feat(launcher): use private Bun for all release launchers

src/main/runtime/command-line-launcher.ts

@@ -5,10 +5,8 @@ import {
   cleanupOldWindowsManagedRuntimes,
   isManagedLauncher,
   managedLauncherContent,
-  managedLauncherPaths,
   shellQuote,
   stageManagedLauncher,
-  windowsManagedRuntimePaths,
 } from './managed-launcher';
 import {
   accessSyncOf,
@@ -174,9 +172,11 @@ export function resolveLauncherResourcePath(options: CommonOptions): string {
   if (options.launcherResourcePath) return options.launcherResourcePath;
   const resourcesPath =
     options.resourcesPath ?? (process as typeof process & { resourcesPath?: string }).resourcesPath;
-  const packaged = resourcesPath ? platformPath.join(resourcesPath, 'launcher', 'subminer') : null;
+  const packaged = resourcesPath
+    ? platformPath.join(resourcesPath, 'launcher', 'subminer.js')
+    : null;
   if (packaged && existsSyncOf(options)(packaged)) return packaged;
-  return platformPath.join(options.cwd ?? process.cwd(), 'dist', 'launcher', 'subminer');
+  return platformPath.join(options.cwd ?? process.cwd(), 'dist', 'launcher', 'subminer.js');
 }
 
 function isWritableDir(candidate: string, options: CommonOptions): boolean {
@@ -313,21 +313,10 @@ export async function detectLauncher(
         message: 'Reinstall the launcher to use the runtime included with SubMiner.',
       };
     }
-    const payload =
-      platform === 'linux'
-        ? managedLauncherPaths(options)
-        : {
-            bunPath:
-              platform === 'win32'
-                ? windowsManagedRuntimePaths(options).bunPath
-                : options.bundledBunPath,
-            scriptPath: launcherResourcePath,
-          };
     if (
       content !==
       managedLauncherContent({
         platform,
-        ...payload,
         appPath: envOf(options).APPIMAGE ?? appExePath,
       })
     ) {
@@ -420,7 +409,7 @@ export async function installLauncher(
         message: bun.message ?? 'The included launcher runtime failed to start.',
       };
     try {
-      const payload = stageManagedLauncher({
+      stageManagedLauncher({
         ...options,
         bundledBunPath: options.bundledBunPath,
         launcherResourcePath,
@@ -431,7 +420,6 @@ export async function installLauncher(
         target.installPath,
         managedLauncherContent({
           platform,
-          ...payload,
           appPath: envOf(options).APPIMAGE ?? options.appExePath ?? process.execPath,
         }),
       );
@@ -577,7 +565,23 @@ export async function refreshManagedCommandLineLauncher(
   for (const candidate of candidates) {
     if (!existsSyncOf(options)(candidate)) continue;
     const existing = String(readFile(candidate, 'utf8'));
-    if (!isManagedLauncher(existing)) continue;
+    const legacy =
+      (existing.startsWith('#!/usr/bin/env bun\n') &&
+        (existing.includes('SubMiner launcher') ||
+          existing.includes('Launch MPV with SubMiner'))) ||
+      (platform === 'win32' &&
+        existing ===
+          windowsShimContent(
+            options.appExePath ?? process.execPath,
+            resolveLauncherResourcePath(options).replace(/subminer\.js$/, 'subminer'),
+          ));
+    if (!isManagedLauncher(existing) && !legacy) continue;
+    if (!isWritableDir(pathModuleFor(platform).dirname(candidate), options)) continue;
+    try {
+      accessSyncOf(options)(candidate, fs.constants.W_OK);
+    } catch {
+      continue;
+    }
     payload ??= stageManagedLauncher({
       ...options,
       bundledBunPath: options.bundledBunPath,
@@ -585,7 +589,6 @@ export async function refreshManagedCommandLineLauncher(
     });
     const content = managedLauncherContent({
       platform,
-      ...payload,
       appPath: envOf(options).APPIMAGE ?? options.appExePath ?? process.execPath,
     });
     if (existing !== content) (options.writeFileSync ?? fs.writeFileSync)(candidate, content);

src/main/runtime/managed-launcher.test.ts

@@ -59,10 +59,16 @@ test('packaged POSIX launcher works without Bun on PATH and survives AppImage un
     'console.log(JSON.stringify({args:process.argv.slice(2),app:process.env.SUBMINER_BINARY_PATH,managed:process.env.SUBMINER_MANAGED_LAUNCHER}));',
   );
   const appPath = path.join(root, 'SubMiner.AppImage');
+  fs.writeFileSync(appPath, '#!/bin/sh\nexit 73\n', { mode: 0o755 });
   const options = {
     platform: process.platform,
     homeDir: path.join(root, 'home'),
-    env: { PATH: bin, XDG_DATA_HOME: path.join(root, 'data'), APPIMAGE: appPath },
+    env: {
+      HOME: path.join(root, 'home'),
+      PATH: bin,
+      XDG_DATA_HOME: path.join(root, 'data'),
+      APPIMAGE: appPath,
+    },
     appExePath: path.join(resources, 'SubMiner'),
     appVersion: '1.0.0',
     bundledBunPath,
@@ -85,13 +91,20 @@ test('packaged POSIX launcher works without Bun on PATH and survives AppImage un
 test('setup can install into a new user bin despite an empty GUI PATH', async (t) => {
   if (process.platform === 'win32') return;
   const root = workspace(t);
-  const script = path.join(root, 'launcher');
+  const appPath = path.join(root, 'SubMiner.app', 'Contents', 'MacOS', 'SubMiner');
+  const resources = path.join(root, 'SubMiner.app', 'Contents', 'Resources');
+  fs.mkdirSync(path.dirname(appPath), { recursive: true });
+  fs.mkdirSync(path.join(resources, 'bun'), { recursive: true });
+  fs.mkdirSync(path.join(resources, 'launcher'), { recursive: true });
+  fs.writeFileSync(appPath, '#!/bin/sh\nexit 73\n', { mode: 0o755 });
+  fs.symlinkSync(process.execPath, path.join(resources, 'bun', 'bun'));
+  const script = path.join(resources, 'launcher', 'subminer.js');
   fs.writeFileSync(script, 'console.log("help");');
   const snapshot = await installLauncher({
     platform: 'darwin',
     homeDir: root,
     env: { PATH: '' },
-    appExePath: '/Applications/SubMiner.app/Contents/MacOS/SubMiner',
+    appExePath: appPath,
     bundledBunPath: process.execPath,
     launcherResourcePath: script,
   });
@@ -105,42 +118,58 @@ test('setup can install into a new user bin despite an empty GUI PATH', async (t
   assert.equal(result.status, 0, result.stderr);
 });
 
