summrise-agent 1.2.456 → 1.2.458

package/bin/summrise.js

@@ -334,17 +334,35 @@ function desktopTaskPs(installQ) {
         `Start-ScheduledTask -TaskName SummriseDesktop`,
     ];
 }
-/** Ask whether the shell is up, and start it if it is not — printing ONE WORD the caller
- *  can trust: `already-running`, `started`, or `not-started`. A command that says "ok"
- *  without distinguishing those three is how an operator ends up staring at a desktop
- *  wondering whether anything happened. Pure; the CLI runs it. */
+/** The desktop shell's START script, as a file — NOT a `-Command` string.
+ *
+ *  WHY A FILE, and this is the third thing the device taught us: the CLI spawns with
+ *  `shell: true`, so every command goes through cmd.exe, and **cmd treats `&` as a command
+ *  separator**. The PowerShell call operator `&` therefore split the command in half, the
+ *  `$t` assignment never ran, and the command fell through to re-registering the task —
+ *  which then failed on the service account's principal. One metacharacter, two unrelated
+ *  looking failures. `powershell -File "<path>"` has no metacharacters to mangle, and the
+ *  operator can READ what the command does.
+ *
+ *  Prints ONE WORD the CLI can trust: `already-running`, `started`, or `not-started`.
+ *  Pure; the CLI writes it and runs it. unit-tested. */
 function desktopStartPs(installQ) {
     return [
-        `if (Get-Process electron -ErrorAction SilentlyContinue) { Write-Output 'already-running'; exit 0 }`,
-        `& powershell -NoProfile -ExecutionPolicy Bypass -File '${installQ}\\scripts\\ensure-desktop.ps1'`,
-        `Start-Sleep -Seconds 3`,
-        `if (Get-Process electron -ErrorAction SilentlyContinue) { Write-Output 'started' } else { Write-Output 'not-started'; exit 1 }`,
-    ].join("; ");
+        "# written by `summrise desktop` -- ask for the window, or say it is already there.",
+        "$ErrorActionPreference = 'Stop'",
+        "if (Get-Process electron -ErrorAction SilentlyContinue) { Write-Output 'already-running'; exit 0 }",
+        "# DO NOT RE-REGISTER THE TASK TO START IT. Register-ScheduledTask needs the interactive",
+        "# user's principal as DOMAIN\\user, and a shell running as a service account has no such",
+        "# mapping -- the device answered \"No mapping between account names and security IDs was",
+        "# done ... UserId\" from a PTY running as systemprofile, while the task itself was Ready.",
+        "# The task already carries the right principal -- `summrise setup` creates it -- so starting",
+        "# it is all that is needed.",
+        "$t = Get-ScheduledTask -TaskName SummriseDesktop -ErrorAction SilentlyContinue",
+        `if (-not $t) { & powershell -NoProfile -ExecutionPolicy Bypass -File "${installQ}\\scripts\\register-desktop-task.ps1" }`,
+        "Start-ScheduledTask -TaskName SummriseDesktop -ErrorAction SilentlyContinue",
+        "Start-Sleep -Seconds 3",
+        "if (Get-Process electron -ErrorAction SilentlyContinue) { Write-Output 'started' } else { Write-Output 'not-started'; exit 1 }",
+    ];
 }
 // exported: agent bind port plumbing (custom-port installs). server.port
 // out of <dir>/config.yaml (first `port:` under top-level `server:`),
@@ -1775,7 +1793,11 @@ const commands = {
         try {
             const reg = path.join(SCRIPTS_DIR, "register-desktop-task.ps1");
             fs.writeFileSync(reg, desktopTaskPs(DIR).join("\r\n") + "\r\n");
-            sh(`powershell -NoProfile -ExecutionPolicy Bypass -File '${(0, exports.psq)(reg)}'`);
+            sh(
+            // DOUBLE quotes — a cmd-layer argument. The single-quoted version this shipped with
+            // reached PowerShell with the quotes included and died on the device with "unsupported
+            // path format" for a path that was perfectly valid.
