summrise-agent 1.2.490 → 1.2.492

package/bin/summrise.js

@@ -34,8 +34,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.BOOT_TASKS = exports.psq = void 0;
+exports.BOOT_TASKS = exports.DESKTOP_AUMID = exports.psq = void 0;
 exports.psArgv = psArgv;
+exports.lnkIdentity = lnkIdentity;
 exports.deskShortcutRepairPs = deskShortcutRepairPs;
 exports.startDesktopPs = startDesktopPs;
 exports.desktopTaskPs = desktopTaskPs;
@@ -298,13 +299,169 @@ function psFile(script) {
 // exported: unit-tested in test/cli.test.mjs (SYSTEM-context PS quoting = injection surface)
 const psq = (x) => String(x).replace(/'/g, "''");
 exports.psq = psq;
+/** The taskbar identity: ONE string, and it lives on BOTH sides of an association.
+ *
+ *  It is the AppUserModelID the desktop shell sets on its process
+ *  (`agent/summrise-desktop-electron/src/main.ts`) and the value written into
+ *  `System.AppUserModel.ID` on the shortcut below. Microsoft's lookup for the taskbar
+ *  group's icon takes the shortcut arm only when the window carries an explicit ID, and
+ *  the window's arm only names a shortcut carrying the SAME ID — so the two halves are one
+ *  association and this is the string that ties them. If they ever disagree, the icon
+ *  silently reverts to the backing executable (stock `electron.exe`, since the shell runs
+ *  unpackaged) with nothing on the device to read that says why.
+ *  PowerShell/Windows AppUserModelIDs cannot contain spaces, and this one does not.
+ *
+ *  WHY IT IS NOT `online.saisi.summrise.agent`, WHICH IS WHAT IT WAS CALLED BEFORE —
+ *  MEASURED on desktop-14rjcr8 (release 1.2.490), ONE VARIABLE AT A TIME:
+ *
+ *    | window's AppUserModelID          | shortcut carries it  | taskbar draws   |
+ *    | window's AppUserModelID       | shortcuts carrying it          | taskbar draws |
+ *    | online.saisi.summrise.agent   | both desktops + Start Menu     | Electron logo |
+ *    | online.saisi.summrise.desktop | both desktops + Start Menu     | THE SUNRISE   |
+ *    | online.saisi.summrise.desktop | both desktops, Start Menu GONE | Electron logo |
+ *
+ *  That third row is the one that decides where the identity has to live, and it was taken
+ *  WITHOUT restarting anything: the same running shell, the same AppUserModelID already set,
+ *  and the icon fell back to the Electron logo the moment the Start Menu shortcut was
+ *  deleted. So the shortcut this lookup resolves is the **Start Menu** one — a desktop
+ *  shortcut is not enough, and writing the identity onto `Summrise.lnk` in
+ *  `%PUBLIC%\Desktop` alone changes nothing. Microsoft's appids.md does say to apply the ID
+ *  to "all of the shortcuts" when an application has several launch locations, and it lists
+ *  the Start menu FIRST; the measurement is what says which of them the taskbar actually
+ *  reads.
+ *
+ *  The other variables were held: the same `IPropertyStore` call read back on every
+ *  shortcut, the same `icon.ico` (downloaded and RENDERED — it is the orange sunrise), the
+ *  same shell restarted under the `SummriseDesktop` task, and in each restarted run the
+ *  running process appended `AUMID-SET-OK` to a log from inside `setAppUserModelId`, so "the
+ *  ID was set" is measured rather than assumed.
+ *
+ *  WHY THE OLD ID WAS DEAD. Releases up to 1.2.489 set `online.saisi.summrise.agent` on the
+ *  process while no shortcut anywhere carried it, so the shell resolved that ID against the
+ *  backing executable — stock `electron.exe` — and kept the result. `shell:AppsFolder` still
+ *  lists it as `name=[Electron] path=[online.saisi.summrise.agent]`, an app entry named after
+ *  `electron.exe`. An ID already resolved to the wrong image is not repaired by writing the
+ *  shortcut afterwards; the association has to be under a name the machine has never seen.
+ *  Keep this string STABLE from here: changing it again costs the pin and the jump list, so
+ *  this is a one-time migration, not a knob.
+ */
+exports.DESKTOP_AUMID = "online.saisi.summrise.desktop";
+/** The two `IPropertyStore` values `Summrise.lnk` must carry, as DATA.
+ *
+ *  Deliberately separated from the PowerShell that performs the write, and exported, so the
+ *  DECISION is testable where the COM call is not: a test can pin what the CLI intends to
+ *  write without a Windows box. `icoPath` is the shell's own sunrise `.ico`; the `,0` is the
+ *  icon index and is REQUIRED — the property's own documentation: "because .ico files can
+ *  contain multiple icon resources, a resource ID is required in the string. If the .ico
+ *  file is a single image, use '0'".
