sparkbun 0.2.5 → 0.2.7

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "sparkbun",
-	"version": "0.2.5",
+	"version": "0.2.7",
 	"description": "Build fast, lightweight, cross-platform desktop apps with TypeScript and Bun.",
 	"license": "MIT",
 	"author": "SparkBun Contributors",

package/src/bun/core/BrowserWindow.ts

@@ -29,6 +29,12 @@ export type WindowOptionsType<T = undefined> = {
 	preload: string | null;
 	viewsRoot: string | null;
 	renderer: "native" | "cef";
+	// Storage partition for the webview's cookies/localStorage/cache/IndexedDB.
+	// A value starting with "persist:" is written to disk; any other non-empty
+	// value is ephemeral — in-memory only, gone when the process exits — which
+	// is what incognito-style/diskless sessions want. Omitted/null falls back to
+	// "persist:default" (on-disk).
+	partition?: string;
 	rpc?: T;
 	styleMask?: {};
 	// titleBarStyle options:
@@ -105,6 +111,7 @@ export class BrowserWindow<T extends RPCWithTransport = AnyRPC> {
 	html: string | null = null;
 	preload: string | null = null;
 	viewsRoot: string | null = null;
+	partition: string | null = null;
 	renderer: "native" | "cef" = "native";
 	transparent: boolean = false;
 	passthrough: boolean = false;
@@ -139,6 +146,7 @@ export class BrowserWindow<T extends RPCWithTransport = AnyRPC> {
 		this.html = options.html || null;
 		this.preload = options.preload || null;
 		this.viewsRoot = options.viewsRoot || null;
+		this.partition = options.partition ?? null;
 		this.renderer = options.renderer || defaultOptions.renderer;
 		this.transparent = options.transparent ?? false;
 		this.passthrough = options.passthrough ?? false;
@@ -223,6 +231,7 @@ export class BrowserWindow<T extends RPCWithTransport = AnyRPC> {
 			html: this.html,
 			preload: this.preload,
 			viewsRoot: this.viewsRoot,
+			partition: this.partition,
 			// frame: this.frame,
 			renderer: this.renderer,
 			frame: {

package/src/bun/core/Updater.ts

@@ -922,17 +922,16 @@ if %rmRetry% GEQ 10 goto rmfailed
 timeout /t 2 /nobreak >nul
 goto rmloop
 :rmfailed
-echo Update failed: could not remove "${runningAppWin}" after retries.
-echo Files may still be locked by a helper process.
-pause
+:: The script runs in a hidden window, so log instead of echo/pause (a hidden
+:: pause would hang invisibly forever).
+echo Update failed: could not remove "${runningAppWin}" after retries. Files may still be locked by a helper process. >> "%~dp0update-error.log"
 exit /b 1
 :rmdone
 
 :: Move new app to current location (safe now that destination is gone)
 move "${newAppWin}" "${runningAppWin}"
 if not exist "${launcherPathWin}" (
-    echo Update failed: launcher not found at "${launcherPathWin}" after move.
-    pause
+    echo Update failed: launcher not found at "${launcherPathWin}" after move. >> "%~dp0update-error.log"
     exit /b 1
 )
 
@@ -947,24 +946,40 @@ for /f "tokens=1" %%t in ('schtasks /query /fo list ^| findstr /i "SparkBunUpdat
     schtasks /delete /tn "%%t" /f >nul 2>&1
 )
 
-:: Delete this update script after a short delay
+:: Delete this update script (and its hidden-window launcher) after a short delay
 ping -n 2 127.0.0.1 >nul
+del "%~dp0update.vbs" 2>nul
 del "%~f0"
 `;
 
 						await Bun.write(updateScriptPath, updateScript);
 