-test('app upgrades refresh Linux managed payloads and leave standalone launchers alone', async (t) => {
+test('app upgrades refresh payloads, migrate legacy Bun launchers, and preserve custom scripts', async (t) => {
   if (process.platform !== 'linux') return;
   const root = workspace(t);
   const bin = path.join(root, 'bin');
   fs.mkdirSync(bin, { recursive: true });
   const script = path.join(root, 'resource');
   fs.writeFileSync(script, 'console.log("old");');
+  const appPath = path.join(root, 'SubMiner.AppImage');
+  fs.writeFileSync(appPath, '#!/bin/sh\nexit 73\n', { mode: 0o755 });
   const options = {
     platform: process.platform,
     homeDir: root,
-    env: { PATH: bin },
+    env: { HOME: root, PATH: bin },
     appVersion: '1',
-    appExePath: '/apps/SubMiner.AppImage',
+    appExePath: appPath,
     bundledBunPath: process.execPath,
     launcherResourcePath: script,
   };
   assert.equal((await installLauncher(options)).status, 'ready');
   fs.writeFileSync(script, 'console.log("new");');
-  await refreshManagedCommandLineLauncher({ ...options, env: { PATH: '' }, appVersion: '2' });
+  await refreshManagedCommandLineLauncher({
+    ...options,
+    env: { HOME: root, PATH: '' },
+    appVersion: '2',
+  });
   const payload = managedLauncherPaths(options);
   assert.equal(fs.readFileSync(payload.scriptPath, 'utf8'), 'console.log("new");');
-  fs.writeFileSync(path.join(bin, 'subminer'), '#!/bin/sh\necho standalone\n');
+  fs.writeFileSync(path.join(bin, 'subminer'), '#!/usr/bin/env bun\n// SubMiner launcher\n');
   await refreshManagedCommandLineLauncher({ ...options, appVersion: '3' });
-  assert.equal(fs.readFileSync(payload.versionPath, 'utf8'), '2');
+  assert.match(fs.readFileSync(path.join(bin, 'subminer'), 'utf8'), /SubMiner managed launcher/);
+  fs.writeFileSync(path.join(bin, 'subminer'), '#!/bin/sh\necho standalone\n');
+  await refreshManagedCommandLineLauncher({ ...options, appVersion: '4' });
+  assert.equal(fs.readFileSync(payload.versionPath, 'utf8'), '3');
 });
 
-test('Windows wrapper uses quoted absolute Bun and disables delayed expansion', () => {
+test('Windows wrapper discovers the configured app and its versioned private runtime', () => {
   const content = managedLauncherContent({
     platform: 'win32',
-    bunPath: 'C:\\Apps & Tools\\100%\\bun.exe',
-    scriptPath: 'C:\\Apps & Tools\\subminer',
-    appPath: 'C:\\Apps!\\SubMiner.exe',
+    appPath: 'C:\\Apps 100% !\\SubMiner.exe',
   });
   assert.ok(content.includes(MANAGED_LAUNCHER_MARKER));
   assert.ok(content.includes('setlocal DisableDelayedExpansion'));
-  assert.ok(content.includes('"C:\\Apps & Tools\\100%%\\bun.exe" "C:\\Apps & Tools\\subminer" %*'));
+  assert.ok(content.includes('set "SUBMINER_BINARY_PATH=C:\\Apps 100%% !\\SubMiner.exe"'));
+  assert.ok(content.includes('%SUBMINER_RESOURCES_PATH%\\launcher\\version'));
+  assert.ok(
+    content.includes(
+      'set "SUBMINER_BUN_PATH=%LOCALAPPDATA%\\SubMiner\\launcher-runtime\\%SUBMINER_APP_VERSION%\\bun.exe"',
+    ),
+  );
+  assert.ok(
+    content.includes('"%SUBMINER_BUN_PATH%" "%SUBMINER_RESOURCES_PATH%\\launcher\\subminer.js" %*'),
+  );
   assert.ok(content.includes('exit /b %errorlevel%'));
 });
 
@@ -178,14 +207,20 @@ test('Windows managed runtime path is absolute, versioned, and injectable', () =
 test('Windows managed launcher forwards arguments without a system Bun', async (t) => {
   if (process.platform !== 'win32') return;
   const root = workspace(t);
-  const script = path.join(root, 'script.js');
+  const appDirectory = path.join(root, 'Installed App');
+  const appPath = path.join(appDirectory, 'SubMiner.exe');
+  const launcherDirectory = path.join(appDirectory, 'resources', 'launcher');
+  const script = path.join(launcherDirectory, 'subminer.js');
+  fs.mkdirSync(launcherDirectory, { recursive: true });
+  fs.copyFileSync(process.execPath, appPath);
   fs.writeFileSync(script, 'console.log(JSON.stringify(process.argv.slice(2)));');
+  fs.writeFileSync(path.join(launcherDirectory, 'version'), '1.0.0');
   const options = {
     platform: process.platform,
-    env: { ...process.env, PATH: '' },
+    env: { ...process.env, PATH: '', LOCALAPPDATA: root },
     bundledBunPath: process.execPath,
     launcherResourcePath: script,
-    appExePath: path.join(root, 'SubMiner.exe'),
+    appExePath: appPath,
     appVersion: '1.0.0',
     localAppData: root,
     getUserPath: () => '',

src/main/runtime/managed-launcher.ts

@@ -1,4 +1,7 @@
 import { randomUUID } from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import { windowsLauncherBootstrapContent } from './windows-launcher-bootstrap';
+import { MANAGED_LAUNCHER_MARKER, posixLauncherBootstrapContent } from './posix-launcher-bootstrap';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -11,7 +14,7 @@ import {
   type WindowsPathOptions,
 } from './command-line-launcher-deps';
 
-export const MANAGED_LAUNCHER_MARKER = 'SubMiner managed launcher (bundled runtime)';
+export { MANAGED_LAUNCHER_MARKER, shellQuote } from './posix-launcher-bootstrap';
 
 export function isManagedLauncher(content: string): boolean {
   const lines = content.split(/\r?\n/, 3);
@@ -21,43 +24,12 @@ export function isManagedLauncher(content: string): boolean {
   );
 }
 
