summrise-agent 1.2.467 → 1.2.469

package/bin/summrise.js

@@ -64,6 +64,7 @@ exports.newestOf = newestOf;
 exports.latestReleaseVersion = latestReleaseVersion;
 exports.cdnBase = cdnBase;
 exports.componentUrl = componentUrl;
+exports.componentFetchUrl = componentFetchUrl;
 exports.componentKey = componentKey;
 exports.componentPins = componentPins;
 exports.sha256File = sha256File;
@@ -908,6 +909,29 @@ function cdnBase() {
 function componentUrl(name) {
     return `${cdnBase()}/summrise-agent/${name}`;
 }
+/**
+ * The address to FETCH a boxed component from: the release manifest's own `url` for it, or
+ * `componentUrl`'s derived route when the manifest carries none.
+ *
+ * WHY THE MANIFEST IS THE AUTHOR. Every release since the pins existed has published a `url`
+ * beside each component's `sha256` in version.json, and this CLI read the digest while the
+ * address was retyped here — one fact, two authors. They agree today, which is why reading the
+ * manifest is a DRIFT GUARD rather than a fix: index/src/index.js rebuilds the published url
+ * against the origin of the request that asked for `/api/version`, so the address it hands back
+ * is the one this function would have derived — under $SUMMRISE_CDN too, where both move
+ * together. A release whose url and route disagreed (a renamed bundle, the round-115 shape)
+ * now fetches what it published; a silent manifest (an older release, or no network) keeps the
+ * derived route, which is what every release before this one did.
+ *
+ * Pure — the tests pin it. The digest check beside it is unchanged.
+ */
+function componentFetchUrl(name, pins) {
+    const key = componentKey(name);
+    const u = key ? (pins[key] || {}).url : "";
+    return typeof u === "string" && /^https?:\/\/\S+$/.test(u.trim())
+        ? u.trim()
+        : componentUrl(name);
+}
 /** The release manifest's key for a component's FILE name (they are not the same string). */
 function componentKey(fileName) {
     if (fileName.startsWith("summrise-playwright"))
@@ -969,7 +993,14 @@ function resolveComponent(name, pkgPath) {
     const dest = path.join(fs.mkdtempSync(path.join(os.tmpdir(), "summrise-comp-")), name);
     // -f: an HTTP error is a FAILURE, not a 404 page written to disk (the
     // HTML-polluted download that round-54 exists to remember).
-    const r = (0, child_process_1.spawnSync)("curl", ["-fsSL", "-m", "300", "-o", dest, componentUrl(name)], { encoding: "utf8", timeout: 320000 });
+    //
+    // THE MANIFEST IS READ ONCE, BEFORE THE FETCH, because it is the author of the DIGEST (below)
+    // and now of the ADDRESS too (componentFetchUrl). Same read, same object, same order of
+    // effects: an unreachable manifest yields `{}`, the fetch falls back to the derived route, and
+    // the digest check then says "fetched WITHOUT a manifest pin — not verified", exactly as it
+    // did when the address was derived unconditionally.
+    const pins = componentPins();
+    const r = (0, child_process_1.spawnSync)("curl", ["-fsSL", "-m", "300", "-o", dest, componentFetchUrl(name, pins)], { encoding: "utf8", timeout: 320000 });
     if (r.status !== 0 || !fs.existsSync(dest) || fs.statSync(dest).size === 0) {
         return null;
     }
@@ -981,8 +1012,11 @@ function resolveComponent(name, pkgPath) {
     // because the failure it prevents is a device running bytes nobody published.
     // No pin at all (an older release) is a warning, not a refusal: it must not make
     // an install impossible.
+    //
+    // `pins` is the read from above — ONE manifest read per component fetch, exactly as before; the
+    // check itself is unchanged.
     const key = componentKey(name);
-    const pin = key ? (componentPins()[key] || {}).sha256 || "" : "";
+    const pin = key ? (pins[key] || {}).sha256 || "" : "";
     if (pin) {
         const got = sha256File(dest);
         if (got !== pin) {
@@ -1447,7 +1481,18 @@ function svc(action) {
     // RETURN the status. It used to be discarded, which is why `stop` printed "stopped"
     // and exited 0 for a missing task or an access-denied, and why `start`/`restart` were
     // silent either way. `autostart` already checks; this is the same pattern.
-    return sh(`schtasks /${action} /TN ${TASK}`, { stdio: "inherit" });
+    //
+    // argv, NOT an `sh()` command string: both `${action}` and `${TASK}` used to be
+    // interpolated UNQUOTED into a line cmd.exe parses, which is the door the `psArgv()`
+    // incident comment above describes — a value carrying a space, `&`, `|`, `>` or `<`
+    // is re-parsed as an OPERATOR before schtasks ever sees it, and `TASK` is a
+    // literal only until somebody makes the task name configurable.