+						// VBS shim so the batch script runs with a HIDDEN window (style 0).
+						// schtasks can't hide a console app's window itself, and without
+						// this the whole update — wait loop included — sits in a visible
+						// cmd window. wscript.exe is a GUI-subsystem host, so nothing
+						// flashes. Errors are logged to update-error.log by the bat.
+						const scriptPathWin = updateScriptPath.replace(/\//g, "\\");
+						const vbsPath = join(parentDir, "update.vbs");
+						const vbsPathWin = vbsPath.replace(/\//g, "\\");
+						await Bun.write(
+							vbsPath,
+							`CreateObject("WScript.Shell").Run "cmd /c ""${scriptPathWin}""", 0, False\r\n`,
+						);
+
 						// Use Windows Task Scheduler to run the update script independently
 						// This ensures the script runs even after the app exits
-						const scriptPathWin = updateScriptPath.replace(/\//g, "\\");
 						const taskName = `SparkBunUpdate_${Date.now()}`;
 
-						// Create a scheduled task that runs immediately and deletes itself
+						// Create a scheduled task that runs immediately and deletes itself.
+						// windowsHide stops the schtasks invocations themselves from
+						// flashing console windows (the app is a GUI-subsystem process,
+						// so each unhidden child would allocate a fresh visible console).
 						execSync(
-							`schtasks /create /tn "${taskName}" /tr "cmd /c \\"${scriptPathWin}\\"" /sc once /st 00:00 /f`,
-							{ stdio: "ignore" },
+							`schtasks /create /tn "${taskName}" /tr "wscript.exe //B \\"${vbsPathWin}\\"" /sc once /st 00:00 /f`,
+							{ stdio: "ignore", windowsHide: true },
 						);
-						execSync(`schtasks /run /tn "${taskName}"`, { stdio: "ignore" });
+						execSync(`schtasks /run /tn "${taskName}"`, { stdio: "ignore", windowsHide: true });
 						// The task will be cleaned up by Windows after it runs, or we delete it in the batch script
 
 						// Use quit() for graceful shutdown - this closes all windows and processes

package/src/cli/index.ts

@@ -1313,6 +1313,30 @@ function escapeXml(str: string): string {
 		.replace(/'/g, "'");
 }
 
