dsh-autorestart 0.7.0 → 0.8.0

package/README.md

@@ -13,6 +13,13 @@ Chinese version: [README.zh.md](docs/README.zh.md)
 
 `dsh-autorestart` turns a DeepSeek Harness restart into a resumable event instead of a dead end.
 
+**New in 0.7.0** — it now also knows *how it was started*: the desktop client, somebody else's
+supervisor (a shell script, systemd, a container, pm2, a Windows scheduled task), or a bare process
+nobody manages. It never starts a second DSH next to a running one, and when it cannot tell it does
+nothing instead of guessing a command. The settings page shows what is really inside the
+pre-restart backups (count, local time, size, path), and carries a **Report a problem** entry that
+copies the diagnostics and opens a pre-filled GitHub issue.
+
 An agent can request a graceful restart. The plugin waits until every conversation is idle and the
 host has been quiet for the settle window, then it restarts the host. Once the host is back, the
 interrupted sessions resume automatically: a session that owns a durable goal gets that goal
@@ -98,8 +105,35 @@ writes that sentence and the matching command into the settings page.
 
 ### If DSH does not come up
 
-Double-click `scripts/emergency-disable.cmd` in the plugin directory — it takes this plugin out
-safely and keeps a backup — then open DSH again.
+**First work out which situation you are in**: if the whole environment is broken (a changed
+configuration, another plugin, a bad upgrade) → go back to the last good state; if **only this
+plugin** is suspect → take this plugin out instead.
+
+**And use the scripts of YOUR platform** — a Linux machine has no `.cmd` file, and a Windows
+machine has no `.sh`:
+
+| Your machine | back to the last good state | take this plugin out |
+|---|---|---|
+| **Windows** (the desktop app, `dsh web` on Windows) | double-click `scripts/restore-profile.cmd` | double-click `scripts/emergency-disable.cmd` |
+| **Linux / WSL / macOS** (`dsh web`) | `sh scripts/restore-profile.sh` | `sh scripts/emergency-disable.sh` |
+
+Two scripts per platform, and they do different jobs:
+
+- **`restore-profile.cmd` / `restore-profile.sh` — back to the last good state.** It puts the
+  newest snapshot that carries a manifest back over the profile, and leaves the broken one behind
+  as `profile.broken-<timestamp>` (moved aside, not deleted). It does not restart DSH for you.
+- **`emergency-disable.cmd` / `emergency-disable.sh` — take this plugin out and change nothing
+  else.** It removes only `dsh-autorestart` from the profile's bundle list and keeps a backup of
+  the file.
+
+**Which one:** "back to the last good state" → `restore-profile`; "I only suspect this plugin" →
+`emergency-disable`. The boundaries (the profile directory has to exist, a snapshot with a
+manifest is required, DSH is never restarted for you, the `broken-` folder stays) are written down
+in [`scripts/README.md`](scripts/README.md).
+
+**What each platform can do** (and what it cannot) is spelled out in
+[`docs/platform-matrix.md`](docs/platform-matrix.md) — the settings page shows the paths of the
+scripts that really exist on the machine you are on.
 
 ### What has really been tested
 
@@ -136,9 +170,8 @@ The settings page has a "**Report a problem**" group at the bottom:
 - When the browser refuses the clipboard (an insecure context, or no permission), the plugin shows
   the diagnostics in a **selectable** box and says so — a report never dies because the browser said
   no.
-- No GitHub account? The same group carries the mailbox (252170229@qq.com), a "Copy the
-  diagnostics" button and a matching mail link (the subject is filled in, the body asks you to
-  paste).
+- No GitHub account? The same group shows the mailbox (252170229@qq.com) as plain text, plus a
+  "Copy the diagnostics" button.
 
 ## What it occupies in DSH
 
@@ -165,7 +198,7 @@ what it adds before you install it.
 
 ## Install
 
-Current version: **0.7.0**.
+Current version: **0.8.0**.
 
