summrise-agent 1.2.461 → 1.2.462

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "summrise-agent",
-  "version": "1.2.461",
+  "version": "1.2.462",
   "description": "Summrise Agent — Windows device MCP server (terminal/SSH/serial) + panel. Self-hosted npm distribution.",
   "//build": "唯一构建路径：在本目录执行 npm run build。它是自包含的：经 npm exec 按需拉取 typescript@5，无需预装任何 node_modules（干净检出可跑；旧脚本引用 ../summrise-desktop-electron/node_modules/.bin/tsc，干净检出必 ENOENT）。必须用 npm exec --package … -- tsc 的形式：npx 会吃掉传给 tsc 的 -p/--outDir 等参数（round-435：npx 写法从未真正跑通过）。先编 electron TS（--noCheck 纯 emit，与 release.yml 一致）同步两处 src/*.js，再编 src/summrise.ts 到 bin/summrise.js 并校验 round-298 标记（弱 oracle，只证某次构建发生，新鲜性由 publish-release.sh 的 tsc 重编 + cmp 门保证）。",
   "bin": {

package/summrise-desktop-electron/src/main.js

@@ -70,6 +70,13 @@ function agentToken() {
     let tok = null;
     try {
         const raw = fs.readFileSync(path.join(INSTALL_ROOT, "etc", "config.yaml"), "utf8");
+        // THIS PATTERN IS NARROWER THAN THE TWO OTHER PARSERS OF THE SAME LINE: the CLI's
+        // (bin/summrise.js, `[A-Za-z0-9._-]+`) and the agent's Rust recovery both accept more than
+        // lowercase hex. Measured against a live device on 2026-09-24 — the token is 64 hex characters
+        // with no space before the colon, so all three agree TODAY, and hex is what the worker issues.
+        // The failure mode if that ever stops being true is SILENT: no credential, a 401, a title that
+        // stays "Summrise" and vitals that stay blank — the state the comment above claims to have
+        // fixed. Widen this line before debugging that.
         const m = /device_token:\s*"?([0-9a-f]{16,})"?/.exec(raw);
         if (m)
             tok = m[1];
@@ -705,6 +712,21 @@ async function autoLaunchTaskSet(enabled) {
             // interactive user is not resolvable from the service session. A bare
             // STRING invocation happens to work (shell default), but spawn arrays
             // need an explicit account: use Administrator (the d1 console user).
+            //
+            // THIS PATH CANNOT REPRODUCE WHAT `summrise` REGISTERS, and the difference matters. The CLI
+            // gives SummriseDesktop TWO triggers — AtLogOn plus a guarded 5-minute pulse (bin/summrise.js:
+            // `New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(3) -RepetitionInterval 5min`, run
+            // through desktop-pulse.vbs → ensure-desktop.ps1, which exits when electron is already up).
+            // `schtasks /create` has no way to express a repetition interval at all, so what this writes is
+            // a LOGON-ONLY task: toggling auto-launch OFF deletes the hardened task, and toggling it ON
+            // again replaces it with one that cannot recover a wedged shell. `summrise update` heals it and
+            // says so in its log — "desk: SummriseDesktop hardened (guarded 5-min pulse)" — which is how
+            // this collision was found in the first place.
+            //
+            // Doing it properly means New-ScheduledTaskTrigger through PowerShell (the CLI's shape,
+            // duplicated in JS) or delegating to the CLI; neither is a one-liner, and the update-time repair
+            // bounds the damage to "until the next update". Recorded where the downgrade happens, so the
+            // next reader sees the trap instead of rediscovering it from a shell that stopped recovering.
             const r = await runSchtasks([
                 "/create", "/tn", AUTOSTART_TASK,
                 // schtasks re-parses the /tr VALUE as a command line — it needs its