sparkbun 0.2.6 → 0.2.7

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "sparkbun",
-	"version": "0.2.6",
+	"version": "0.2.7",
 	"description": "Build fast, lightweight, cross-platform desktop apps with TypeScript and Bun.",
 	"license": "MIT",
 	"author": "SparkBun Contributors",

package/src/bun/core/Updater.ts

@@ -922,17 +922,16 @@ if %rmRetry% GEQ 10 goto rmfailed
 timeout /t 2 /nobreak >nul
 goto rmloop
 :rmfailed
-echo Update failed: could not remove "${runningAppWin}" after retries.
-echo Files may still be locked by a helper process.
-pause
+:: The script runs in a hidden window, so log instead of echo/pause (a hidden
+:: pause would hang invisibly forever).
+echo Update failed: could not remove "${runningAppWin}" after retries. Files may still be locked by a helper process. >> "%~dp0update-error.log"
 exit /b 1
 :rmdone
 
 :: Move new app to current location (safe now that destination is gone)
 move "${newAppWin}" "${runningAppWin}"
 if not exist "${launcherPathWin}" (
-    echo Update failed: launcher not found at "${launcherPathWin}" after move.
-    pause
+    echo Update failed: launcher not found at "${launcherPathWin}" after move. >> "%~dp0update-error.log"
     exit /b 1
 )
 
@@ -947,24 +946,40 @@ for /f "tokens=1" %%t in ('schtasks /query /fo list ^| findstr /i "SparkBunUpdat
     schtasks /delete /tn "%%t" /f >nul 2>&1
 )
 
-:: Delete this update script after a short delay
+:: Delete this update script (and its hidden-window launcher) after a short delay
 ping -n 2 127.0.0.1 >nul
+del "%~dp0update.vbs" 2>nul
 del "%~f0"
 `;
 
 						await Bun.write(updateScriptPath, updateScript);
 
+						// VBS shim so the batch script runs with a HIDDEN window (style 0).
+						// schtasks can't hide a console app's window itself, and without
+						// this the whole update — wait loop included — sits in a visible
+						// cmd window. wscript.exe is a GUI-subsystem host, so nothing
+						// flashes. Errors are logged to update-error.log by the bat.
+						const scriptPathWin = updateScriptPath.replace(/\//g, "\\");
+						const vbsPath = join(parentDir, "update.vbs");
+						const vbsPathWin = vbsPath.replace(/\//g, "\\");
+						await Bun.write(
+							vbsPath,
+							`CreateObject("WScript.Shell").Run "cmd /c ""${scriptPathWin}""", 0, False\r\n`,
+						);
+
 						// Use Windows Task Scheduler to run the update script independently
 						// This ensures the script runs even after the app exits
-						const scriptPathWin = updateScriptPath.replace(/\//g, "\\");
 						const taskName = `SparkBunUpdate_${Date.now()}`;
 
-						// Create a scheduled task that runs immediately and deletes itself
+						// Create a scheduled task that runs immediately and deletes itself.
+						// windowsHide stops the schtasks invocations themselves from
+						// flashing console windows (the app is a GUI-subsystem process,
+						// so each unhidden child would allocate a fresh visible console).
 						execSync(
-							`schtasks /create /tn "${taskName}" /tr "cmd /c \\"${scriptPathWin}\\"" /sc once /st 00:00 /f`,
-							{ stdio: "ignore" },
+							`schtasks /create /tn "${taskName}" /tr "wscript.exe //B \\"${vbsPathWin}\\"" /sc once /st 00:00 /f`,
+							{ stdio: "ignore", windowsHide: true },
 						);
-						execSync(`schtasks /run /tn "${taskName}"`, { stdio: "ignore" });
+						execSync(`schtasks /run /tn "${taskName}"`, { stdio: "ignore", windowsHide: true });
 						// The task will be cleaned up by Windows after it runs, or we delete it in the batch script
 
 						// Use quit() for graceful shutdown - this closes all windows and processes

package/src/cli/index.ts

@@ -1313,6 +1313,30 @@ function escapeXml(str: string): string {
 		.replace(/'/g, "'");
 }
 