+    // schtasks needs no shell feature (no pipe, no `&&`, no redirection) and `/Query`
+    // below already spawns it this way, so the door closes with no behaviour change:
+    // the same program receives the same argv.
+    return (0, child_process_1.spawnSync)("schtasks", [`/${action}`, "/TN", TASK], {
+        stdio: "inherit",
+    });
 }
 /**
  * The scheduled task's State (`Running`, `Ready`, `Disabled`, …) or **null when it could not be read**.
@@ -1881,12 +1926,18 @@ const commands = {
             });
             const pre = pfx.status === 0 ? String(pfx.stdout || "").trim() : "";
             if (selfVer && pre) {
+                // `shell: true` is REQUIRED here (npm on Windows is a `.cmd` shim, which a bare
+                // spawnSync cannot execute) — and that shell JOINS THIS ARGV INTO ONE cmd.exe
+                // LINE, the shape the `processRunning` comment above records for the tasklist
+                // filter. `pre` is a PATH (npm's global prefix), so it is DOUBLE-QUOTED for the
+                // cmd layer: unquoted, a prefix like `C:\Program Files\nodejs` was split at its
+                // space and npm installed the CLI somewhere else while reporting success.
                 const inst = (0, child_process_1.spawnSync)("npm", [
                     "i",
                     "-g",
-                    `summrise-agent@${selfVer}`,
+                    `"summrise-agent@${selfVer}"`,
                     "--prefix",
-                    pre,
+                    `"${pre}"`,
                     "--registry=https://registry.npmjs.org/",
                     "--no-audit",
                     "--no-fund",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "summrise-agent",
-  "version": "1.2.467",
+  "version": "1.2.469",
   "description": "Summrise Agent — Windows device MCP server (terminal/SSH/serial) + panel. Self-hosted npm distribution.",
   "//build": "唯一构建路径：在本目录执行 npm run build。它是自包含的：经 npm exec 按需拉取 typescript@5，无需预装任何 node_modules（干净检出可跑；旧脚本引用 ../summrise-desktop-electron/node_modules/.bin/tsc，干净检出必 ENOENT）。必须用 npm exec --package … -- tsc 的形式：npx 会吃掉传给 tsc 的 -p/--outDir 等参数（round-435：npx 写法从未真正跑通过）。先编 electron TS（--noCheck 纯 emit，与 release.yml 一致）同步两处 src/*.js，再编 src/summrise.ts 到 bin/summrise.js 并校验 round-298 标记（弱 oracle，只证某次构建发生，新鲜性由 publish-release.sh 的 tsc 重编 + cmp 门保证）。",
   "bin": {

package/summrise-desktop-electron/src/main.js

@@ -165,6 +165,32 @@ function probeImage(p) {
 function frameOk(e) {
     return (0, url_policy_1.frameUrlOk)(e.senderFrame?.url || "");
 }
+// THE ONE REFUSAL a forbidden frame gets. It used to have TWO shapes — seven
+// handlers answered this one and the rest answered a bare `{ ok: false }`,
+// which the SPA cannot tell apart from a dead view (`j?.ok` is falsy either
+// way, and only this shape carries the reason). The preload's `invoke` callers
+// were written against THIS shape, so every handler answers it now.
+const FORBIDDEN_FRAME = Object.freeze({
+    ok: false,
+    error: "forbidden frame",
+});
+// THE ONE IPC DOOR: `ipcMain.handle` is called HERE and nowhere else, so the
+// frame check above is applied ONCE per channel and no handler can forget it.
+// A fourteenth handler that re-checked (or skipped) the frame was SILENT:
+// main.ts imports electron, so no node suite can import it and notice — the
+// pin is a SOURCE check instead (test/ipc-door.test.mjs counts the call sites).
+//
+// Handlers get the invoke ARGUMENTS only: every one of them used the event for
+// nothing but the frame check. The refusal is decided before the handler runs,
+// so a forbidden frame never reaches the implementation (no schtasks spawn, no
+// browser window, no loadURL).
+function ipcHandle(channel, fn) {
+    electron_1.ipcMain.handle(channel, (e, ...args) => {
+        if (!frameOk(e))
+            return FORBIDDEN_FRAME;
+        return fn(...args);
+    });
+}
 // P1: CDP port for AI (playwright) to drive Summrise's own pages — the SAME
 // Electron window the user watches. Summrise's playwright-mcp connects via
 // connectOverCDP("http://127.0.0.1:9333") and drives this window's pages.