+ *
+ *  `IconLocation` on the shortcut is a DIFFERENT thing and is left alone: it is what
+ *  Explorer draws for the .lnk FILE. These two are what the taskbar GROUP uses.
+ */
+function lnkIdentity(icoPath) {
+    return { id: exports.DESKTOP_AUMID, icon: `${icoPath},0` };
+}
+/** C# interop for the two shortcut properties `WScript.Shell` cannot set.
+ *
+ *  WHY THIS MECHANISM, given this repository prefers Rust for logic: `System.AppUserModel.ID`
+ *  and `System.AppUserModel.RelaunchIconResource` are not fields of the .lnk header — they
+ *  live in the shortcut's `IPropertyStore`, and `WScript.Shell` exposes no way to reach one.
+ *  The route Microsoft documents for a shortcut is `IShellLink` + `QueryInterface` for
+ *  `IPropertyStore` ("A shortcut (as an IShellLink, CLSID_ShellLink, or a .lnk file) supports
+ *  properties through IPropertyStore", shell/appids.md) — COM interop, in the launcher's own
+ *  script generator, which is already PowerShell and already writing this shortcut.
+ *  `Add-Type` compiles it with the C# compiler that ships IN the box: nothing installed,
+ *  nothing downloaded, and it runs on a stock Windows box with no Node, no Rust and no SDK.
+ *  A Rust helper is the repository's usual preference and was rejected HERE on cost, not on
+ *  taste: it needs a new cross-compiled binary in the npm package, and this package "carries
+ *  NO boxed components" by design — `setup` fetches and hash-pins them — so ~60 lines of
+ *  interop would buy a build stage, a release-host component and a new pin.
+ *
+ *  TWO THINGS THE DEVICE TAUGHT, both load-bearing:
+ *   - `IPersistFile::Load` must be given STGM_READWRITE (2). Loading with 0 opens the link
+ *     READ-ONLY and the later `IPropertyStore::Commit` fails STG_E_ACCESSDENIED (0x80030005)
+ *     — measured on desktop-14rjcr8, where the first version of this passed 0 and wrote
+ *     nothing while reporting no error the caller could see.
+ *   - the write is verified by READING THE PROPERTIES BACK with `Read`, which is also what
+ *     decides whether the shortcut needs repairing at all.
+ */
+const LNK_PROPS_CS = `using System;
+using System.Runtime.InteropServices;
+public static class SummriseLnk {
+  [StructLayout(LayoutKind.Sequential, Pack = 4)]
+  struct PROPERTYKEY { public Guid fmtid; public uint pid; }
+  [StructLayout(LayoutKind.Sequential)]
+  struct PROPVARIANT { public ushort vt, r1, r2, r3; public IntPtr p, p2; }
+  [ComImport, Guid("886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99"), InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
+  interface IPropertyStore {
+    int GetCount(out uint c);
+    int GetAt(uint i, out PROPERTYKEY k);
+    int GetValue(ref PROPERTYKEY k, out PROPVARIANT v);
+    int SetValue(ref PROPERTYKEY k, ref PROPVARIANT v);
+    int Commit();
+  }
+  [ComImport, Guid("0000010b-0000-0000-C000-000000000046"), InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
+  interface IPersistFile {
+    void GetClassID(out Guid g);
+    [PreserveSig] int IsDirty();
+    void Load([MarshalAs(UnmanagedType.LPWStr)] string f, uint m);
+    void Save([MarshalAs(UnmanagedType.LPWStr)] string f, [MarshalAs(UnmanagedType.Bool)] bool r);
+    void SaveCompleted([MarshalAs(UnmanagedType.LPWStr)] string f);
+    void GetCurFile([MarshalAs(UnmanagedType.LPWStr)] out string f);
+  }
+  static readonly Guid CLSID = new Guid("00021401-0000-0000-C000-000000000046");
+  static readonly Guid FMT = new Guid("9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3");
+  const uint RW = 2;
+  static PROPERTYKEY K(uint pid) { PROPERTYKEY k; k.fmtid = FMT; k.pid = pid; return k; }
+  static object New(string lnk, uint mode) {
+    object o = Activator.CreateInstance(Type.GetTypeFromCLSID(CLSID));
+    ((IPersistFile)o).Load(lnk, mode);
+    return o;
+  }
+  static string Get(string lnk, uint pid, uint mode) {
+    IPropertyStore s = (IPropertyStore)New(lnk, mode);
+    PROPERTYKEY k = K(pid); PROPVARIANT v;
+    if (s.GetValue(ref k, out v) != 0) return "";
+    if (v.vt != 31 || v.p == IntPtr.Zero) return "";
