Windows Application Control blocks unsigned hunk.exe; launcher reports UNKNOWN instead of falling back

[solankydev]

What happened?

On Windows x64, hunkdiff@0.17.1 installs successfully with npm, but running hunk fails with:

spawnSync %APPDATA%\npm\node_modules\hunkdiff\node_modules\hunkdiff-windows-x64\bin\hunk.exe UNKNOWN

Running the prebuilt executable directly exposes the underlying Windows error:

An Application Control policy has blocked this file.

PowerShell confirms that the distributed executable is not Authenticode-signed:

$hunkExe = "$env:APPDATA\npm\node_modules\hunkdiff\node_modules\hunkdiff-windows-x64\bin\hunk.exe"
Get-AuthenticodeSignature $hunkExe | Select-Object Status, StatusMessage

The signature status is NotSigned.

This appears to be two related problems:

1. The published Windows prebuilt executable is unsigned, so Windows Application Control / Smart App Control can block it.
2. The npm launcher surfaces only spawnSync ... UNKNOWN and exits instead of continuing to the bundled Bun/JavaScript fallback.

Steps to reproduce

On a Windows x64 system with Application Control enforcing trust for executables:

npm install --global hunkdiff
hunk --version

Expected behavior

Ideally, the Windows prebuilt executable is Authenticode-signed so Windows can validate its publisher.

If process creation of the native executable fails, the launcher should either:

• fall back to the bundled Bun/JavaScript entrypoint; or
• print an actionable error explaining that Windows Application Control blocked the executable.

Actual behavior

The launcher exits with:

spawnSync %APPDATA%\npm\node_modules\hunkdiff\node_modules\hunkdiff-windows-x64\bin\hunk.exe UNKNOWN

This hides the actionable Windows error and does not attempt the available fallback.

Verified fallback

The packaged Bun executable has a valid Authenticode signature, and invoking the JavaScript entrypoint directly works:

$pkg = "$env:APPDATA\npm\node_modules\hunkdiff"
& "$pkg\node_modules\bun\bin\bun.exe" "$pkg\dist\npm\main.js" --version

Output:

0.17.1

Renaming the blocked prebuilt hunk.exe also allows the existing launcher discovery logic to reach this fallback successfully.

Environment

• Windows x64
• Hunkdiff: 0.17.1
• Node.js: 26.4.0
• npm: 11.17.0

Related issues

• Linux x64 prebuilt binary SIGILLs on non-AVX/Haswell CPU; Bun fallback works #454 — native binary failure does not reach the Bun fallback
• EACCESS error #202 — another spawnSync process-creation error
• Windows support #283 — initial Windows executable support