+/**
+ * Flip the PE subsystem from CONSOLE (3) to WINDOWS GUI (2) so the exe never
+ * opens a console window. Byte-identical to `editbin /SUBSYSTEM:WINDOWS`.
+ *
+ * This exists because Bun's `compile.windows.hideConsole` is a silent no-op:
+ * the only code that applies it sits after a switch in which every prong
+ * returns early (oven-sh/bun#19916; fix PR oven-sh/bun#20338 unmerged as of
+ * Bun 1.3.14). Bun's intended implementation writes the exact same byte at the
+ * exact same offset, so when upstream merges the fix, `hideConsole: true`
+ * takes over and this patch degrades to a no-op (the `current !== 2` check).
+ *
+ * Unlike Bun's flag, this also works when cross-compiling from macOS/Linux
+ * (Bun only applies windows options when the build host is Windows).
+ *
+ * Must run AFTER all other PE edits (payload injection, rescle metadata) and
+ * BEFORE any future code signing — mutating a signed exe invalidates the
+ * signature.
+ *
+ * Historical note: a May 2026 commit (cf58be7) blamed hideConsole for breaking
+ * the ShellExecuteW("runas") elevation flow. Since hideConsole never touched
+ * the binary, that breakage came from elsewhere (likely the experimental
+ * signature-stripping variant of this function that was being tested at the
+ * same time and was reverted in the same commit).
+ */
 function patchPeSubsystem(exePath: string): void {
 	const buf = readFileSync(exePath);
 	const peOffset = buf.readUInt32LE(0x3c);
@@ -2144,8 +2168,9 @@ usageDescriptions : ""}${urlTypes ? "\n" + urlTypes : ""}${documentTypes ?
 		if (targetOS === "win") {
 			if (OS !== "win") {
 				console.warn(
-					`\n⚠️  Cross-compiling for Windows: icon, hideConsole, and PE metadata (title, version, publisher, etc.) will be ignored.\n` +
+					`\n⚠️  Cross-compiling for Windows: icon and PE metadata (title, version, publisher, etc.) will be ignored.\n` +
 					`   Bun's Windows-specific compile options require building on a Windows host.\n` +
+					`   (The console window is still hidden — the PE subsystem patch runs on any host.)\n` +
 					`   See: https://bun.com/docs/bundler/executables#windows-specific-flags\n`
 				);
 			} else {
@@ -3177,6 +3202,8 @@ usageDescriptions : ""}${urlTypes ? "\n" + urlTypes : ""}${documentTypes ?
 						hash,
 						config,
 						projectRoot,
+						targetOS,
+						currentTarget.arch,
 					);
 					artifactsToUpload.push(installerPath);
 				}
@@ -3199,8 +3226,10 @@ usageDescriptions : ""}${urlTypes ? "\n" + urlTypes : ""}${documentTypes ?
 				// the download button or display on your marketing site or in the app.
 				version: config.app.version,
 				hash: hash.toString(),
-				platform: OS,
-				arch: ARCH,
+				// The TARGET platform of these artifacts (host != target when
+				// cross-compiling, e.g. --target=win-x64 on macOS).
+				platform: targetOS,
+				arch: currentTarget.arch,
 				// channel: buildEnvironment,
 				// baseUrl: config.release.baseUrl
 			});
@@ -3681,9 +3710,14 @@ ${archiveExports.join("\n")}
 				}
 			}
 			installerCompileOptions.windows = {
-				// Don't set hideConsole — it conflicts with the ShellExecuteW("runas")
-				// elevation flow in the wrapper template. The PE subsystem patch
-				// (CONSOLE -> WINDOWS) applied after compilation hides the console.
+				// Currently a no-op in Bun (oven-sh/bun#19916 — the subsystem edit is
+				// unreachable code; fix PR #20338 unmerged as of 1.3.14), so the
+				// console is actually hidden by patchPeSubsystem() below. Set it
+				// anyway: it's harmless today and becomes the primary mechanism the
+				// day Bun fixes it (the patch then no-ops). See patchPeSubsystem's
+				// doc comment for why the old "conflicts with elevation" story here
+				// was a misattribution.
+				hideConsole: true,
 				...(icoPath && { icon: icoPath }),
 				title: `${installerName} Setup`,
 				version: installerVersion,
@@ -4318,9 +4352,16 @@ ${archiveExports.join("\n")}
 		hash: string,
 		config: any,
 		projectRoot: string,
+		// The TARGET platform being built for — not the build host. These used to
+		// be derived from the host OS/ARCH globals, so cross-compiling (e.g.
+		// `--target=win-x64` on macOS) wrongly built a host-platform installer
+		// whose extensionless outfile then collided with the app bundle directory
+		// ("is a directory" build failure).
+		targetOS: "win" | "linux" | "macos",
+		targetArch: string,
 	): Promise<string> {
-		const targetOSName = OS === "macos" ? "darwin" : OS === "win" ? "windows" : "linux";
-		const isWindows = OS === "win";
+		const targetOSName = targetOS === "macos" ? "darwin" : targetOS === "win" ? "windows" : "linux";
+		const isWindows = targetOS === "win";
 
 		const setupFileName = isWindows
 			? getWindowsSetupFileName(config.app.name, buildEnvironment)
@@ -4337,9 +4378,9 @@ ${archiveExports.join("\n")}
 		// Copy archive
 		copyFileSync(compressedTarPath, join(stagingDir, "app-archive.tar.gz"));
 
