gm-plugkit 2.0.1229 → 2.0.1231

package/bootstrap.js

@@ -7,6 +7,28 @@ const os = require('os');
 const crypto = require('crypto');
 const { spawn, spawnSync } = require('child_process');
 
+// Resolve a bare command name to its actual .exe on Windows. cmd.exe + .cmd
+// shim chains re-enter conhost (visible window flash) even with
+// windowsHide:true on the parent. Spawning the real .exe directly lets
+// CREATE_NO_WINDOW propagate. See [[windows-spawn-cmd-shim-flash]].
+function resolveWindowsExe(cmd) {
+  if (process.platform !== 'win32') return cmd;
+  try {
+    const r = spawnSync('where', [cmd], {
+      encoding: 'utf-8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+      windowsHide: true,
+      timeout: 800,
+    });
+    if (r.status !== 0) return cmd;
+    const lines = (r.stdout || '').split(/\r?\n/).map(l => l.trim()).filter(Boolean);
+    const exe = lines.find(l => /\.exe$/i.test(l));
+    return exe || lines[0] || cmd;
+  } catch {
+    return cmd;
+  }
+}
+
 const NPM_PACKAGE = 'plugkit-wasm';
 const ATTEMPT_TIMEOUT_MS = 10 * 60 * 1000;
 const MAX_ATTEMPTS = 3;
@@ -180,7 +202,7 @@ async function extractNpmPackageWasm(destPath, version) {
 
     fs.writeFileSync(path.join(tempDir, 'package.json'), JSON.stringify({ name: 'plugkit-extract', version: '0.0.0', private: true }));
 
-    const cmd = process.platform === 'win32' ? 'npm.cmd' : 'npm';
+    const cmd = resolveWindowsExe('npm');
     const args = ['install', '--no-audit', '--no-fund', '--no-save', NPM_PACKAGE + '@' + version];
 
     const result = spawnSync(cmd, args, {
@@ -189,7 +211,9 @@ async function extractNpmPackageWasm(destPath, version) {
       timeout: ATTEMPT_TIMEOUT_MS,
       encoding: 'utf8',
       windowsHide: true,
-      shell: process.platform === 'win32',
+      // CREATE_NO_WINDOW — inherited by .cmd shims npm spawns during
+      // package install, so no conhost flash during the extract step.
+      ...(process.platform === 'win32' ? { creationFlags: 0x08000000 } : {}),
     });
 
     if (result.error) throw result.error;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-plugkit",
-  "version": "2.0.1229",
+  "version": "2.0.1231",
   "description": "Bootstrap and daemon-spawn tool for gm plugkit binary. Downloads the correct platform binary, verifies SHA256, and starts the spool watcher daemon. Includes plugkit-wasm-wrapper for WASM-based spool watching.",
   "main": "index.js",
   "bin": {

package/plugkit-wasm-wrapper.js

@@ -797,15 +797,22 @@ function ensureAcptoapi() {
     }
     // Resolve `bun` to its actual .exe on Windows so the spawned daemon
     // doesn't enter conhost via a bun.cmd shim. See
-    // [[windows-spawn-cmd-shim-flash]] — cmd.exe + .cmd chain re-enters
-    // conhost even with windowsHide:true on the parent. Falls back to
-    // the bare name on non-Windows / when `where` can't resolve.
+    // [[windows-spawn-cmd-shim-flash]].
+    //
+    // Use CREATE_NO_WINDOW (0x08000000) | DETACHED_PROCESS (0x00000008)
+    // creationFlags so the suppression is INHERITED by every descendant
+    // bun-x downloads and launches (acptoapi itself spawns 11 ACP sub-
+    // daemons via .cmd shims; without this flag each one pops a conhost
+    // window). windowsHide:true alone only hides the immediate child.
+    const CREATE_NO_WINDOW = 0x08000000;
+    const DETACHED_PROCESS = 0x00000008;
     const cmd = resolveWindowsExeLocal('bun');
     const child = spawn(cmd, ['x', 'acptoapi@latest'], {
       detached: true,
       stdio: 'ignore',
       windowsHide: true,
       shell: false,
+      creationFlags: CREATE_NO_WINDOW | DETACHED_PROCESS,
     });
     child.unref();
     _acptoapiBoot.spawned_at = Date.now();