summrise-agent 1.2.468 → 1.2.470

package/bin/summrise.js

@@ -1481,7 +1481,18 @@ function svc(action) {
     // RETURN the status. It used to be discarded, which is why `stop` printed "stopped"
     // and exited 0 for a missing task or an access-denied, and why `start`/`restart` were
     // silent either way. `autostart` already checks; this is the same pattern.
-    return sh(`schtasks /${action} /TN ${TASK}`, { stdio: "inherit" });
+    //
+    // argv, NOT an `sh()` command string: both `${action}` and `${TASK}` used to be
+    // interpolated UNQUOTED into a line cmd.exe parses, which is the door the `psArgv()`
+    // incident comment above describes — a value carrying a space, `&`, `|`, `>` or `<`
+    // is re-parsed as an OPERATOR before schtasks ever sees it, and `TASK` is a
+    // literal only until somebody makes the task name configurable.
+    // schtasks needs no shell feature (no pipe, no `&&`, no redirection) and `/Query`
+    // below already spawns it this way, so the door closes with no behaviour change:
+    // the same program receives the same argv.
+    return (0, child_process_1.spawnSync)("schtasks", [`/${action}`, "/TN", TASK], {
+        stdio: "inherit",
+    });
 }
 /**
  * The scheduled task's State (`Running`, `Ready`, `Disabled`, …) or **null when it could not be read**.
@@ -1915,12 +1926,18 @@ const commands = {
             });
             const pre = pfx.status === 0 ? String(pfx.stdout || "").trim() : "";
             if (selfVer && pre) {
+                // `shell: true` is REQUIRED here (npm on Windows is a `.cmd` shim, which a bare
+                // spawnSync cannot execute) — and that shell JOINS THIS ARGV INTO ONE cmd.exe
+                // LINE, the shape the `processRunning` comment above records for the tasklist
+                // filter. `pre` is a PATH (npm's global prefix), so it is DOUBLE-QUOTED for the
+                // cmd layer: unquoted, a prefix like `C:\Program Files\nodejs` was split at its
+                // space and npm installed the CLI somewhere else while reporting success.
                 const inst = (0, child_process_1.spawnSync)("npm", [
                     "i",
                     "-g",
-                    `summrise-agent@${selfVer}`,
+                    `"summrise-agent@${selfVer}"`,
                     "--prefix",
-                    pre,
+                    `"${pre}"`,
                     "--registry=https://registry.npmjs.org/",
                     "--no-audit",
                     "--no-fund",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "summrise-agent",
-  "version": "1.2.468",
+  "version": "1.2.470",
   "description": "Summrise Agent — Windows device MCP server (terminal/SSH/serial) + panel. Self-hosted npm distribution.",
   "//build": "唯一构建路径：在本目录执行 npm run build。它是自包含的：经 npm exec 按需拉取 typescript@5，无需预装任何 node_modules（干净检出可跑；旧脚本引用 ../summrise-desktop-electron/node_modules/.bin/tsc，干净检出必 ENOENT）。必须用 npm exec --package … -- tsc 的形式：npx 会吃掉传给 tsc 的 -p/--outDir 等参数（round-435：npx 写法从未真正跑通过）。先编 electron TS（--noCheck 纯 emit，与 release.yml 一致）同步两处 src/*.js，再编 src/summrise.ts 到 bin/summrise.js 并校验 round-298 标记（弱 oracle，只证某次构建发生，新鲜性由 publish-release.sh 的 tsc 重编 + cmp 门保证）。",
   "bin": {