 From npm — the package is published under the name `dsh-autorestart`:
 
@@ -485,6 +518,75 @@ own health route. A slow start inside `rollbackTimeoutMs` is never treated as a
 healthy host is never touched. The restore itself is bounded as well: every copy step gives up after
 `rollbackCopyTimeoutMs` (default `120000`) and says so in the report.
 
+### When the machine refuses a scheduled task (the automatic rollback is gone)
+
+The safety net above hangs on a **one-off scheduled task**: the helper that brings the host back
+after a restart is a task that fires a minute later. On a machine where such a task cannot be
+created (a corporate policy, a locked-down account, a machine without the rights) the net is
+silently missing.
+
+So the plugin **checks the machine once** — the first time it runs there — and tells the truth in
+the settings page:
+
+- `Automatic rollback: available` — the net is there.
+- `Automatic rollback: **not available**` — and exactly what is lost: *DSH will not recover by
+  itself when it does not come up after a restart*. The line points at the restore script in
+  "If DSH will not start", which is the way out.
+
+**What this deliberately does NOT do:**
+
+- **No fallback chain.** There is no "use the startup folder instead", no "use a systemd timer
+  instead", no second mechanism that is tried when the first one is refused.
+- **No bypassing the policy.** The plugin does not look for a way around a machine that says no.
+  If the machine refuses, the answer is "not available" — and only that is reported.
+
+A refused check is **never** a failed installation: the plugin works exactly as before, only the
+safety net is missing. The check itself is harmless by construction — it registers a task that
+fires in two minutes and does nothing (`cmd /c exit 0`), reads it back, deletes it, and reads it
+back once more to prove that it is gone. It runs **once**, not on every visit of the settings page,
+and it never leaves a task behind (not even when a step of it fails).
+
+### The watchdog: the three ways it can be triggered
+
+The rollback above needs somebody to *wait*: the host is restarted, and a
+one-off thing has to notice that the new host never came up. That thing is the
+**watchdog** (`scripts/watchdog.mjs`), and how it is triggered is the part
+that differs between the machines — so the plugin picks the best way the
+machine has and says which one it picked:
+
+| Tier | Mechanism | Where |
+|---|---|---|
+| `scheduled-task` | a one-off Windows scheduled task (read back after it was registered, deleted completely afterwards) | the desktop app and `dsh web` on Windows |
+| `systemd-run` | a systemd user timer (`systemd-run --user --on-active=…`), reset when it is over | `dsh web` on Linux, WSL with systemd |
+| `detached-process` | a background process of our own (`setsid nohup sh -c 'sleep …; …'`), its pid in the state directory | containers, WSL without systemd |
+| `none` | nothing on this machine | then there is **no automatic rollback**, and the settings page says so |
+
+**One function decides it** (`lib/watchdog-tier.js`), and the settings page, the
+diagnostics and the watchdog itself all ask that one function — so the warning
+("this machine has no automatic rollback") can never drift away from what the
+plugin actually does.
+
+The flow is the same for every tier (`lib/watchdog.js`): wait for the new host
+to write the ready marker → ask again (a slow host is not a dead host) → is an
+instance alive? (then there is nothing to restore) → take the shared lock
+(`rollback.lock`, so exactly one of us restores) → restore the snapshot → start
+the host again → wait for the ready marker once more. At most **one** restore
+and **one** start; then the watchdog stops and writes what happened into
+`<stateDir>/last-watchdog-report.json` (which tier it used, and why).
+
+**Only one watchdog at a time.** There is an older watcher in this plugin as
+well (it restores the snapshot but does **not** start the host again). Both take
+the same lock, so running them together is worse than running one: the one that
+loses the lock gives up — and if the new one lost, the profile would be restored
+and **nothing would be running**. So the plugin decides once, in one place
+(`lib/watchdog-arbiter.js`): the new watchdog takes over whenever it can be
+armed at all, and the old one only runs when the new one cannot (no tier on this
+machine, the watchdog is switched off, or the registration failed). The report
+names the arbiter (`arbiter: "v2"` or `"v1"`), so it is visible at a glance who
+was watching.
+
+`watchdogEnabled: false` switches it off entirely.
+
 ### The access link after a restart
 
 The boot token of `dsh web` is created **per process**, so the link the browser holds answers `401`
@@ -711,6 +813,35 @@ be cancelled — the card has a button, and the moon button itself becomes a tog
 is armed. If a conversation starts working again during the countdown, the countdown goes back to
 "waiting" and nothing is switched off.
 