+/**
+ * Flip the PE subsystem from CONSOLE (3) to WINDOWS GUI (2) so the exe never
+ * opens a console window. Byte-identical to `editbin /SUBSYSTEM:WINDOWS`.
+ *
+ * This exists because Bun's `compile.windows.hideConsole` is a silent no-op:
+ * the only code that applies it sits after a switch in which every prong
+ * returns early (oven-sh/bun#19916; fix PR oven-sh/bun#20338 unmerged as of
+ * Bun 1.3.14). Bun's intended implementation writes the exact same byte at the
+ * exact same offset, so when upstream merges the fix, `hideConsole: true`
+ * takes over and this patch degrades to a no-op (the `current !== 2` check).
+ *
+ * Unlike Bun's flag, this also works when cross-compiling from macOS/Linux
+ * (Bun only applies windows options when the build host is Windows).
+ *
+ * Must run AFTER all other PE edits (payload injection, rescle metadata) and
+ * BEFORE any future code signing — mutating a signed exe invalidates the
+ * signature.
+ *
+ * Historical note: a May 2026 commit (cf58be7) blamed hideConsole for breaking
+ * the ShellExecuteW("runas") elevation flow. Since hideConsole never touched
+ * the binary, that breakage came from elsewhere (likely the experimental
+ * signature-stripping variant of this function that was being tested at the
+ * same time and was reverted in the same commit).
+ */
 function patchPeSubsystem(exePath: string): void {
 	const buf = readFileSync(exePath);
 	const peOffset = buf.readUInt32LE(0x3c);
@@ -2144,8 +2168,9 @@ usageDescriptions : ""}${urlTypes ? "\n" + urlTypes : ""}${documentTypes ?
 		if (targetOS === "win") {
 			if (OS !== "win") {
 				console.warn(
-					`\n⚠️  Cross-compiling for Windows: icon, hideConsole, and PE metadata (title, version, publisher, etc.) will be ignored.\n` +
+					`\n⚠️  Cross-compiling for Windows: icon and PE metadata (title, version, publisher, etc.) will be ignored.\n` +
 					`   Bun's Windows-specific compile options require building on a Windows host.\n` +
+					`   (The console window is still hidden — the PE subsystem patch runs on any host.)\n` +
 					`   See: https://bun.com/docs/bundler/executables#windows-specific-flags\n`
 				);
 			} else {
@@ -3177,6 +3202,8 @@ usageDescriptions : ""}${urlTypes ? "\n" + urlTypes : ""}${documentTypes ?
 						hash,
 						config,
 						projectRoot,
+						targetOS,
+						currentTarget.arch,
 					);
 					artifactsToUpload.push(installerPath);
 				}
@@ -3199,8 +3226,10 @@ usageDescriptions : ""}${urlTypes ? "\n" + urlTypes : ""}${documentTypes ?
 				// the download button or display on your marketing site or in the app.
 				version: config.app.version,
 				hash: hash.toString(),
-				platform: OS,
-				arch: ARCH,
+				// The TARGET platform of these artifacts (host != target when
+				// cross-compiling, e.g. --target=win-x64 on macOS).
+				platform: targetOS,
+				arch: currentTarget.arch,
 				// channel: buildEnvironment,
 				// baseUrl: config.release.baseUrl
 			});
@@ -3681,9 +3710,14 @@ ${archiveExports.join("\n")}
 				}
 			}
 			installerCompileOptions.windows = {
-				// Don't set hideConsole — it conflicts with the ShellExecuteW("runas")
-				// elevation flow in the wrapper template. The PE subsystem patch
-				// (CONSOLE -> WINDOWS) applied after compilation hides the console.
+				// Currently a no-op in Bun (oven-sh/bun#19916 — the subsystem edit is
+				// unreachable code; fix PR #20338 unmerged as of 1.3.14), so the
+				// console is actually hidden by patchPeSubsystem() below. Set it
+				// anyway: it's harmless today and becomes the primary mechanism the
+				// day Bun fixes it (the patch then no-ops). See patchPeSubsystem's
+				// doc comment for why the old "conflicts with elevation" story here
+				// was a misattribution.
+				hideConsole: true,
 				...(icoPath && { icon: icoPath }),
 				title: `${installerName} Setup`,
 				version: installerVersion,
@@ -4318,9 +4352,16 @@ ${archiveExports.join("\n")}
 		hash: string,
 		config: any,
 		projectRoot: string,
+		// The TARGET platform being built for — not the build host. These used to
+		// be derived from the host OS/ARCH globals, so cross-compiling (e.g.
+		// `--target=win-x64` on macOS) wrongly built a host-platform installer
+		// whose extensionless outfile then collided with the app bundle directory
+		// ("is a directory" build failure).
+		targetOS: "win" | "linux" | "macos",
+		targetArch: string,
 	): Promise<string> {
-		const targetOSName = OS === "macos" ? "darwin" : OS === "win" ? "windows" : "linux";
-		const isWindows = OS === "win";
+		const targetOSName = targetOS === "macos" ? "darwin" : targetOS === "win" ? "windows" : "linux";
+		const isWindows = targetOS === "win";
 
 		const setupFileName = isWindows
 			? getWindowsSetupFileName(config.app.name, buildEnvironment)
@@ -4337,9 +4378,9 @@ ${archiveExports.join("\n")}
 		// Copy archive
 		copyFileSync(compressedTarPath, join(stagingDir, "app-archive.tar.gz"));
 
-		// Write metadata
-		const platformConfig = OS === "macos" ? config.build?.mac
-			: OS === "win" ? config.build?.win
+		// Write metadata (platform config of the TARGET, not the build host)
+		const platformConfig = targetOS === "macos" ? config.build?.mac
+			: targetOS === "win" ? config.build?.win
 			: config.build?.linux;
 		const metadata = {
 			identifier: config.app.identifier,
@@ -4356,11 +4397,18 @@ ${archiveExports.join("\n")}
 		copyFileSync(templatePath, join(stagingDir, "installer.ts"));
 
 		const installerCompileOptions: any = {
-			target: `bun-${targetOSName}-${ARCH}`,
+			target: `bun-${targetOSName}-${targetArch}`,
 			outfile: outputPath,
 		};
 