-export function shellQuote(value: string): string {
-  return `'${value.replaceAll("'", "'\\''")}'`;
-}
-
-function windowsLiteral(value: string): string {
-  if (/["\r\n]/.test(value)) throw new Error('Launcher paths cannot contain quotes or newlines.');
-  return value.replaceAll('%', '%%');
-}
-
 export function managedLauncherContent(options: {
   platform: NodeJS.Platform;
-  bunPath: string;
-  scriptPath: string;
   appPath: string;
 }): string {
-  if (options.platform === 'win32') {
-    return [
-      '@echo off',
-      `rem ${MANAGED_LAUNCHER_MARKER}`,
-      'setlocal DisableDelayedExpansion',
-      'set "SUBMINER_MANAGED_LAUNCHER=1"',
-      'set "SUBMINER_LAUNCHER_PATH=%~f0"',
-      `set "SUBMINER_BINARY_PATH=${windowsLiteral(options.appPath)}"`,
-      `"${windowsLiteral(options.bunPath)}" "${windowsLiteral(options.scriptPath)}" %*`,
-      'exit /b %errorlevel%',
-      '',
-    ].join('\r\n');
-  }
-  return [
-    '#!/bin/sh',
-    `# ${MANAGED_LAUNCHER_MARKER}`,
-    'export SUBMINER_MANAGED_LAUNCHER=1',
-    'export SUBMINER_LAUNCHER_PATH="$0"',
-    `export SUBMINER_BINARY_PATH=${shellQuote(options.appPath)}`,
-    `exec ${shellQuote(options.bunPath)} ${shellQuote(options.scriptPath)} "$@"`,
-    '',
-  ].join('\n');
+  if (options.platform === 'win32') return windowsLauncherBootstrapContent(options.appPath);
+  return posixLauncherBootstrapContent(options.appPath);
 }
 
 export function managedLauncherPaths(options: CommonOptions) {
@@ -65,7 +37,7 @@ export function managedLauncherPaths(options: CommonOptions) {
   const platformPath = pathModuleFor(platform);
   const env = envOf(options);
   const home = options.homeDir ?? os.homedir();
-  const dataHome = env.XDG_DATA_HOME?.trim();
+  const dataHome = env.XDG_DATA_HOME;
   const directory = platformPath.join(
     dataHome && platformPath.isAbsolute(dataHome)
       ? dataHome
@@ -78,6 +50,8 @@ export function managedLauncherPaths(options: CommonOptions) {
     bunPath: platformPath.join(directory, 'bun'),
     scriptPath: platformPath.join(directory, 'subminer'),
     versionPath: platformPath.join(directory, 'version'),
+    fingerprintPath: platformPath.join(directory, 'fingerprint'),
+    appPathFile: platformPath.join(directory, 'app-path'),
   };
 }
 
@@ -203,10 +177,21 @@ export function stageManagedLauncher(
   const mkdir = options.mkdirSync ?? fs.mkdirSync;
   const chmod = options.chmodSync ?? fs.chmodSync;
   const version = options.appVersion ?? 'development';
+  const appPath = envOf(options).APPIMAGE ?? options.appExePath;
+  const fingerprint = appPath
+    ? execFileSync('stat', ['-Lc', '%d:%i:%s:%y:%z', '--', appPath], {
+        encoding: 'utf8',
+        env: { ...envOf(options), PATH: `/usr/bin:/bin:${envOf(options).PATH ?? ''}` },
+      }).trim()
+    : '';
   if (
     !options.force &&
     exists(paths.versionPath) &&
     read(paths.versionPath, 'utf8') === version &&
+    exists(paths.fingerprintPath) &&
+    read(paths.fingerprintPath, 'utf8') === `${fingerprint}\n` &&
+    exists(paths.appPathFile) &&
+    read(paths.appPathFile, 'utf8') === `${appPath ?? ''}\n` &&
     exists(paths.bunPath) &&
     exists(paths.scriptPath)
   )
@@ -222,7 +207,9 @@ export function stageManagedLauncher(
     if (exists(notices))
       fs.cpSync(notices, path.join(paths.directory, 'licenses'), { recursive: true });
     write(path.join(staging, 'version'), version);
-    for (const name of ['bun', 'subminer', 'version']) {
+    write(path.join(staging, 'app-path'), `${appPath ?? ''}\n`);
+    write(path.join(staging, 'fingerprint'), `${fingerprint}\n`);
+    for (const name of ['bun', 'subminer', 'version', 'app-path', 'fingerprint']) {
       fs.renameSync(path.join(staging, name), path.join(paths.directory, name));
     }
   } finally {

src/main/runtime/posix-launcher-bootstrap.test.ts

@@ -0,0 +1,66 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import test from 'node:test';
+import { posixLauncherBootstrapContent, shellQuote } from './posix-launcher-bootstrap';
+
+test('downloaded launcher prepares once, survives unmount, and refreshes after app replacement', (t) => {
+  if (process.platform !== 'linux') return;
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "subminer bootstrap's "));
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  const appPath = path.join(root, 'SubMiner.AppImage');
+  const resources = path.join(root, 'mount', 'resources');
+  fs.mkdirSync(path.join(resources, 'launcher'), { recursive: true });
+  fs.mkdirSync(path.join(resources, 'bun', 'licenses'), { recursive: true });
+  fs.symlinkSync(process.execPath, path.join(resources, 'bun', 'bun'));
+  fs.writeFileSync(path.join(resources, 'bun', 'licenses', 'notice'), 'Bun notice');
+  fs.writeFileSync(path.join(resources, 'launcher', 'version'), '1.0.0\n');
+  fs.writeFileSync(
+    path.join(resources, 'launcher', 'prepare.cjs'),
+    `exports.prepareLauncherRuntime = require(${JSON.stringify(path.join(__dirname, 'prepare-launcher-runtime.ts'))}).prepareLauncherRuntime;`,
+  );
+  const script = (version: number) =>
+    `console.log(JSON.stringify({version:${version},args:process.argv.slice(2)}));`;
+  fs.writeFileSync(path.join(resources, 'launcher', 'subminer.js'), script(1));
+  const prepares = path.join(root, 'preparations');
+  const appContent = `#!/bin/sh\necho prepared >> ${shellQuote(prepares)}\nexport APPDIR=${shellQuote(path.dirname(resources))}\nexec ${shellQuote(process.execPath)} "$@"\n`;
+  fs.writeFileSync(appPath, appContent, { mode: 0o755 });
+  const wrapper = path.join(root, 'subminer');
+  fs.writeFileSync(wrapper, posixLauncherBootstrapContent(), { mode: 0o755 });
+  const env = { HOME: root, PATH: '', SUBMINER_BINARY_PATH: appPath };
+  const args = ['space here', "a'b", 'a&b', '$(touch nope)', '日本語'];
+  const run = (extraEnv = {}) =>
+    spawnSync(wrapper, args, { env: { ...env, ...extraEnv }, encoding: 'utf8' });
+  const first = run();
+  assert.equal(first.status, 0, first.stderr);
+  assert.deepEqual(JSON.parse(first.stdout), { version: 1, args });
+  const cache = path.join(root, '.local', 'share', 'SubMiner', 'launcher');
+  assert.equal(fs.readFileSync(path.join(cache, 'licenses', 'notice'), 'utf8'), 'Bun notice');
+
+  fs.renameSync(resources, `${resources}.unmounted`);
+  const warm = run({ SUBMINER_BINARY_PATH: '' }); // Finds the app recorded by preparation.
+  assert.equal(warm.status, 0, warm.stderr);
+  assert.deepEqual(JSON.parse(warm.stdout), { version: 1, args });
+  assert.equal(fs.readFileSync(prepares, 'utf8'), 'prepared\n');
+  fs.renameSync(`${resources}.unmounted`, resources);
+
+  // Same version and path, new inode: manual replacement must still refresh.
+  fs.writeFileSync(`${appPath}.new`, appContent, { mode: 0o755 });
+  fs.renameSync(`${appPath}.new`, appPath);
+  fs.writeFileSync(path.join(resources, 'launcher', 'subminer.js'), script(2));
+  const updated = run();
+  assert.equal(updated.status, 0, updated.stderr);
+  assert.deepEqual(JSON.parse(updated.stdout), { version: 2, args });
+  assert.equal(fs.readFileSync(prepares, 'utf8'), 'prepared\nprepared\n');
+
+  fs.unlinkSync(path.join(cache, 'bun'));
+  assert.equal(run().status, 0);
+  assert.equal(fs.readFileSync(prepares, 'utf8'), 'prepared\nprepared\nprepared\n');
+
+  fs.writeFileSync(appPath, '#!/bin/sh\nexit 42\n', { mode: 0o755 });
+  const failed = run();
+  assert.equal(failed.status, 42);
+  assert.equal(failed.stdout, ''); // Never silently execute stale CLI after failed preparation.
+});