+### Which machine gets switched off?
+
+The plugin works out where it runs and switches off **that machine** — and the label in the
+settings says which one, so there is no guessing:
+
+| Where DSH runs | What the shutdown switches off | The label you see |
+|---|---|---|
+| The Windows desktop app | that Windows computer | "Switch off this Windows computer" |
+| `dsh web` on Windows | that Windows computer | "Switch off this Windows computer" |
+| `dsh web` on a Linux host | that Linux host | "Shut down this Linux host" |
+| **`dsh web` inside WSL** | **the whole Windows machine** (not the little WSL box!) | "The DSH inside WSL → switches off the whole Windows" |
+| A container | nothing at all (there is no command) | "This machine has no reliable way to switch off" |
+
+> ⚠️ **A shutdown countdown inside WSL means your whole machine goes down** — not just that
+> web service. WSL is a small Linux environment *inside* Windows; shutting that environment
+> down would only stop the distribution. To switch off the **host**, the plugin goes through
+> the mounted drive: `shutdown.exe` (`/mnt/c/Windows/System32/shutdown.exe /s /f /t 0`), with
+> `powershell.exe -Command "Stop-Computer -Force"` and `cmd.exe /c shutdown.exe /s /f /t 0`
+> as the fallbacks. In other words: **the host goes off.**
+
+**How far this is verified.** The *plan* is verified for every platform
+(`test/sleep-plan-posix.test.mjs`: inside WSL the plan must take the "switch off the whole
+Windows" branch, a plain Linux plan must not contain a single Windows command, and a machine
+without a way to switch off has an empty command and **executes nothing**). The real power-off
+is verified on **Windows**; on POSIX it is deliberately **not** switched off for real — a
+common-sense fact is not worth ending every session on the machine for.
+
+The full picture per platform is in [`docs/platform-matrix.md`](docs/platform-matrix.md).
+
 ### Shutdown and restart: who goes first
 