@@ -365,11 +391,30 @@ function buildMenu() {
     return electron_1.Menu.buildFromTemplate(template);
 }
 // --- Browser-session control: shared core (used by both IPC and HTTP) ---
-/** Only http/https/about:blank targets are allowed — file:// and other
- *  schemes would hand the AI a local-file read primitive via the shared
- *  CDP endpoint (stage-n hardening). */
+/** THE ONE LOAD DOOR (stage-n hardening): every raw URL this shell is asked to
+ *  load — a browser-session window, the embedded real-render view, a
+ *  window.open() from a page inside it — is decided HERE and nowhere else.
+ *
+ *  Only http/https/about:blank survive; file:// and every other scheme
+ *  collapse to "about:blank", because a loadable file:// would hand the AI a
+ *  local-file read primitive via the shared CDP endpoint (:9333).
+ *
+ *  The DECISION itself is url-policy.sanitizeBrowserUrl() — pure, and
+ *  unit-tested in test/url-policy.test.mjs, since main.ts imports electron and
+ *  no node suite can import it. This function is that predicate's ONE call site
+ *  in the shell (test/ipc-door.test.mjs pins the count), so a fourth load site
+ *  cannot quietly reach for a weaker policy of its own.
+ *
+ *  Callers keep their own about:blank semantics: browserOpen() opens a blank
+ *  window, embeddedNavigate() loads it, and the embedded view's window-open
+ *  handler REFUSES it (an external link must not blank the page being read). */
+function loadTarget(raw) {
+    return (0, url_policy_1.sanitizeBrowserUrl)(raw);
+}
+/** Open a browser-session window on a decided load target (loadTarget() is the
+ *  ONE load door — the scheme policy lives there). */
 function browserOpen(url) {
-    const target = (0, url_policy_1.sanitizeBrowserUrl)(url);
+    const target = loadTarget(url);
     // stage-n: reuse an existing window on the same URL instead of stacking
     // duplicates (AI-driven browsing opens/closes sessions repeatedly); focus
     // the existing window. Match against the window's INITIAL target (stored
@@ -433,9 +478,9 @@ function browserList() {
     const list = [...browserSessions.entries()].map(([id, bw]) => ({ id, url: bw.webContents.getURL() }));
     return { ok: true, sessions: list, cdp: `http://127.0.0.1:${CDP_PORT}` };
 }
-electron_1.ipcMain.handle("browser-session:open", (e, url) => frameOk(e) ? browserOpen(url) : { ok: false, error: "forbidden frame" });
-electron_1.ipcMain.handle("browser-session:close", (e, id) => frameOk(e) ? browserClose(id) : { ok: false, error: "forbidden frame" });
-electron_1.ipcMain.handle("browser-session:list", (e) => frameOk(e) ? browserList() : { ok: false, error: "forbidden frame" });
+ipcHandle("browser-session:open", (url) => browserOpen(url));
+ipcHandle("browser-session:close", (id) => browserClose(id));
+ipcHandle("browser-session:list", () => browserList());
 // ── Embedded real-render browser view (round-246) ──────────────────────────
 // The SPA's Browser page used to show the BRIDGE's headless-chromium as a
 // JPEG screencast (lossy q60-92 frames over a websocket) — never as sharp as
@@ -473,12 +518,13 @@ function embeddedViewEnsure() {
     // window) were DENIED, so clicking them did nothing. The embedded view is
     // a single-tab browser: intercept window.open and navigate the SAME view
     // to the requested URL instead (the address bar follows via the nav
-    // events). Only http/https/data/about are honored — anything else
-    // (javascript:, file:, chrome:) is dropped like the url-policy requires.
+    // events). The scheme allow-list is loadTarget()'s (the ONE load door):
+    // anything it refuses (javascript:, file:, chrome:) must NOT blank the page
+    // the user is reading, so a refused target is dropped here instead.
     view.webContents.setWindowOpenHandler(({ url }) => {
-        const safe = (0, url_policy_1.sanitizeBrowserUrl)(url);
-        if (safe && safe !== "about:blank") {
-            embeddedNavigate(safe);
+        const target = loadTarget(url);
+        if (target !== "about:blank") {
+            embeddedNavigate(target);
         }
         return { action: "deny" };
     });
@@ -519,7 +565,9 @@ function embeddedViewPlace(bounds) {
     win.contentView.addChildView(view);
 }
 function embeddedNavigate(raw) {
-    const url = (0, url_policy_1.sanitizeBrowserUrl)(raw);
+    // Every raw URL the SPA/AI hands the embedded view is decided by the ONE
+    // load door before it reaches loadURL.