src/main/runtime/posix-launcher-bootstrap.ts

@@ -0,0 +1,56 @@
+export const MANAGED_LAUNCHER_MARKER = 'SubMiner managed launcher (bundled runtime)';
+
+export function shellQuote(value: string): string {
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
+
+// Only a missing or stale Linux cache starts Electron in Node mode. Normal
+// launches do one stat and execute the cached Bun and matching CLI directly.
+export function posixLauncherBootstrapContent(appPath = ''): string {
+  return `#!/bin/sh
+# ${MANAGED_LAUNCHER_MARKER}
+export SUBMINER_MANAGED_LAUNCHER=1
+export SUBMINER_LAUNCHER_PATH="$0"
+subminer_default_app=${shellQuote(appPath)}
+case "\${XDG_DATA_HOME:-}" in
+  /*) subminer_data="$XDG_DATA_HOME" ;;
+  *) subminer_data="$HOME/.local/share" ;;
+esac
+subminer_cache="$subminer_data/SubMiner/launcher"
+subminer_saved_app=
+if [ -f "$subminer_cache/app-path" ]; then
+  IFS= read -r subminer_saved_app < "$subminer_cache/app-path" || :
+fi
+subminer_app=
+for subminer_candidate in "\${SUBMINER_APPIMAGE_PATH:-}" "\${SUBMINER_BINARY_PATH:-}" "$subminer_default_app" "$subminer_saved_app" "$HOME/.local/bin/SubMiner.AppImage" /opt/SubMiner/SubMiner.AppImage /Applications/SubMiner.app/Contents/MacOS/SubMiner "$HOME/Applications/SubMiner.app/Contents/MacOS/SubMiner"; do
+  if [ -n "$subminer_candidate" ] && [ -x "$subminer_candidate" ]; then
+    subminer_app="$subminer_candidate"
+    break
+  fi
+done
+if [ -z "$subminer_app" ]; then
+  echo 'SubMiner app not found. Install the app or set SUBMINER_BINARY_PATH to its executable.' >&2
+  exit 1
+fi
+export SUBMINER_BINARY_PATH="$subminer_app"
+case "$subminer_app" in
+  */Contents/MacOS/*)
+    subminer_resources="\${subminer_app%/MacOS/*}/Resources"
+    if [ ! -x "$subminer_resources/bun/bun" ] || [ ! -f "$subminer_resources/launcher/subminer.js" ]; then
+      echo 'This launcher requires a SubMiner app with the included Bun runtime. Update SubMiner.' >&2
+      exit 1
+    fi
+    exec "$subminer_resources/bun/bun" "$subminer_resources/launcher/subminer.js" "$@"
+    ;;
+esac
+subminer_fingerprint=$(PATH="/usr/bin:/bin:$PATH" stat -Lc '%d:%i:%s:%y:%z' -- "$subminer_app") || exit 1
+subminer_cached_fingerprint=
+if [ -f "$subminer_cache/fingerprint" ]; then
+  IFS= read -r subminer_cached_fingerprint < "$subminer_cache/fingerprint" || :
+fi
+if [ "$subminer_app" != "$subminer_saved_app" ] || [ "$subminer_fingerprint" != "$subminer_cached_fingerprint" ] || [ ! -x "$subminer_cache/bun" ] || [ ! -f "$subminer_cache/subminer" ]; then
+  PATH="/usr/bin:/bin:$PATH" ELECTRON_RUN_AS_NODE=1 "$subminer_app" -e 'const p=require("node:path"); const r=process.env.APPDIR ? p.join(process.env.APPDIR,"resources") : p.join(p.dirname(process.execPath),"resources"); try { require(p.join(r,"launcher/prepare.cjs")).prepareLauncherRuntime({appPath:process.env.SUBMINER_BINARY_PATH,resourcesPath:r}); } catch(e) { console.error("Cannot prepare SubMiner launcher. Update or reinstall the SubMiner app.",e.message); process.exit(1); }' || exit $?
+fi
+exec "$subminer_cache/bun" "$subminer_cache/subminer" "$@"
+`;
+}

src/main/runtime/prepare-launcher-runtime.ts

@@ -0,0 +1,24 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { cleanupOldWindowsManagedRuntimes, stageManagedLauncher } from './managed-launcher';
+
+// Bundled separately as Node-compatible code so AppImages can prepare their
+// runtime without starting Electron's GUI, single-instance lock, or settings.
+export function prepareLauncherRuntime(options: { appPath: string; resourcesPath: string }) {
+  const appVersion = fs
+    .readFileSync(path.join(options.resourcesPath, 'launcher', 'version'), 'utf8')
+    .trim();
+  const payload = stageManagedLauncher({
+    appExePath: options.appPath,
+    appVersion,
+    bundledBunPath: path.join(
+      options.resourcesPath,
+      'bun',
+      process.platform === 'win32' ? 'bun.exe' : 'bun',
+    ),
+    launcherResourcePath: path.join(options.resourcesPath, 'launcher', 'subminer.js'),
+    force: process.platform === 'linux',
+  });
+  if (process.platform === 'win32') cleanupOldWindowsManagedRuntimes({ appVersion });
+  return payload;
+}

src/main/runtime/update/appimage-updater.test.ts

@@ -58,7 +58,7 @@ test('updateAppImageFromRelease verifies hash and atomically replaces writable A
   ]);
 });
 