 **The short version.** Pressing the moon button means "switch the machine off when the work is

package/client.js

@@ -377,6 +377,31 @@
     'settings.backup.withPlugins': '含已装插件',
     'settings.backup.withoutPlugins': '只有配置',
     'settings.groups.report': '报告问题',
+    'settings.groups.rescue': '出事了怎么办',
+    'settings.rescue.hint': 'DSH 打不开的时候，用下面这两个脚本救自己（都不用 DSH 跑起来）。',
+    'settings.rescue.restoreProfile': '回到上一次好状态',
+    'settings.rescue.emergencyDisable': '只把这个插件摘掉',
+    'settings.rescue.path': '路径',
+    'settings.rescue.copyPath': '复制路径',
+    'settings.rescue.copied': '路径已复制',
+    'settings.rescue.copyFailed': '复制失败，请手动选中上面的路径',
+    'settings.rescue.reveal': '打开所在文件夹',
+    'settings.rescue.which': '怎么选：整个环境坏了（改了配置、装了别的插件、升级崩了）→ 用「回到上一次好状态」；只怀疑这个插件 → 用「只把这个插件摘掉」。',
+    'settings.rescue.warning': '重要：这两个脚本是在 DSH 打不开的时候用的。DSH 正开着的时候用「回到上一次好状态」，会把你现在正在用的配置覆盖掉。',
+    'settings.rescue.rollbackOk': '自动回滚：可用（重启后起不来会自动回到上一个好状态）',
+    'settings.rescue.rollbackBlocked': '自动回滚：**不可用** —— 这台电脑不允许创建计划任务。**会丢失：重启后 DSH 起不来时不会自动恢复**；出问题时请双击「出事了怎么办」里的还原脚本。',
+    'settings.rescue.rollbackUnknown': '自动回滚：还不知道（这台机器的能力还没检查过）',
+    'settings.rescue.watchdogTier': '看门狗的触发方式：{tier}',
+    'settings.rescue.watchdogLast': '上一次看门狗的结果：{result}',
+    'settings.rescue.tierScheduledTask': 'Windows 计划任务',
+    'settings.rescue.tierSystemdRun': 'systemd 定时器',
+    'settings.rescue.tierDetachedProcess': '自建后台进程',
+    'settings.rescue.tierNone': '（这台机器没有可用机制）',
+    'settings.rescue.shortcut': '在桌面放一个快捷方式',
+    'settings.rescue.shortcutDone': '已在桌面',
+    'settings.rescue.noDesktop': '这台机器上没有桌面目录，所以放不了快捷方式（脚本的路径在上面，可以手动复制过去）。',
+    'settings.rescue.shortcutFailed': '快捷方式没放成：{message}',
+    'settings.rescue.revealFailed': '文件夹没打开：{message}',
     'settings.report.label': '遇到问题了？',
     'settings.report.github': '复制诊断信息并去 GitHub 提问题',
     'settings.report.hint': '诊断信息里没有你的访问令牌，也没有任何密钥；把它贴进 issue，我们就能看出问题出在哪。',
@@ -675,6 +700,31 @@
     'settings.backup.withPlugins': 'includes the installed plugins',
     'settings.backup.withoutPlugins': 'configuration only',
     'settings.groups.report': 'Report a problem',
+    'settings.groups.rescue': 'If DSH will not start',
+    'settings.rescue.hint': 'When DSH does not come up, these two scripts rescue it for you (neither of them needs DSH running).',
+    'settings.rescue.restoreProfile': 'Back to the last good state',
+    'settings.rescue.emergencyDisable': 'Take this plugin out only',
+    'settings.rescue.path': 'Path',
+    'settings.rescue.copyPath': 'Copy the path',
+    'settings.rescue.copied': 'The path is on the clipboard',
+    'settings.rescue.copyFailed': 'The copy failed — please select the path above by hand',
+    'settings.rescue.reveal': 'Open the folder',
+    'settings.rescue.which': 'Which one: the whole environment is broken (a changed configuration, another plugin, a bad upgrade) → "Back to the last good state"; only this plugin is suspect → "Take this plugin out only".',
+    'settings.rescue.warning': 'Important: these two scripts are for when DSH does not come up. Using "Back to the last good state" while DSH is running overwrites the configuration you are working with right now.',
+    'settings.rescue.rollbackOk': 'Automatic rollback: available (a host that does not come up after a restart goes back to the last good state)',
+    'settings.rescue.rollbackBlocked': 'Automatic rollback: **not available** — this computer does not allow creating scheduled tasks. **What you lose: DSH will NOT recover by itself when it does not come up after a restart**; when it breaks, double-click the restore script in "If DSH will not start".',
+    'settings.rescue.rollbackUnknown': 'Automatic rollback: not known yet (this machine has not been checked)',
+    'settings.rescue.watchdogTier': 'How the watchdog is triggered: {tier}',
+    'settings.rescue.watchdogLast': 'The last watchdog run: {result}',
+    'settings.rescue.tierScheduledTask': 'a Windows scheduled task',
+    'settings.rescue.tierSystemdRun': 'a systemd timer',
+    'settings.rescue.tierDetachedProcess': 'a detached background process',
+    'settings.rescue.tierNone': '(this machine has no way to run it)',
+    'settings.rescue.shortcut': 'Put a shortcut on the desktop',
+    'settings.rescue.shortcutDone': 'It is on the desktop',
+    'settings.rescue.noDesktop': 'This machine has no desktop directory, so no shortcut can be placed (the paths are above — copy them by hand).',
+    'settings.rescue.shortcutFailed': 'The shortcut was not placed: {message}',
+    'settings.rescue.revealFailed': 'The folder did not open: {message}',
     'settings.report.label': 'Something wrong?',
     'settings.report.github': 'Copy the diagnostics and open a GitHub issue',
     'settings.report.hint': 'The diagnostics carry no access token and no secrets — paste them into the issue and we can see what went wrong.',
@@ -1818,6 +1868,73 @@
     return { ok: false, fallback: true, text: source };
   }
 
