sealcode 1.3.0 → 1.3.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sealcode",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "Lock your source code in your own git repo. Stop AI agents, scrapers, and curious eyes from reading what's yours.",
   "keywords": [
     "encryption",

package/src/cli-watch.js

@@ -314,6 +314,7 @@ function startExfilWatchers({
         encoding: 'utf8',
         timeout: 1500,
         stdio: ['ignore', 'pipe', 'ignore'],
+        windowsHide: true,
       })
       .trim();
   } catch (_) { /* repo may not have git */ }
@@ -417,6 +418,7 @@ function startExfilWatchers({
       const cur = cp
         .execFileSync('git', ['-C', projectAbs, 'remote', '-v'], {
           encoding: 'utf8', timeout: 1500, stdio: ['ignore', 'pipe', 'ignore'],
+          windowsHide: true,
         })
         .trim();
       if (initialRemotes && cur !== initialRemotes) {
@@ -932,9 +934,33 @@ async function finalLock(projectRoot, config, code, reason, json, daemon) {
  * Helper: spawn a detached `sealcode watch <code> --daemon` child. Used
  * by runUnlock when the unlock came from a grant-derived session.
  * Returns the child pid (already detached). Best-effort.
+ *
+ * Windows specifics (sealcode@1.3.1):
+ *   - `windowsHide: true` keeps the spawned process from popping a
+ *     console window. Without this, every daemon spawn flashes a black
+ *     cmd window which users (rightly) find alarming.
+ *   - We also guard against re-spawn loops: if a daemon is already
+ *     alive for this project we just return its pid instead of
+ *     spawning a new one. Without this guard, repeated `redeem` calls
+ *     (or any startup hook that re-runs redeem) accumulate orphan
+ *     daemons that each show up as a pop-and-vanish window when they
+ *     periodically run their child-process sweeps.
  */
 function spawnDaemonWatcher({ projectRoot, code }) {
   try {
+    // If a healthy daemon is already running for this project, don't
+    // start another one. This is the single most important defense
+    // against the "windows pop in and out" loop on Windows.
+    const existing = readWatcherStatus(projectRoot);
+    if (existing.state === 'alive') {
+      return { pid: existing.pid, reused: true };
+    }
+    // Stale / dead state file should be cleared before respawn, otherwise
+    // the new daemon may collide with leftover bookkeeping.
+    if (existing.state === 'stale' || existing.state === 'dead') {
+      try { fs.unlinkSync(watchStateFile(projectRoot)); } catch (_) { /* ignore */ }
+    }
+
     ensureDir(WATCH_LOG_DIR);
     const bin = process.execPath;
     const entry = require.resolve('../bin/sealcode.js');
@@ -945,6 +971,9 @@ function spawnDaemonWatcher({ projectRoot, code }) {
         cwd: projectRoot,
         detached: true,
         stdio: 'ignore',
+        // Critical on Windows — without this, the spawned daemon
+        // opens a visible cmd window. macOS / Linux ignore the flag.
+        windowsHide: true,
         env: { ...process.env, SEALCODE_AUTO_DAEMON: '1' },
       },
     );

package/src/device.js

@@ -72,6 +72,9 @@ function readMachineId() {
         encoding: 'utf8',
         timeout: 1500,
         stdio: ['ignore', 'pipe', 'ignore'],
+        // Stop reg.exe from flashing a console window — happens on every
+        // command run because device.js is loaded by `clientInfo()`.
+        windowsHide: true,
       });
       const m = /MachineGuid\s+REG_SZ\s+([0-9a-f-]+)/i.exec(out);
       return m ? m[1] : null;