-test('updateAppImageFromRelease reports protected command without replacing non-writable AppImage', async () => {
+test('updateAppImageFromRelease reports protected command for a direct non-writable AppImage', async () => {
   const result = await updateAppImageFromRelease({
     release: {
       tag_name: 'v0.15.0',
@@ -67,7 +67,7 @@ test('updateAppImageFromRelease reports protected command without replacing non-
       assets: [{ name: 'SubMiner.AppImage', browser_download_url: 'https://example.test/app' }],
     },
     sha256Sums: new Map([['SubMiner.AppImage', appImageHash]]),
-    appImagePath: '/opt/SubMiner/SubMiner.AppImage',
+    appImagePath: '/usr/local/lib/SubMiner.AppImage',
     downloadAsset: async () => appImageBytes,
     fs: {
       stat: async () => ({
@@ -87,10 +87,50 @@ test('updateAppImageFromRelease reports protected command without replacing non-
   });
 
   assert.equal(result.status, 'protected');
-  assert.equal(result.path, '/opt/SubMiner/SubMiner.AppImage');
+  assert.equal(result.path, '/usr/local/lib/SubMiner.AppImage');
   assert.match(result.command ?? '', /curl -fSL 'https:\/\/example\.test\/app' -o "\$tmp"/);
   assert.match(result.command ?? '', /sha256sum -c -/);
-  assert.match(result.command ?? '', /sudo mv "\$tmp" '\/opt\/SubMiner\/SubMiner\.AppImage'/);
+  assert.match(result.command ?? '', /sudo mv "\$tmp" '\/usr\/local\/lib\/SubMiner\.AppImage'/);
+});
+
+test('updateAppImageFromRelease leaves canonical and symlinked AUR AppImages to pacman', async () => {
+  for (const appImagePath of ['/opt/SubMiner/SubMiner.AppImage', '/usr/bin/SubMiner.AppImage']) {
+    let accessed = false;
+    const result = await updateAppImageFromRelease({
+      release: {
+        tag_name: 'v0.15.0',
+        prerelease: false,
+        draft: false,
+        assets: [{ name: 'SubMiner.AppImage', browser_download_url: 'https://example.test/app' }],
+      },
+      sha256Sums: new Map([['SubMiner.AppImage', appImageHash]]),
+      appImagePath,
+      downloadAsset: async () => {
+        throw new Error('must not download package-managed AppImage');
+      },
+      fs: {
+        realpath: async () => '/opt/SubMiner/SubMiner.AppImage',
+        stat: async () => {
+          throw new Error('must not stat package-managed AppImage');
+        },
+        access: async () => {
+          accessed = true;
+        },
+        writeFile: async () => {},
+        chmod: async () => {},
+        rename: async () => {},
+        unlink: async () => {},
+      },
+    });
+
+    assert.deepEqual(result, {
+      status: 'skipped',
+      path: appImagePath,
+      message: 'This AppImage is managed by the subminer-bin system package.',
+    });
+    assert.equal(accessed, false);
+    assert.equal(result.command, undefined);
+  }
 });
 
 test('buildProtectedAppImageUpdateCommand quotes inputs and verifies checksum before sudo move', () => {

src/main/runtime/update/appimage-updater.ts

@@ -25,6 +25,7 @@ export interface AppImageUpdateResult {
 }
 
 export interface AppImageUpdateFileSystem {
+  realpath?: (targetPath: string) => Promise<string>;
   stat: (targetPath: string) => Promise<StatLike>;
   access: (targetPath: string) => Promise<void>;
   writeFile: (targetPath: string, data: Buffer) => Promise<void>;
@@ -39,6 +40,7 @@ function sha256(data: Buffer): string {
 
 function defaultFs(): AppImageUpdateFileSystem {
   return {
+    realpath: (targetPath) => fs.promises.realpath(targetPath),
     stat: (targetPath) => fs.promises.stat(targetPath),
     access: async (targetPath) => {
       await fs.promises.access(targetPath, fs.constants.W_OK);
@@ -105,6 +107,19 @@ export async function updateAppImageFromRelease(options: {
   }
 
   const fsDeps = options.fs ?? defaultFs();
+  let resolvedAppImagePath = options.appImagePath;
+  try {
+    resolvedAppImagePath = (await fsDeps.realpath?.(options.appImagePath)) ?? options.appImagePath;
+  } catch {
+    // stat below reports a missing or inaccessible path with the existing result shape.
+  }
+  if (resolvedAppImagePath === '/opt/SubMiner/SubMiner.AppImage') {
+    return {
+      status: 'skipped',
+      path: options.appImagePath,
+      message: 'This AppImage is managed by the subminer-bin system package.',
+    };
+  }
   let stat: StatLike;
   try {
     stat = await fsDeps.stat(options.appImagePath);

src/main/runtime/update/launcher-updater.test.ts

@@ -5,6 +5,7 @@ import {
   buildProtectedLauncherUpdateCommand,
   looksLikeSubminerLauncher,
   updateLauncherAtPath,
+  updateLauncherFromRelease,
 } from './launcher-updater';
 
 const launcherBytes = Buffer.from('#!/usr/bin/env bash\n# SubMiner launcher\nexec SubMiner "$@"\n');
@@ -141,8 +142,6 @@ test('app-managed wrappers are never overwritten by the standalone release scrip
       readFile: async () =>
         managedLauncherContent({
           platform: 'linux',
-          bunPath: '/private/bun',
-          scriptPath: '/private/subminer',
           appPath: '/apps/SubMiner.AppImage',
         }),
       access: async () => {
@@ -159,3 +158,72 @@ test('app-managed wrappers are never overwritten by the standalone release scrip
   assert.equal(result.status, 'skipped');
   assert.equal(downloaded, false);
 });
+
+test('GUI updates defer recognized standalone launcher migration to app startup', async () => {
+  let accessed = false;
+  let downloaded = false;
+  const result = await updateLauncherAtPath({
+    launcherPath: '/home/tester/.local/bin/subminer',
+    assetUrl: 'https://example.test/subminer',
+    expectedSha256: launcherHash,
+    deferRecognizedLauncherUpdate: true,
+    download: async () => {
+      downloaded = true;
+      return launcherBytes;
+    },
+    fs: {
+      stat: async () => ({ isFile: () => true }),
+      readFile: async () => Buffer.from('#!/bin/sh\n# SubMiner launcher\n'),
+      access: async () => {
+        accessed = true;
+      },
+      writeFile: async () => {},
+      chmod: async () => {},
+      rename: async () => {},
+      unlink: async () => {},
+    },
+  });
+
+  assert.deepEqual(result, {
+    status: 'skipped',
+    path: '/home/tester/.local/bin/subminer',
+    message: 'Launcher migration is deferred until the updated SubMiner app starts.',
+  });
+  assert.equal(accessed, false);
+  assert.equal(downloaded, false);
+});
+
+test('release launcher updater propagates GUI migration deferral', async () => {
+  let downloaded = false;
+  const result = await updateLauncherFromRelease({
+    release: {
+      tag_name: 'v0.15.0',
+      prerelease: false,
+      draft: false,
+      assets: [{ name: 'subminer', browser_download_url: 'https://example.test/subminer' }],
+    },
+    sha256Sums: new Map([['subminer', launcherHash]]),
+    launcherPath: '/home/tester/.local/bin/subminer',
+    deferRecognizedLauncherUpdate: true,
+    exists: () => true,
+    downloadAsset: async () => {
+      downloaded = true;
+      return launcherBytes;
+    },
+    fs: {
+      stat: async () => ({ isFile: () => true }),
+      readFile: async () => Buffer.from('#!/bin/sh\n# SubMiner launcher\n'),
+      access: async () => {
+        throw new Error('must not check writability before app startup');
+      },
+      writeFile: async () => {},
+      chmod: async () => {},
+      rename: async () => {},
+      unlink: async () => {},
+    },
+  });
+
+  assert.equal(result.status, 'skipped');
+  assert.match(result.message ?? '', /deferred until the updated SubMiner app starts/);
+  assert.equal(downloaded, false);
+});