-		if (isWindows) {
+		if (isWindows && OS !== "win") {
+			// Bun only applies windows compile options on a Windows host; the
+			// console is still hidden by patchPeSubsystem below (works anywhere).
+			console.warn(
+				`\n⚠️  Cross-compiling the Windows installer: icon and PE metadata (title, version, publisher, etc.) will be ignored.\n` +
+				`   Build on a Windows host if the installer exe needs them.\n`
+			);
+		} else if (isWindows) {
 			let icoPath: string | undefined;
 			if (config.build.win?.icon) {
 				const iconSrc = config.build.win.icon.startsWith("/") || config.build.win.icon.match(/^[a-zA-Z]:/)

package/src/installer/installer-template.ts

@@ -92,6 +92,36 @@ function getInstallDir(meta: Metadata): string {
 	}
 }
 
+// Create a .lnk via WScript.Shell. windowsHide is essential: the installer is a
+// GUI-subsystem exe, so without it each PowerShell child allocates its own
+// visible console window mid-install. PowerShell is called by absolute path
+// (PATH isn't reliable in every launch context), and the paths are passed
+// through the environment ($env:SB_*) rather than interpolated into the script
+// text, so an app name containing quotes can't break or inject into the command.
+function createShortcut(lnkPath: string, targetPath: string, workingDir: string) {
+	const systemRoot = process.env.SystemRoot || process.env.windir || "C:\\Windows";
+	const powershell = join(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+	const script =
+		"$ws = New-Object -ComObject WScript.Shell;" +
+		" $s = $ws.CreateShortcut($env:SB_LNK);" +
+		" $s.TargetPath = $env:SB_TARGET;" +
+		" $s.WorkingDirectory = $env:SB_WORKDIR;" +
+		" $s.Save()";
+	try {
+		Bun.spawnSync([powershell, "-NoProfile", "-Command", script], {
+			stdout: "ignore",
+			stderr: "ignore",
+			windowsHide: true,
+			env: {
+				...process.env,
+				SB_LNK: lnkPath,
+				SB_TARGET: targetPath,
+				SB_WORKDIR: workingDir,
+			},
+		});
+	} catch {}
+}
+
 async function createWindowsShortcuts(appDir: string, meta: Metadata) {
 	const binDir = join(appDir, "bin");
 	const exePath = join(binDir, `${meta.name.replace(/ /g, "")}.exe`);
@@ -100,19 +130,11 @@ async function createWindowsShortcuts(appDir: string, meta: Metadata) {
 
 	// Start Menu shortcut
 	const startMenu = join(process.env.APPDATA || "", "Microsoft", "Windows", "Start Menu", "Programs");
-	try {
-		Bun.spawnSync(["powershell", "-NoProfile", "-Command",
-			`$ws = New-Object -ComObject WScript.Shell; $s = $ws.CreateShortcut('${join(startMenu, meta.name + ".lnk")}'); $s.TargetPath = '${exePath}'; $s.WorkingDirectory = '${binDir}'; $s.Save()`
-		]);
-	} catch {}
+	createShortcut(join(startMenu, meta.name + ".lnk"), exePath, binDir);
 