+            `powershell -NoProfile -ExecutionPolicy Bypass -File "${reg}"`);
             console.log("setup: SummriseDesktop registered (logon + a 5-minute watchdog) and started");
         }
         catch {
@@ -1983,7 +2005,7 @@ const commands = {
     //
     // WHY IT EXISTS. The shell is normally started by the SummriseDesktop task, but the LAUNCHER
     // dies with the console that started it — measured twice on 2026-09-23, both times arriving
-    // as "electron 又不见了" — and until now there was no command to ask for it, only a .ps1 path
+    // as "the electron window is gone again" — and until now there was no command to ask for it, only a .ps1 path
     // an operator had to know. Idempotent by construction (the task's ensure-desktop.ps1 exits
     // when electron is alive, so a running shell is never disturbed), and it distinguishes the
     // three outcomes. "ok" without saying WHICH is how an operator ends up staring at a desktop.
@@ -1995,13 +2017,17 @@ const commands = {
             // writes, from the same builder, so the two cannot drift.
             fs.writeFileSync(reg, desktopTaskPs(DIR).join("\r\n") + "\r\n");
         }
-        try {
-            sh(`powershell -NoProfile -ExecutionPolicy Bypass -File '${(0, exports.psq)(reg)}'`);
-        }
-        catch {
-            /* the task may already exist and be healthy; the check below is the verdict */
-        }
-        const r = (0, child_process_1.spawnSync)("powershell", ["-NoProfile", "-Command", desktopStartPs(DIR)], { encoding: "utf8", shell: true });
+        // THE START SCRIPT GOES IN A FILE, AND ONLY IT DECIDES WHETHER TO REGISTER. Spawning with
+        // `shell: true` means cmd.exe, and **cmd splits a command on `&`** — the PowerShell call
+        // operator in the middle of this logic cut the command in half on the device, so the `$t`
+        // assignment never ran and it fell through to re-registering a task that already existed,
+        // which then failed on the service account's principal. Two failures, one metacharacter.
+        const start = path.join(SCRIPTS_DIR, "desktop-start.ps1");
+        fs.writeFileSync(start, desktopStartPs(DIR).join("\r\n") + "\r\n");
+        // The register script is WRITTEN here (a machine that never ran setup still gets a working
+        // task, from the same builder setup uses) but NOT run: desktop-start.ps1 runs it only when
+        // the task is genuinely missing.
+        const r = (0, child_process_1.spawnSync)("powershell", ["-NoProfile", "-ExecutionPolicy", "Bypass", "-File", start], { encoding: "utf8", shell: true });
         const out = String(r.stdout || "").trim();
         if (out.endsWith("already-running")) {
             console.log("desktop: the Summrise shell is ALREADY RUNNING (look for the window, or the tray icon)");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "summrise-agent",
-  "version": "1.2.456",
+  "version": "1.2.458",
   "description": "Summrise Agent — Windows device MCP server (terminal/SSH/serial) + panel. Self-hosted npm distribution.",
   "//build": "唯一构建路径：在本目录执行 npm run build。它是自包含的：经 npm exec 按需拉取 typescript@5，无需预装任何 node_modules（干净检出可跑；旧脚本引用 ../summrise-desktop-electron/node_modules/.bin/tsc，干净检出必 ENOENT）。必须用 npm exec --package … -- tsc 的形式：npx 会吃掉传给 tsc 的 -p/--outDir 等参数（round-435：npx 写法从未真正跑通过）。先编 electron TS（--noCheck 纯 emit，与 release.yml 一致）同步两处 src/*.js，再编 src/summrise.ts 到 bin/summrise.js 并校验 round-298 标记（弱 oracle，只证某次构建发生，新鲜性由 publish-release.sh 的 tsc 重编 + cmp 门保证）。",
   "bin": {