+  /**
+   * Must the warning about the missing automatic rollback be shown now?
+   *
+   * The warning belongs to ONE moment: the machine has NO way to run the
+   * watchdog at all (tier 'none'), and the user has not seen it yet (the Host
+   * recorded `warnedAt`). A machine that is blocked and stays blocked does
+   * not nag.
+   *
+   * @param {object|null} capabilities
+   * @returns {boolean}
+   */
+  function watchdogNoticeFor(capabilities) {
+    if (!capabilities || typeof capabilities !== 'object') return false
+    if (capabilities.tier !== 'none') return false
+    return typeof capabilities.warnedAt !== 'number'
+  }
+
+  /**
+   * The name of the tier, in the language of the user.
+   *
+   * @param {Function} t the translator
+   * @param {string} tier
+   * @returns {string}
+   */
+  function watchdogTierLabel(t, tier) {
+    if (tier === 'scheduled-task') return t('settings.rescue.tierScheduledTask')
+    if (tier === 'systemd-run') return t('settings.rescue.tierSystemdRun')
+    if (tier === 'detached-process') return t('settings.rescue.tierDetachedProcess')
+    if (tier === 'none') return t('settings.rescue.tierNone')
+    return ''
+  }
+
+  /**
+   * The two rescue scripts, as the Host reported them.
+   *
+   * The paths come from the Host (it resolved the plugin directory for
+   * itself) — the browser never guesses them. A path that is not there is not
+   * shown: an empty path would be a dead end for the user.
+   *
+   * @param {object} info the Host's state payload
+   * @returns {Array<{ key: string, path: string }>}
+   */
+  function rescuePathsFor(info) {
+    const rescue = info && typeof info === 'object' && info.rescue && typeof info.rescue === 'object'
+      ? info.rescue
+      : null
+    if (!rescue) return []
+    const out = []
+    const restore = typeof rescue.restoreProfile === 'string' ? rescue.restoreProfile.trim() : ''
+    if (restore !== '') out.push({ key: 'restoreProfile', path: restore })
+    const disable = typeof rescue.emergencyDisable === 'string' ? rescue.emergencyDisable.trim() : ''
+    if (disable !== '') out.push({ key: 'emergencyDisable', path: disable })
+    return out
+  }
+
+  /**
+   * The route that writes the desktop shortcut and opens the folder.
+   *
+   * @param {object} info the Host's state payload
+   * @returns {string}
+   */
+  function rescueUrlFor(info) {
+    const sent = info && typeof info === 'object' && typeof info.rescueUrl === 'string' ? info.rescueUrl.trim() : ''
+    if (sent.startsWith('/')) return sent
+    return '/__dsh_autorestart/rescue'
+  }
+
   /**
    * Whether the "how was this host started" block may be shown at all.
    *
@@ -1929,6 +2046,14 @@
     // "Report a problem": the URL builders and the clipboard with its fallback.
     buildIssueUrl,
     copyReportText,
+    // The rescue kit: the two script paths as the Host resolved them, and the
+    // route that writes the desktop shortcut and opens the folder.
+    rescuePathsFor,
+    rescueUrlFor,
+    // The automatic rollback: what this machine can do, and whether the
+    // one-time warning about it is still waiting to be shown.
+    watchdogNoticeFor,
+    watchdogTierLabel,
     // The startup block: whether it may be shown, the one line that says what
     // the plugin remembers, and the formatters of the backup list.
     shouldShowStartupBlock,
@@ -4393,6 +4518,8 @@