 	// Desktop shortcut
-	try {
-		const desktop = join(process.env.USERPROFILE || "", "Desktop");
-		Bun.spawnSync(["powershell", "-NoProfile", "-Command",
-			`$ws = New-Object -ComObject WScript.Shell; $s = $ws.CreateShortcut('${join(desktop, meta.name + ".lnk")}'); $s.TargetPath = '${exePath}'; $s.WorkingDirectory = '${binDir}'; $s.Save()`
-		]);
-	} catch {}
+	const desktop = join(process.env.USERPROFILE || "", "Desktop");
+	createShortcut(join(desktop, meta.name + ".lnk"), exePath, binDir);
 
 	console.log("Created Start Menu and Desktop shortcuts");
 }

package/src/native/linux/nativeWrapper.cpp

@@ -11208,55 +11208,66 @@ static std::map<std::string, WebKitWebsiteDataManager*> g_partitionDataManagers;
 static WebKitWebsiteDataManager* getDataManagerForPartition(const char* partitionIdentifier) {
     std::string partition = partitionIdentifier ? partitionIdentifier : "";
 
+    // Prefer the data manager owned by the live webview context for this
+    // partition. getContextForPartition() builds each webview's context around
+    // its own WebKitWebsiteDataManager; creating a separate manager here — even
+    // one pointing at the same on-disk directory — clears a different instance
+    // and leaves the running webview's storage untouched, which made
+    // clearStorageData()/cookies.clear() appear to do nothing. Resolving through
+    // the context keeps clears on the exact store the page reads and writes.
+    if (partition.empty()) {
+        WebKitWebContext* context = webkit_web_context_get_default();
+        return webkit_web_context_get_website_data_manager(context);
+    }
+
+    auto ctxIt = g_partitionContexts.find(partition);
+    if (ctxIt != g_partitionContexts.end() && ctxIt->second) {
+        return webkit_web_context_get_website_data_manager(ctxIt->second);
+    }
+
+    // No live context for this partition yet — fall back to a standalone manager
+    // (cached) so cookie/storage APIs still work before a webview is created.
     auto it = g_partitionDataManagers.find(partition);
     if (it != g_partitionDataManagers.end()) {
         return it->second;
     }
 
     WebKitWebsiteDataManager* dataManager = nullptr;
+    bool isPersistent = partition.substr(0, 8) == "persist:";
 
-    if (partition.empty()) {
-        // Default: use default context's data manager
-        WebKitWebContext* context = webkit_web_context_get_default();
-        dataManager = webkit_web_context_get_website_data_manager(context);
-    } else {
-        bool isPersistent = partition.substr(0, 8) == "persist:";
+    if (isPersistent) {
+        std::string partitionName = partition.substr(8);
 
-        if (isPersistent) {
-            std::string partitionName = partition.substr(8);
+        // Build paths with identifier/channel structure (consistent with CLI and updater)
+        char* home = getenv("HOME");
+        std::string homeStr = home ? std::string(home) : "/tmp";
+        std::string dataPath = buildPartitionPath(homeStr + "/.local/share", g_sparkbunIdentifier, g_sparkbunChannel, "WebKit", partitionName);
+        std::string cachePath = buildPartitionPath(homeStr + "/.cache", g_sparkbunIdentifier, g_sparkbunChannel, "WebKit", partitionName);
 
-            // Build paths with identifier/channel structure (consistent with CLI and updater)
-            char* home = getenv("HOME");
-            std::string homeStr = home ? std::string(home) : "/tmp";
-            std::string dataPath = buildPartitionPath(homeStr + "/.local/share", g_sparkbunIdentifier, g_sparkbunChannel, "WebKit", partitionName);
-            std::string cachePath = buildPartitionPath(homeStr + "/.cache", g_sparkbunIdentifier, g_sparkbunChannel, "WebKit", partitionName);
+        g_mkdir_with_parents(dataPath.c_str(), 0755);
+        g_mkdir_with_parents(cachePath.c_str(), 0755);
 
-            g_mkdir_with_parents(dataPath.c_str(), 0755);
-            g_mkdir_with_parents(cachePath.c_str(), 0755);
+        dataManager = webkit_website_data_manager_new(
+            "base-data-directory", dataPath.c_str(),
+            "base-cache-directory", cachePath.c_str(),
+            NULL
+        );
 