src/main/runtime/update/launcher-updater.ts

@@ -83,6 +83,7 @@ export async function updateLauncherAtPath(options: {
   assetUrl: string;
   expectedSha256: string;
   download: () => Promise<Buffer>;
+  deferRecognizedLauncherUpdate?: boolean;
   fs?: LauncherUpdateFileSystem;
 }): Promise<LauncherUpdateResult> {
   const fsDeps = options.fs ?? defaultFs();
@@ -111,6 +112,13 @@ export async function updateLauncherAtPath(options: {
       message: 'Existing executable does not look like a SubMiner launcher.',
     };
   }
+  if (options.deferRecognizedLauncherUpdate) {
+    return {
+      status: 'skipped',
+      path: options.launcherPath,
+      message: 'Launcher migration is deferred until the updated SubMiner app starts.',
+    };
+  }
 
   try {
     await fsDeps.access(options.launcherPath);
@@ -168,7 +176,9 @@ export async function updateLauncherFromRelease(options: {
   platform?: NodeJS.Platform;
   homeDir?: string;
   downloadAsset: (url: string) => Promise<Buffer>;
+  deferRecognizedLauncherUpdate?: boolean;
   exists?: (targetPath: string) => boolean;
+  fs?: LauncherUpdateFileSystem;
 }): Promise<LauncherUpdateResult> {
   if (!options.release) return { status: 'missing-asset', message: 'No release found.' };
   const asset = findReleaseAsset(options.release, 'subminer');
@@ -192,5 +202,7 @@ export async function updateLauncherFromRelease(options: {
     assetUrl: asset.browser_download_url,
     expectedSha256,
     download: () => options.downloadAsset(asset.browser_download_url),
+    deferRecognizedLauncherUpdate: options.deferRecognizedLauncherUpdate,
+    fs: options.fs,
   });
 }

src/main/runtime/update/update-service-runtime.ts

@@ -79,6 +79,7 @@ export function createUpdateServiceRuntime(deps: UpdateServiceRuntimeDeps): {
       sha256Sums: sums,
       launcherPath,
       downloadAsset: (url) => fetchReleaseAssetBuffer(fetchForUpdater, url),
+      deferRecognizedLauncherUpdate: true,
     });
     return runSupportAssetUpdatesForLauncherResult({
       launcherResult,

src/main/runtime/windows-launcher-bootstrap.test.ts

@@ -0,0 +1,127 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import { getRunCommand } from './command-line-launcher-deps';
+import { windowsLauncherBootstrapContent } from './windows-launcher-bootstrap';
+
+function workspace(t: test.TestContext): string {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'subminer windows bootstrap '));
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  return root;
+}
+
+test('generic bootstrap searches supported Windows install locations in order', () => {
+  const content = windowsLauncherBootstrapContent();
+  const override = content.indexOf('if defined SUBMINER_BINARY_PATH goto subminer_app_found');
+  const localInstall = content.indexOf('%LOCALAPPDATA%\\Programs\\SubMiner\\SubMiner.exe');
+  const machineInstall = content.indexOf('%ProgramFiles%\\SubMiner\\SubMiner.exe');
+
+  assert.ok(override >= 0);
+  assert.ok(localInstall > override);
+  assert.ok(machineInstall > localInstall);
+  assert.match(content, /SubMiner app not found/);
+});
+
+test('configured app path is an escaped fallback after the environment override', () => {
+  const configured = 'D:\\Apps & Tools\\SubMiner 100% !\\SubMiner.exe';
+  const content = windowsLauncherBootstrapContent(configured);
+
+  assert.ok(
+    content.indexOf('if defined SUBMINER_BINARY_PATH goto subminer_app_found') <
+      content.indexOf('if not exist "D:\\Apps & Tools\\SubMiner 100%% !\\SubMiner.exe"'),
+  );
+  assert.match(
+    content,
+    /set "SUBMINER_BINARY_PATH=D:\\Apps & Tools\\SubMiner 100%% !\\SubMiner\.exe"/,
+  );
+  assert.throws(
+    () => windowsLauncherBootstrapContent('C:\\Bad "Install"\\SubMiner.exe'),
+    /quotes or newlines/,
+  );
+});
+
+test('cached runtime is the fast path and launcher arguments remain opaque to the batch file', () => {
+  const content = windowsLauncherBootstrapContent();
+  const cacheCheck = content.indexOf('if exist "%SUBMINER_BUN_PATH%" goto subminer_run');
+  const electronPrepare = content.indexOf('set "ELECTRON_RUN_AS_NODE=1"');
+  const run = content.indexOf(
+    '"%SUBMINER_BUN_PATH%" "%SUBMINER_RESOURCES_PATH%\\launcher\\subminer.js" %*',
+  );
+
+  assert.match(content, /^@echo off\r\nrem SubMiner managed launcher \(bundled runtime\)/);
+  assert.match(content, /setlocal DisableDelayedExpansion/);
+  assert.ok(cacheCheck >= 0);
+  assert.ok(electronPrepare > cacheCheck);
+  assert.ok(run > electronPrepare);
+  assert.doesNotMatch(content, /powershell/i);
+  assert.doesNotMatch(content, /^\s*(?:call\s+)?bun(?:\.exe)?(?:\s|$)/im);
+});
+
+test('preparation failures keep their exit code and never continue to the launcher', () => {
+  const content = windowsLauncherBootstrapContent();
+
+  assert.match(content, /set "SUBMINER_PREPARE_EXIT=%errorlevel%"/);
+  assert.match(content, /if not "%SUBMINER_PREPARE_EXIT%"=="0" exit \/b %SUBMINER_PREPARE_EXIT%/);
+  assert.match(content, /if not exist "%SUBMINER_BUN_PATH%" goto subminer_prepare_missing/);
+  assert.match(content, /set "ELECTRON_RUN_AS_NODE="/);
+});
+
+test('Windows bootstrap prepares once and forwards metacharacter arguments', async (t) => {
+  if (process.platform !== 'win32') return;
+
+  const root = workspace(t);
+  const appDirectory = path.join(root, 'Installed & App 100% !');
+  const appPath = path.join(appDirectory, 'SubMiner.exe');
+  const resourcesPath = path.join(appDirectory, 'resources');
+  const launcherDirectory = path.join(resourcesPath, 'launcher');
+  const localAppData = path.join(root, 'Local App Data');
+  const bootstrapPath = path.join(root, 'subminer.cmd');
+  const version = '1.2.3-test';
+  const cachedBunPath = path.join(localAppData, 'SubMiner', 'launcher-runtime', version, 'bun.exe');
+  fs.mkdirSync(launcherDirectory, { recursive: true });
+  fs.copyFileSync(process.execPath, appPath);
+  fs.writeFileSync(path.join(launcherDirectory, 'version'), version);
+  fs.writeFileSync(
+    path.join(launcherDirectory, 'subminer.js'),
+    'console.log(JSON.stringify({args:process.argv.slice(2),app:process.env.SUBMINER_BINARY_PATH,resources:process.env.SUBMINER_RESOURCES_PATH,managed:process.env.SUBMINER_MANAGED_LAUNCHER}));',
+  );
+  fs.writeFileSync(
+    path.join(launcherDirectory, 'prepare.cjs'),
+    `const fs=require('node:fs');const path=require('node:path');exports.prepareLauncherRuntime=()=>{const target=${JSON.stringify(cachedBunPath)};fs.mkdirSync(path.dirname(target),{recursive:true});fs.copyFileSync(process.execPath,target);};`,
+  );
+  fs.writeFileSync(bootstrapPath, windowsLauncherBootstrapContent(appPath));
+
+  const args = [
+    'spaces here',
+    '100%',
+    'bang!',
+    'a&b',
+    'x|y',
+    '<left>',
+    'caret^',
+    'say "hi"',
+    '日本語',
+  ];
+  const env = { ...process.env, PATH: '', Path: '', LOCALAPPDATA: localAppData };
+  const first = await getRunCommand({})(bootstrapPath, args, { env });
+  assert.equal(first.exitCode, 0, first.stderr);
+  assert.ok(fs.existsSync(cachedBunPath));
+  const firstPayload: unknown = JSON.parse(first.stdout);
+  assert.deepEqual(firstPayload, {
+    args,
+    app: appPath,
+    resources: resourcesPath,
+    managed: '1',
+  });
+
+  fs.writeFileSync(
+    path.join(launcherDirectory, 'prepare.cjs'),
+    "throw new Error('cached launch should not prepare');",
+  );
+  const second = await getRunCommand({})(bootstrapPath, args, { env });
+  assert.equal(second.exitCode, 0, second.stderr);
+  const secondPayload: unknown = JSON.parse(second.stdout);
+  assert.deepEqual(secondPayload, firstPayload);
+});

