console.log(`Manifest generated: ${outputPath}`);
       console.log("Edit the file to add platform-specific update URLs");
       break;
@@ -10892,6 +11017,7 @@ function detectDevMode() {
 class CraftApp {
   process;
   config;
+  sidebarConfigDir;
   constructor(config = {}) {
     if (config.window?.width !== undefined && (config.window.width < 100 || config.window.width > 1e4)) {
       throw new Error(`Invalid window width: ${config.window.width}. Must be between 100 and 10000 pixels.`);
@@ -10928,8 +11054,15 @@ class CraftApp {
       throw new Error(`No content to display. Provide either html or url:
 ` + "  show(html, options) or loadURL(url, options)");
     }
+    this.removeSidebarConfig();
     const args = this.buildArgs();
-    const craftPath = await this.findCraftBinary();
+    let craftPath;
+    try {
+      craftPath = await this.findCraftBinary();
+    } catch (error) {
+      this.removeSidebarConfig();
+      throw error;
+    }
     probeBinaryVersion(craftPath);
     const quiet = this.config.quiet === true;
     this.process = spawn4(craftPath, args, {
@@ -10942,6 +11075,7 @@ class CraftApp {
     });
     return new Promise((resolve, reject) => {
       this.process?.on("error", (error) => {
+        this.removeSidebarConfig();
         if (error.code === "ENOENT") {
           reject(new Error(craftBinaryNotFoundMessage(craftPath)));
           return;
@@ -10959,6 +11093,7 @@ class CraftApp {
 ` + "  https://github.com/home-lang/craft/issues"));
       });
       this.process?.on("close", (code) => {
+        this.removeSidebarConfig();
         if (code === 0 || code === null) {
           resolve();
         } else {
@@ -10976,6 +11111,12 @@ class CraftApp {
       this.process.kill();
     }
   }
+  removeSidebarConfig() {
+    if (!this.sidebarConfigDir)
+      return;
+    removeTempDir(this.sidebarConfigDir);
+    this.sidebarConfigDir = undefined;
+  }
   buildArgs() {
     const args = [];
     const { window: window3, html, url, appName } = this.config;
@@ -11074,9 +11215,10 @@ class CraftApp {
         if (safeForArgv) {
           args.push("--sidebar-config", json);
         } else {
-          const dir = mkdtempSync3(join4(tmpdir4(), "craft-sidebar-"));
-          const path = join4(dir, "sidebar-config.json");
-          writeFileSync3(path, json, "utf-8");
+          const dir = createTempDir("craft-sidebar-");
+          this.sidebarConfigDir = dir;
+          const path = join5(dir, "sidebar-config.json");
+          writeFileSync4(path, json, "utf-8");
           args.push("--sidebar-config-file", path);
         }
       }