-		// Write metadata
-		const platformConfig = OS === "macos" ? config.build?.mac
-			: OS === "win" ? config.build?.win
+		// Write metadata (platform config of the TARGET, not the build host)
+		const platformConfig = targetOS === "macos" ? config.build?.mac
+			: targetOS === "win" ? config.build?.win
 			: config.build?.linux;
 		const metadata = {
 			identifier: config.app.identifier,
@@ -4356,11 +4397,18 @@ ${archiveExports.join("\n")}
 		copyFileSync(templatePath, join(stagingDir, "installer.ts"));
 
 		const installerCompileOptions: any = {
-			target: `bun-${targetOSName}-${ARCH}`,
+			target: `bun-${targetOSName}-${targetArch}`,
 			outfile: outputPath,
 		};
 
-		if (isWindows) {
+		if (isWindows && OS !== "win") {
+			// Bun only applies windows compile options on a Windows host; the
+			// console is still hidden by patchPeSubsystem below (works anywhere).
+			console.warn(
+				`\n⚠️  Cross-compiling the Windows installer: icon and PE metadata (title, version, publisher, etc.) will be ignored.\n` +
+				`   Build on a Windows host if the installer exe needs them.\n`
+			);
+		} else if (isWindows) {
 			let icoPath: string | undefined;
 			if (config.build.win?.icon) {
 				const iconSrc = config.build.win.icon.startsWith("/") || config.build.win.icon.match(/^[a-zA-Z]:/)

package/src/installer/installer-template.ts

@@ -92,6 +92,36 @@ function getInstallDir(meta: Metadata): string {
 	}
 }
 
+// Create a .lnk via WScript.Shell. windowsHide is essential: the installer is a
+// GUI-subsystem exe, so without it each PowerShell child allocates its own
+// visible console window mid-install. PowerShell is called by absolute path
+// (PATH isn't reliable in every launch context), and the paths are passed
+// through the environment ($env:SB_*) rather than interpolated into the script
+// text, so an app name containing quotes can't break or inject into the command.
+function createShortcut(lnkPath: string, targetPath: string, workingDir: string) {
+	const systemRoot = process.env.SystemRoot || process.env.windir || "C:\\Windows";
+	const powershell = join(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+	const script =
+		"$ws = New-Object -ComObject WScript.Shell;" +
+		" $s = $ws.CreateShortcut($env:SB_LNK);" +
+		" $s.TargetPath = $env:SB_TARGET;" +
+		" $s.WorkingDirectory = $env:SB_WORKDIR;" +
+		" $s.Save()";
+	try {
+		Bun.spawnSync([powershell, "-NoProfile", "-Command", script], {
+			stdout: "ignore",
+			stderr: "ignore",
+			windowsHide: true,
+			env: {
+				...process.env,
+				SB_LNK: lnkPath,
+				SB_TARGET: targetPath,
+				SB_WORKDIR: workingDir,
+			},
+		});
+	} catch {}
+}
+
 async function createWindowsShortcuts(appDir: string, meta: Metadata) {
 	const binDir = join(appDir, "bin");
 	const exePath = join(binDir, `${meta.name.replace(/ /g, "")}.exe`);
@@ -100,19 +130,11 @@ async function createWindowsShortcuts(appDir: string, meta: Metadata) {
 
 	// Start Menu shortcut
 	const startMenu = join(process.env.APPDATA || "", "Microsoft", "Windows", "Start Menu", "Programs");
-	try {
-		Bun.spawnSync(["powershell", "-NoProfile", "-Command",
-			`$ws = New-Object -ComObject WScript.Shell; $s = $ws.CreateShortcut('${join(startMenu, meta.name + ".lnk")}'); $s.TargetPath = '${exePath}'; $s.WorkingDirectory = '${binDir}'; $s.Save()`
-		]);
-	} catch {}
+	createShortcut(join(startMenu, meta.name + ".lnk"), exePath, binDir);
 
 	// Desktop shortcut
-	try {
-		const desktop = join(process.env.USERPROFILE || "", "Desktop");
-		Bun.spawnSync(["powershell", "-NoProfile", "-Command",
-			`$ws = New-Object -ComObject WScript.Shell; $s = $ws.CreateShortcut('${join(desktop, meta.name + ".lnk")}'); $s.TargetPath = '${exePath}'; $s.WorkingDirectory = '${binDir}'; $s.Save()`
-		]);
-	} catch {}
+	const desktop = join(process.env.USERPROFILE || "", "Desktop");
+	createShortcut(join(desktop, meta.name + ".lnk"), exePath, binDir);
 
 	console.log("Created Start Menu and Desktop shortcuts");
 }