From 718c67b387a00d3240dda53911b883ff6a5b4da1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miguel=20=C3=81ngel?= <miguel.sierra@heygen.com>
Date: Fri, 10 Jul 2026 16:22:50 -0400
Subject: [PATCH] fix: escape NUL bytes in HFMASK regex (Bun blank renders) +
 Windows junction for studio preview links (#2140)

* fix(core): escape NUL delimiters in HFMASK mask token and restore regex

Raw 0x00 bytes in the maskInertRegions token and restore regex made
timingCompiler.ts binary to git and shipped raw NULs into dist/cli.js.
Bun's transpiler (<= 1.3.11) corrupts raw NULs in regex literals into
literal backslash-uFFFD text, so restore never matched: every masked
<style>/<script> region was dropped, the player never initialized, and
bunx renders produced blank white frames showing HFMASK tokens.

Use \u0000 escapes instead, which survive any transpile layer, and add
a byte-level regression test (behavior is identical under Node, so only
a byte check catches this).

Fixes the first half of #2139.

* fix(cli): use NTFS junctions for studio project links on Windows

linkProjectIntoStudioData called symlinkSync(dir, path, "dir"), which
needs Developer Mode or elevation on Windows, so preview and dev in
local-studio mode died with EPERM for default-configured users.
Junctions need no privilege, work for directories, and keep the live
write-back the studio depends on (a copy fallback would decouple the
studio from the real project). Covers both preview and dev, which share
the helper.

Fixes the second half of #2139.
---
 packages/cli/src/commands/preview.ts          |   4 +++-
 .../core/src/compiler/timingCompiler.test.ts  |  11 +++++++++++
 packages/core/src/compiler/timingCompiler.ts  | Bin 10940 -> 11248 bytes
 3 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/packages/cli/src/commands/preview.ts b/packages/cli/src/commands/preview.ts
index 598d6e92e..6edeec423 100644
--- a/packages/cli/src/commands/preview.ts
+++ b/packages/cli/src/commands/preview.ts
@@ -682,7 +682,9 @@ function linkProjectIntoStudioData(
       }
     }
     if (!existsSync(symlinkPath)) {
-      symlinkSync(dir, symlinkPath, "dir");
+      // Windows: "dir" symlinks need Developer Mode or elevation (EPERM otherwise);
+      // NTFS junctions are unprivileged and keep the live write-back the studio needs.
+      symlinkSync(dir, symlinkPath, process.platform === "win32" ? "junction" : "dir");
       createdSymlink = true;
     }
   }
diff --git a/packages/core/src/compiler/timingCompiler.test.ts b/packages/core/src/compiler/timingCompiler.test.ts
index 86e7dfe7c..cab293ebb 100644
--- a/packages/core/src/compiler/timingCompiler.test.ts
+++ b/packages/core/src/compiler/timingCompiler.test.ts
@@ -1,3 +1,5 @@
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
 import { describe, it, expect } from "vitest";
 import {
   compileTimingAttrs,
@@ -6,6 +8,15 @@ import {
   clampDurations,
 } from "./timingCompiler.js";
 
+// Raw 0x00 bytes in the HFMASK delimiters shipped once and broke every render
+// under Bun's transpiler while behaving fine under Node (issue #2139) — only a
+// byte-level check catches that, so keep the delimiters as \x00 escapes.
+it("source contains no raw NUL bytes", () => {
+  const testPath = expect.getState().testPath ?? "";
+  const src = readFileSync(join(dirname(testPath), "timingCompiler.ts"), "latin1");
+  expect(src.includes("\x00")).toBe(false);
+});
+
 describe("compileTimingAttrs", () => {
   it("adds data-end when data-start and data-duration are present on a video", () => {
     const html = '<video id="v1" src="a.mp4" data-start="2" data-duration="5">';
diff --git a/packages/core/src/compiler/timingCompiler.ts b/packages/core/src/compiler/timingCompiler.ts
index eb55a112a8053c8a7ee55a633af4a36360f988a7..b5c3a06feb090537e915df0e20ea1505b709cbbc 100644
GIT binary patch
delta 379
zcmYk2u}%U(5QcjacmWH4BZ&~*1GUml3qvB<2(h7X?rz{VEPI!oy>P@BeFs{72NPRM
zTi?af(gg~gZvLH_eBXYIzVF^%>rb5yh8g2#)JMuj&$VYKn3v)qo|YiNxa@`kOF{+9
zIUFs}twItnJ%?GEF?^;46K%K_4#wJ&Tf*m<Y7eq0$T5=Kxw7z_hCN)C_CVlWldKeB
z&0&$TMO@m{go&0GDH;1G$ERoQX!TP6+S^j}t_Byk*Ug8(CRt?IPJQ;ceOf&??$<hb
zWwiAw)k3jhWx4VyBn+FYB)8t>Mme5x1*JCL30a#5&Z1y)&=$SnpnnvAbdn)xEi&>O
oOTk(PLK6<X%>I6?hENi@T`mkI-0J+NZH?2z_BMF`X?*Vd0$o&q{Qv*}

delta 69
zcmewmz9)3UT;9o!d}qWNJluR8gS}O%i%SxVGxTy&^U_N)Y8fW$@h3<W>lLLI<Rm7i
UYUo3iX~d*xYcg!s5jY|Z0BkiE0RR91