src/main/runtime/windows-launcher-bootstrap.ts

@@ -0,0 +1,75 @@
+const MANAGED_LAUNCHER_MARKER = 'SubMiner managed launcher (bundled runtime)';
+
+function windowsBatchLiteral(value: string): string {
+  if (/["\r\n]/.test(value)) {
+    throw new Error('Launcher paths cannot contain quotes or newlines.');
+  }
+  return value.replaceAll('%', '%%');
+}
+
+function configuredAppCandidate(appPath: string | undefined): string[] {
+  if (!appPath) return [];
+  const literal = windowsBatchLiteral(appPath);
+  return [
+    `if not exist "${literal}" goto subminer_check_local_app`,
+    `set "SUBMINER_BINARY_PATH=${literal}"`,
+    'goto subminer_app_found',
+  ];
+}
+
+// This command file stays valid across app updates. It locates the current app
+// and only starts Electron in Node mode when that version's private Bun is absent.
+export function windowsLauncherBootstrapContent(appPath?: string): string {
+  return [
+    '@echo off',
+    `rem ${MANAGED_LAUNCHER_MARKER}`,
+    'setlocal DisableDelayedExpansion',
+    'set "SUBMINER_MANAGED_LAUNCHER=1"',
+    'set "SUBMINER_LAUNCHER_PATH=%~f0"',
+    'if defined SUBMINER_BINARY_PATH goto subminer_app_found',
+    ...configuredAppCandidate(appPath),
+    ':subminer_check_local_app',
+    'if not defined LOCALAPPDATA goto subminer_check_program_files',
+    'if not exist "%LOCALAPPDATA%\\Programs\\SubMiner\\SubMiner.exe" goto subminer_check_program_files',
+    'set "SUBMINER_BINARY_PATH=%LOCALAPPDATA%\\Programs\\SubMiner\\SubMiner.exe"',
+    'goto subminer_app_found',
+    ':subminer_check_program_files',
+    'if not defined ProgramFiles goto subminer_app_missing',
+    'if not exist "%ProgramFiles%\\SubMiner\\SubMiner.exe" goto subminer_app_missing',
+    'set "SUBMINER_BINARY_PATH=%ProgramFiles%\\SubMiner\\SubMiner.exe"',
+    ':subminer_app_found',
+    'if not exist "%SUBMINER_BINARY_PATH%" goto subminer_app_missing',
+    'if not defined LOCALAPPDATA goto subminer_local_app_data_missing',
+    'for %%I in ("%SUBMINER_BINARY_PATH%") do set "SUBMINER_RESOURCES_PATH=%%~dpIresources"',
+    'if not exist "%SUBMINER_RESOURCES_PATH%\\launcher\\subminer.js" goto subminer_resources_missing',
+    'set "SUBMINER_APP_VERSION="',
+    'if not exist "%SUBMINER_RESOURCES_PATH%\\launcher\\version" goto subminer_resources_missing',
+    'set /p "SUBMINER_APP_VERSION="<"%SUBMINER_RESOURCES_PATH%\\launcher\\version"',
+    'if not defined SUBMINER_APP_VERSION goto subminer_resources_missing',
+    'set "SUBMINER_BUN_PATH=%LOCALAPPDATA%\\SubMiner\\launcher-runtime\\%SUBMINER_APP_VERSION%\\bun.exe"',
+    'if exist "%SUBMINER_BUN_PATH%" goto subminer_run',
+    'if not exist "%SUBMINER_RESOURCES_PATH%\\launcher\\prepare.cjs" goto subminer_resources_missing',
+    'set "ELECTRON_RUN_AS_NODE=1"',
+    "\"%SUBMINER_BINARY_PATH%\" -e \"const p=require('node:path');try{require(p.join(process.env.SUBMINER_RESOURCES_PATH,'launcher','prepare.cjs')).prepareLauncherRuntime({appPath:process.env.SUBMINER_BINARY_PATH,resourcesPath:process.env.SUBMINER_RESOURCES_PATH});}catch(error){console.error('Cannot prepare SubMiner launcher. Update or reinstall the SubMiner app.',error instanceof Error?error.message:String(error));process.exit(1);}\"",
+    'set "SUBMINER_PREPARE_EXIT=%errorlevel%"',
+    'set "ELECTRON_RUN_AS_NODE="',
+    'if not "%SUBMINER_PREPARE_EXIT%"=="0" exit /b %SUBMINER_PREPARE_EXIT%',
+    'if not exist "%SUBMINER_BUN_PATH%" goto subminer_prepare_missing',
+    ':subminer_run',
+    '"%SUBMINER_BUN_PATH%" "%SUBMINER_RESOURCES_PATH%\\launcher\\subminer.js" %*',
+    'exit /b %errorlevel%',
+    ':subminer_app_missing',
+    '>&2 echo SubMiner app not found. Install the app or set SUBMINER_BINARY_PATH to its executable.',
+    'exit /b 1',
+    ':subminer_local_app_data_missing',
+    '>&2 echo LOCALAPPDATA is unavailable. SubMiner cannot locate its private launcher runtime.',
+    'exit /b 1',
+    ':subminer_resources_missing',
+    '>&2 echo This launcher requires a SubMiner app with the included Bun runtime. Update SubMiner.',
+    'exit /b 1',
+    ':subminer_prepare_missing',
+    '>&2 echo SubMiner did not create its private launcher runtime. Update or reinstall SubMiner.',
+    'exit /b 1',
+    '',
+  ].join('\r\n');
+}