+    const url = loadTarget(raw);
     const view = embeddedViewEnsure();
     embeddedUrl = url;
     view.webContents.loadURL(url).catch(() => { });
@@ -621,6 +669,8 @@ function embeddedRecover() {
     const view = embeddedViewEnsure();
     if (!view || view.webContents.isDestroyed())
         return { ok: false };
+    // Already decided by loadTarget() when embeddedUrl was set (the ONE load
+    // door) — recovery re-loads that decision, it does not re-open the policy.
     const url = embeddedUrl && embeddedUrl !== "about:blank" ? embeddedUrl : "https://www.bing.com";
     view.webContents.loadURL(url).catch(() => { });
     // Re-show if the SPA slot is live (bounds were placed before the crash).
@@ -631,16 +681,14 @@ function embeddedRecover() {
     }
     return { ok: true };
 }
-electron_1.ipcMain.handle("embedded-browser:recover", (e) => frameOk(e) ? embeddedRecover() : { ok: false });
-electron_1.ipcMain.handle("embedded-browser:navigate", (e, url) => frameOk(e) ? embeddedNavigate(String(url || "")) : { ok: false, error: "forbidden frame" });
-electron_1.ipcMain.handle("embedded-browser:back", (e) => frameOk(e) ? embeddedGo(-1) : { ok: false });
-electron_1.ipcMain.handle("embedded-browser:fwd", (e) => frameOk(e) ? embeddedGo(1) : { ok: false });
-electron_1.ipcMain.handle("embedded-browser:reload", (e) => frameOk(e) ? embeddedReload() : { ok: false });
+ipcHandle("embedded-browser:recover", () => embeddedRecover());
+ipcHandle("embedded-browser:navigate", (url) => embeddedNavigate(String(url || "")));
+ipcHandle("embedded-browser:back", () => embeddedGo(-1));
+ipcHandle("embedded-browser:fwd", () => embeddedGo(1));
+ipcHandle("embedded-browser:reload", () => embeddedReload());
 /** round-251: zoom the REAL embedded view (webContents.setZoomFactor — the
  *  native browser zooms, not a CSS scale). factor: 0.5-3.0. */
-electron_1.ipcMain.handle("embedded-browser:zoom", (e, factor) => {
-    if (!frameOk(e))
-        return { ok: false };
+ipcHandle("embedded-browser:zoom", (factor) => {
     const view = embeddedView;
     if (!view || view.webContents.isDestroyed())
         return { ok: false };
@@ -653,13 +701,11 @@ electron_1.ipcMain.handle("embedded-browser:zoom", (e, factor) => {
         return { ok: false };
     }
 });
-electron_1.ipcMain.handle("embedded-browser:place", (e, bounds) => {
-    if (!frameOk(e))
-        return { ok: false };
+ipcHandle("embedded-browser:place", (bounds) => {
     embeddedViewPlace(bounds);
     return { ok: true };
 });
-electron_1.ipcMain.handle("embedded-browser:state", (e) => frameOk(e) ? embeddedState() : { ok: false, error: "forbidden frame" });
+ipcHandle("embedded-browser:state", () => embeddedState());
 // Desktop-app settings (auto-launch) — the Settings page toggles this. We
 // manage a per-user scheduled task ("SummriseDesktop", onlogon) instead of
 // Electron's setLoginItemSettings: in dev mode (electron .) the login-item
@@ -752,10 +798,10 @@ async function autoLaunchTaskSet(enabled) {
         return { ok: false, error: String(e) };
     }
 }
-electron_1.ipcMain.handle("desktop:get-auto-launch", async (e) => frameOk(e) ? { ok: true, enabled: await autoLaunchTaskExists() } : { ok: false, error: "forbidden frame" });
+ipcHandle("desktop:get-auto-launch", async () => ({ ok: true, enabled: await autoLaunchTaskExists() }));
 // The auto-launch pair is the PERSISTENCE primitive (onlogon schtasks in an
 // admin context) — it absolutely cannot be reachable from a foreign frame.
-electron_1.ipcMain.handle("desktop:set-auto-launch", async (e, enabled) => frameOk(e) ? autoLaunchTaskSet(!!enabled) : { ok: false, error: "forbidden frame" });
+ipcHandle("desktop:set-auto-launch", async (enabled) => autoLaunchTaskSet(!!enabled));
 // --- Agent lifecycle (stage-m: Rust owns it; the shell only probes/triggers) ---
 // review #2 (HIGH): a raw TCP connect only proves the PORT is held — an
 // agent that is wedged (deadlock / OOM-parked) but still listening keeps the