         const [reportFallback, setReportFallback] = useState('')
         // The note under the backup path: copied, or "copy it by hand".
         const [pathNote, setPathNote] = useState('')
+        // The note under the rescue paths: copied, or "copy it by hand".
+        const [rescueNote, setRescueNote] = useState('')
         // Whether the "technical details" fold is open. It is NOT persisted:
         // a fresh page starts closed, so nobody leaves technical text open by
         // accident.
@@ -4479,6 +4606,49 @@
           ? info.backups
           : { dir: '', max: 0, count: 0, items: [] }
         const backupItems = Array.isArray(backupsInfo.items) ? backupsInfo.items : []
+        // THE RESCUE KIT: the two scripts and where they are, as the Host
+        // resolved them. The browser never guesses a path.
+        const rescuePaths = rescuePathsFor(info)
+        const rescueKit = info && typeof info === 'object' && info.rescue && typeof info.rescue === 'object'
+          ? info.rescue
+          : {}
+        // Where a desktop shortcut could go ('' = there is no desktop here).
+        const rescueDesktop = typeof rescueKit.desktopDir === 'string' ? rescueKit.desktopDir.trim() : ''
+        // Whether it is already there (then the button says so).
+        const rescueShortcutExists = rescueKit.shortcutExists === true
+        // WHAT THIS MACHINE CAN DO: the automatic rollback needs a watchdog,
+        // and the watchdog needs a way to be triggered later. The tier (the
+        // ONE function that decides it on the host) says which one that is.
+        const capabilities = info && typeof info === 'object' && info.capabilities && typeof info.capabilities === 'object'
+          ? info.capabilities
+          : {}
+        const watchdog = info && typeof info === 'object' && info.watchdog && typeof info.watchdog === 'object'
+          ? info.watchdog
+          : {}
+        const watchdogTier = typeof watchdog.tier === 'string' && watchdog.tier !== '' ? watchdog.tier : ''
+        const schedulerState = watchdogTier === '' ? 'unknown' : (watchdogTier === 'none' ? 'blocked' : 'ok')
+        // The notice is for the TRANSITION: a user who has seen it is not
+        // asked again.
+        const schedulerNotice = watchdogNoticeFor(capabilities)
+        const schedulerText = schedulerState === 'ok'
+          ? t('settings.rescue.rollbackOk')
+          : schedulerState === 'blocked'
+            ? t('settings.rescue.rollbackBlocked')
+            : t('settings.rescue.rollbackUnknown')
+        const watchdogLast = watchdog.report && typeof watchdog.report === 'object' && typeof watchdog.report.result === 'string'
+          ? watchdog.report.result
+          : ''
+        useEffect(() => {
+          if (!schedulerNotice) return
+          // The user has read it: the Host remembers that and stops asking.
+          void fetch(rescueUrlFor(info), {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ action: 'ack-scheduler' }),
+          }).catch(() => {
+            // The Host will ask again next time — no harm.
+          })
+        }, [schedulerNotice])
         const supervisorPending = supervisorStatus !== null
           && supervisorStatus.detail !== null
           && typeof supervisorStatus.detail === 'object'
@@ -4643,6 +4813,73 @@
           setPathNote(copied.fallback ? t('settings.backup.copyFailed') : t('settings.backup.copied'))
         }
 