src/prerelease-workflow.test.ts

@@ -79,14 +79,14 @@ test('prerelease workflow builds and uploads all release platforms', () => {
   assert.match(prereleaseWorkflow, /name: windows/);
 });
 
-test('prerelease workflow publishes the same release assets as the stable workflow', () => {
+test('prerelease workflow publishes both launcher wrappers with the platform packages', () => {
   assert.match(
     prereleaseWorkflow,
-    /files=\(release\/\*\.AppImage release\/\*\.dmg release\/\*\.exe release\/\*\.zip release\/\*\.tar\.gz release\/latest\*\.yml release\/\*\.blockmap dist\/launcher\/subminer\)/,
+    /files=\(release\/\*\.AppImage release\/\*\.dmg release\/\*\.exe release\/\*\.zip release\/\*\.tar\.gz release\/latest\*\.yml release\/\*\.blockmap dist\/launcher\/subminer dist\/launcher\/subminer\.cmd\)/,
   );
   assert.match(
     prereleaseWorkflow,
-    /artifacts=\([\s\S]*release\/\*\.exe[\s\S]*release\/latest\*\.yml[\s\S]*release\/\*\.blockmap[\s\S]*release\/SHA256SUMS\.txt[\s\S]*\)/,
+    /artifacts=\([\s\S]*release\/\*\.exe[\s\S]*release\/latest\*\.yml[\s\S]*release\/\*\.blockmap[\s\S]*release\/SHA256SUMS\.txt[\s\S]*dist\/launcher\/subminer[\s\S]*dist\/launcher\/subminer\.cmd[\s\S]*\)/,
   );
 });
 

src/release-workflow.test.ts

@@ -16,6 +16,8 @@ const parsedReleaseWorkflow = readWorkflow(releaseWorkflowPath);
 const parsedDocsPagesWorkflow = readWorkflow(docsPagesWorkflowPath);
 const makefilePath = resolve(__dirname, '../Makefile');
 const makefile = readFileSync(makefilePath, 'utf8');
+const buildLauncherPath = resolve(__dirname, '../scripts/build-launcher.ts');
+const buildLauncher = readFileSync(buildLauncherPath, 'utf8');
 const packageJsonPath = resolve(__dirname, '../package.json');
 const packageJson = JSON.parse(readFileSync(packageJsonPath, 'utf8')) as {
   desktopName?: string;
@@ -32,6 +34,7 @@ const packageJson = JSON.parse(readFileSync(packageJsonPath, 'utf8')) as {
     extraResources?: Array<{
       from?: string;
       to?: string;
+      filter?: string[];
     }>;
     mac?: {
       artifactName?: string;
@@ -114,14 +117,14 @@ test('release workflow generates release notes from committed changelog output',
   assert.ok(!releaseWorkflow.includes('git log --pretty=format:"- %s"'));
 });
 
-test('release workflow includes the Windows installer in checksums and uploaded assets', () => {
+test('release workflow includes the Windows installer and both launcher wrappers in release assets', () => {
   assert.match(
     releaseWorkflow,
-    /files=\(release\/\*\.AppImage release\/\*\.dmg release\/\*\.exe release\/\*\.zip release\/\*\.tar\.gz release\/latest\*\.yml release\/\*\.blockmap dist\/launcher\/subminer\)/,
+    /files=\(release\/\*\.AppImage release\/\*\.dmg release\/\*\.exe release\/\*\.zip release\/\*\.tar\.gz release\/latest\*\.yml release\/\*\.blockmap dist\/launcher\/subminer dist\/launcher\/subminer\.cmd\)/,
   );
   assert.match(
     releaseWorkflow,
-    /artifacts=\([\s\S]*release\/\*\.exe[\s\S]*release\/latest\*\.yml[\s\S]*release\/\*\.blockmap[\s\S]*release\/SHA256SUMS\.txt[\s\S]*\)/,
+    /artifacts=\([\s\S]*release\/\*\.exe[\s\S]*release\/latest\*\.yml[\s\S]*release\/\*\.blockmap[\s\S]*release\/SHA256SUMS\.txt[\s\S]*dist\/launcher\/subminer[\s\S]*dist\/launcher\/subminer\.cmd[\s\S]*\)/,
   );
 });
 
@@ -196,15 +199,22 @@ test('release packaging keeps default file inclusion and excludes large source-o
   assert.ok(files.includes('!node_modules/@libsql/linux-x64-musl{,/**/*}'));
 });
 
-test('release packaging stages generated launcher as an app resource', () => {
-  assert.ok(
-    packageJson.build?.extraResources?.some(
-      (resource) =>
-        resource.from === 'dist/launcher/subminer' && resource.to === 'launcher/subminer',
-    ),
+test('release packaging stages only the generated launcher runtime artifacts', () => {
+  const launcherResource = packageJson.build?.extraResources?.find(
+    (resource) => resource.from === 'dist/launcher' && resource.to === 'launcher',
   );
+  assert.deepEqual(launcherResource?.filter, [
+    'subminer',
+    'subminer.cmd',
+    'subminer.js',
+    'prepare.cjs',
+    'version',
+  ]);
   assert.match(packageJson.scripts.build ?? '', /bun run build:launcher/);
-  assert.match(packageJson.scripts['build:launcher'] ?? '', /--banner='#!\/usr\/bin\/env bun'/);
+  assert.equal(packageJson.scripts['build:launcher'], 'bun run scripts/build-launcher.ts');
+  assert.match(buildLauncher, /banner: '#!\/usr\/bin\/env bun'/);
+  assert.match(buildLauncher, /posixLauncherBootstrapContent\(\)/);
+  assert.match(buildLauncher, /windowsLauncherBootstrapContent\(\)/);
 });
 
 test('release packaging does not reference removed Windows window helper script', () => {