-            dataManager = webkit_website_data_manager_new(
-                "base-data-directory", dataPath.c_str(),
-                "base-cache-directory", cachePath.c_str(),
-                NULL
+        // Enable persistent cookie storage (SQLite-backed)
+        WebKitCookieManager* cookieManager = webkit_website_data_manager_get_cookie_manager(dataManager);
+        if (cookieManager) {
+            std::string cookiePath = dataPath + "/cookies.sqlite";
+            webkit_cookie_manager_set_persistent_storage(
+                cookieManager,
+                cookiePath.c_str(),
+                WEBKIT_COOKIE_PERSISTENT_STORAGE_SQLITE
             );
-
-            // Enable persistent cookie storage (SQLite-backed)
-            WebKitCookieManager* cookieManager = webkit_website_data_manager_get_cookie_manager(dataManager);
-            if (cookieManager) {
-                std::string cookiePath = dataPath + "/cookies.sqlite";
-                webkit_cookie_manager_set_persistent_storage(
-                    cookieManager,
-                    cookiePath.c_str(),
-                    WEBKIT_COOKIE_PERSISTENT_STORAGE_SQLITE
-                );
-            }
-        } else {
-            dataManager = webkit_website_data_manager_new_ephemeral();
         }
-
-        g_partitionDataManagers[partition] = dataManager;
+    } else {
+        dataManager = webkit_website_data_manager_new_ephemeral();
     }
 
+    g_partitionDataManagers[partition] = dataManager;
     return dataManager;
 }
 
@@ -11651,11 +11662,44 @@ SPARKBUN_EXPORT bool sessionRemoveCookie(const char* partitionIdentifier, const
 // Clear all cookies (WebKit2GTK)
 // Clear all cookies (WebKit2GTK) - STUB implementation to prevent crashes
 SPARKBUN_EXPORT void sessionClearCookies(const char* partitionIdentifier) {
-    // Stub implementation: do nothing and return immediately
-    // This prevents crashes from complex WebKit async patterns during tests
-    // while maintaining API compatibility
-    (void)partitionIdentifier; // Suppress unused parameter warning
-    return;
+    // Copy argument before dispatching to main thread
+    std::string partitionStr = partitionIdentifier ? partitionIdentifier : "";
+
+    // Clear cookies via the website data manager rather than per-cookie
+    // get/delete. This reuses the same dispatch + GMainLoop pattern as
+    // sessionClearStorageData (which is stable) instead of the async cookie
+    // enumeration that previously crashed and led to this being stubbed out.
+    dispatch_sync_main_void([partitionStr]() {
+        WebKitWebsiteDataManager* dataManager = getDataManagerForPartition(partitionStr.c_str());
+        if (!dataManager) {
+            return;
+        }
+
+        GMainLoop* loop = g_main_loop_new(NULL, FALSE);
+
+        webkit_website_data_manager_clear(dataManager, WEBKIT_WEBSITE_DATA_COOKIES, 0, nullptr,
+            [](GObject* source, GAsyncResult* result, gpointer user_data) {
+                GMainLoop* loop = static_cast<GMainLoop*>(user_data);
+                GError* error = nullptr;
+                webkit_website_data_manager_clear_finish(WEBKIT_WEBSITE_DATA_MANAGER(source), result, &error);
+                if (error) {
+                    g_error_free(error);
+                }
+                g_main_loop_quit(loop);
+            }, loop);
+
+        GSource* timeout = g_timeout_source_new(10000);
+        g_source_set_callback(timeout, [](gpointer data) -> gboolean {
+            g_main_loop_quit(static_cast<GMainLoop*>(data));
+            return G_SOURCE_REMOVE;
+        }, loop, nullptr);
+        g_source_attach(timeout, g_main_loop_get_context(loop));
+
+        g_main_loop_run(loop);
+        g_source_destroy(timeout);
+        g_source_unref(timeout);
+        g_main_loop_unref(loop);
+    });
 }
 
 // Clear storage data (WebKit2GTK)