+        /**
+         * Copy the path of a rescue script.
+         *
+         * The path is on screen anyway (selectable), so a refused clipboard
+         * only costs a hint — the same fallback the diagnostics use.
+         */
+        const copyRescuePath = async (target) => {
+          const copied = await copyReportText(target)
+          setRescueNote(copied.fallback ? t('settings.rescue.copyFailed') : t('settings.rescue.copied'))
+        }
+
+        /**
+         * Put the desktop shortcut there.
+         *
+         * ONLY because the user pressed the button: the settings page never
+         * writes anything to the desktop by itself.
+         */
+        const createRescueShortcut = async () => {
+          if (busy) return
+          setBusy(true)
+          setRescueNote('')
+          try {
+            const response = await fetch(rescueUrlFor(info), {
+              method: 'POST',
+              headers: { 'content-type': 'application/json' },
+              body: JSON.stringify({ action: 'shortcut' }),
+            })
+            const body = await response.json().catch(() => null)
+            if (!response.ok) {
+              const message = body && typeof body === 'object' && body.error ? body.error : String(response.status)
+              setRescueNote(fill(t('settings.rescue.shortcutFailed'), { message }))
+              return
+            }
+            setRescueNote(t('settings.rescue.shortcutDone'))
+          } catch (failure) {
+            setRescueNote(fill(t('settings.rescue.shortcutFailed'), { message: describeError(failure) }))
+          } finally {
+            setBusy(false)
+          }
+        }
+
+        /**
+         * Open the folder of the scripts in the file manager.
+         */
+        const revealRescueFolder = async () => {
+          if (busy) return
+          setBusy(true)
+          setRescueNote('')
+          try {
+            const response = await fetch(rescueUrlFor(info), {
+              method: 'POST',
+              headers: { 'content-type': 'application/json' },
+              body: JSON.stringify({ action: 'reveal' }),
+            })
+            const body = await response.json().catch(() => null)
+            if (!response.ok) {
+              const message = body && typeof body === 'object' && body.error ? body.error : String(response.status)
+              setRescueNote(fill(t('settings.rescue.revealFailed'), { message }))
+              return
+            }
+          } catch (failure) {
+            setRescueNote(fill(t('settings.rescue.revealFailed'), { message: describeError(failure) }))
+          } finally {
+            setBusy(false)
+          }
+        }
+
         return h(
           'div',
           { className: 'dsh-autorestart-settings' },
@@ -5154,6 +5391,156 @@
                 )
               : null,
           ),
+          // "IF DSH WILL NOT START": the two rescue scripts, where they are, and
+          // the way to get them onto the desktop. A user whose host is down
+          // cannot open a README — they need the path, and they need to be
+          // able to copy it.
+          h(
+            'div',
+            {
+              className: 'dsh-autorestart-settings__group',
+              'data-dsh-autorestart-group': 'rescue',
+            },
+            h(
+              'div',
+              { className: 'dsh-autorestart-settings__group-title' },
+              t('settings.groups.rescue'),
+            ),
+            h(
+              'div',
+              { className: 'dsh-autorestart-settings__field' },
+              h(
+                'span',
+                { className: 'dsh-autorestart-settings__hint' },
+                t('settings.rescue.hint'),
+              ),
+            ),
+            rescuePaths.map((entry) => h(
+              'div',
+              {
+                className: 'dsh-autorestart-settings__field',
+                'data-dsh-autorestart-rescue': entry.key,
+              },
+              h(
+                'span',
+                { className: 'dsh-autorestart-settings__label' },
+                t(entry.key === 'restoreProfile' ? 'settings.rescue.restoreProfile' : 'settings.rescue.emergencyDisable'),
+              ),
+              h(
+                'code',
+                { className: 'dsh-autorestart-settings__value', 'data-dsh-autorestart-rescue': 'path' },
+                entry.path,
+              ),
+              h(
+                'button',
+                {
+                  type: 'button',
+                  className: 'dsh-autorestart-settings__button',
+                  disabled: busy,
+                  'data-dsh-autorestart-rescue': 'copy-path',
+                  onClick: () => void copyRescuePath(entry.path),
+                },
+                t('settings.rescue.copyPath'),
+              ),
+              h(
+                'button',
+                {
+                  type: 'button',
+                  className: 'dsh-autorestart-settings__button',
+                  disabled: busy,
+                  'data-dsh-autorestart-rescue': 'reveal',
+                  onClick: () => void revealRescueFolder(),
+                },
+                t('settings.rescue.reveal'),
+              ),
+            )),
+            h(
+              'div',
+              { className: 'dsh-autorestart-settings__field' },
+              h(
+                'span',
+                { className: 'dsh-autorestart-settings__hint', 'data-dsh-autorestart-rescue': 'which' },
+                t('settings.rescue.which'),
+              ),
+            ),
+            h(
+              'div',
+              { className: 'dsh-autorestart-settings__field' },
+              h(
+                'span',
+                { className: 'dsh-autorestart-settings__hint', 'data-dsh-autorestart-rescue': 'warning' },
+                t('settings.rescue.warning'),
+              ),
+            ),
+            // WHAT THIS MACHINE CAN DO: the automatic rollback (and what is
+            // lost when the machine refuses a watchdog).
+            h(
+              'div',
+              { className: 'dsh-autorestart-settings__field', 'data-dsh-autorestart-rescue': 'rollback' },
+              h(
+                'span',
+                { className: 'dsh-autorestart-settings__hint', 'data-dsh-autorestart-rescue': 'rollback-state' },
+                schedulerText,
+              ),
+              watchdogTier === '' ? null : h(
+                'span',
+                { className: 'dsh-autorestart-settings__hint', 'data-dsh-autorestart-rescue': 'watchdog-tier' },
+                t('settings.rescue.watchdogTier', { tier: watchdogTierLabel(t, watchdogTier) }),
+              ),
+              watchdogLast === '' ? null : h(
+                'span',
+                { className: 'dsh-autorestart-settings__hint', 'data-dsh-autorestart-rescue': 'watchdog-last' },
+                t('settings.rescue.watchdogLast', { result: watchdogLast }),
+              ),
+            ),
+            // The notice is shown ONCE: the Host remembers that the user has
+            // read it.
+            schedulerNotice
+              ? h(
+                  'div',
+                  { className: 'dsh-autorestart-settings__field' },
+                  h(
+                    'span',
+                    { className: 'dsh-autorestart-settings__label', 'data-dsh-autorestart-rescue': 'rollback-notice' },
+                    t('settings.rescue.rollbackBlocked'),
+                  ),
+                )
+              : null,
+            // The desktop shortcut is a BUTTON, never a side effect: loading
+            // this page writes nothing to the desktop.
+            rescueDesktop === ''
+              ? h(
+                  'div',
+                  { className: 'dsh-autorestart-settings__field' },
+                  h(
+                    'span',
+                    { className: 'dsh-autorestart-settings__hint', 'data-dsh-autorestart-rescue': 'no-desktop' },
+                    t('settings.rescue.noDesktop'),
+                  ),
+                )
+              : h(
+                  'div',
+                  { className: 'dsh-autorestart-settings__field' },
+                  h(
+                    'button',
+                    {
+                      type: 'button',
+                      className: 'dsh-autorestart-settings__button',
+                      disabled: busy,
+                      'data-dsh-autorestart-rescue': 'shortcut',
+                      onClick: () => void createRescueShortcut(),
+                    },
+                    rescueShortcutExists ? t('settings.rescue.shortcutDone') : t('settings.rescue.shortcut'),
+                  ),
+                  rescueNote === ''
+                    ? null
+                    : h(
+                        'span',
+                        { className: 'dsh-autorestart-settings__hint', 'data-dsh-autorestart-rescue': 'note' },
+                        rescueNote,
+                      ),
+                ),
+          ),
           // "REPORT A PROBLEM": copy the diagnostics and open a pre-filled
           // issue page. The email is the way out when there is no GitHub
           // account. When the clipboard refuses, the text is shown in a box

package/cordis.patch.yml

@@ -60,6 +60,13 @@
         backupIncludePlugins: true
         # Keep at most this many snapshots; older ones are deleted automatically.
         maxBackups: 2
+        # The WATCHDOG: the process that waits for the relaunched host and
+        # puts the snapshot back when it never answers. It has to be triggered
+        # LATER, and the machine decides how (a one-off Windows scheduled task,
+        # a systemd user timer, or a detached process of our own). Set this to
+        # false to switch the automatic rollback off entirely; the settings
+        # page then says that there is no automatic rollback.
+        watchdogEnabled: true
         # How long the detached watcher waits for the relaunched host (ms) before
         # it restores the snapshot. The watcher NEVER launches a second copy of
         # the host: it restores the files and writes the report.