+    string r = Marshal.PtrToStringUni(v.p);
+    Marshal.FreeCoTaskMem(v.p);
+    return r;
+  }
+  static void Put(IPropertyStore s, uint pid, string val) {
+    PROPERTYKEY k = K(pid); PROPVARIANT v = new PROPVARIANT();
+    v.vt = 31; v.p = Marshal.StringToCoTaskMemUni(val);
+    try { int hr = s.SetValue(ref k, ref v); if (hr != 0) Marshal.ThrowExceptionForHR(hr); }
+    finally { Marshal.FreeCoTaskMem(v.p); }
+  }
+  public static string Read(string lnk) { return Get(lnk, 5, 0) + "|" + Get(lnk, 3, 0); }
+  public static void Write(string lnk, string id, string icon) {
+    object o = New(lnk, RW);
+    IPropertyStore s = (IPropertyStore)o;
+    Put(s, 5, id); Put(s, 3, icon);
+    int hr = s.Commit();
+    if (hr != 0) Marshal.ThrowExceptionForHR(hr);
+    ((IPersistFile)o).Save(lnk, true);
+  }
+}`;
 // stage-brand: healed desktop shortcut. A 2026-09-01 Summrise.lnk on devices
 // points at the RETIRED Tauri summrise-desktop.exe (embedded stale icon) —
 // double-clicking it launches the dead app instead of the Electron shell.
 // Repair (only if the link already exists — headless installs must not
 // sprout desktop icons): repoint at start-desktop.ps1 (the SummriseDesktop
-// onlogon path) with IconLocation pinned to the sunrise icon.ico, and
-// remove the retired Tauri/tray orphans nothing ships anymore.
+// onlogon path) with IconLocation pinned to the sunrise icon.ico, remove the
+// retired Tauri/tray orphans nothing ships anymore, AND write the taskbar
+// identity (System.AppUserModel.ID + RelaunchIconResource) into the link's
+// property store.
+//
+// WHY THE IDENTITY IS PART OF *THIS* FUNCTION: a shortcut with the right target
+// and the wrong (or absent) identity is exactly the state that draws the
+// Electron logo — the shell sets the same AppUserModelID on its process, and the
+// taskbar's icon lookup reaches the shortcut arm only when a shortcut carrying
+// that ID can be found. MEASURED on desktop-14rjcr8 before this change: both
+// Summrise.lnk files existed and carried NEITHER property, which is why an
+// explicit ID on the window alone changed nothing and why deleting that ID
+// (d4edbb64) changed nothing either.
+//
 // Best-effort + logged, never fatal. `sink` is a PS output pipe
 // (e.g. Write-Host, or the update log pipe). Single-quoted PS literals
 // only (npm audit #6) except the double quotes the .lnk Arguments path
@@ -313,18 +470,66 @@ exports.psq = psq;
 // script to `ps()` as argv and the update swap runs it from a file. The
 // backslash-escape `setup` used to apply was deleted with that conversion
 // (see step 7), which is why this line no longer says "escape them".
+// The C# rides in a single-quoted HERE-STRING (`@'` … `'@`, both alone on
+// their line): it contains double quotes and is literal end to end, so the
+// doubling rule above cannot be defeated by anything inside it.
 // exported: unit-tested in test/cli.test.mjs.
 function deskShortcutRepairPs(scriptsQ, deskDirQ, sink) {
+    const { id, icon } = lnkIdentity(`${deskDirQ}\\icon.ico`);
+    // BOTH shortcuts get the identity, and the START MENU one is the load-bearing half:
+    // deleting it from a running shell reverted the taskbar to the Electron logo with the ID
+    // still set on the process and both desktop shortcuts still carrying it (see DESKTOP_AUMID).
+    // The desktop link is kept because it is what a person double-clicks and because
+    // appids.md says to apply the ID to "all of the shortcuts" a user can launch from.
+    const lnk = (p, tag) => [
+        `  try { $dWs${tag} = New-Object -ComObject WScript.Shell; $dSc${tag} = $dWs${tag}.CreateShortcut(${p}); $dSc${tag}.TargetPath = Join-Path $env:SystemRoot 'System32\\WindowsPowerShell\\v1.0\\powershell.exe'; $dSc${tag}.Arguments = '-NoProfile -ExecutionPolicy Bypass -File "' + $dPs1 + '"'; $dSc${tag}.WorkingDirectory = '${deskDirQ}'; $dSc${tag}.IconLocation = $dIco + ',0'; $dSc${tag}.Save(); 'desk: ' + ${p} + ' repointed to electron shell' | ${sink} } catch { ('desk: ' + ${p} + ' repair failed: ' + $_.Exception.Message) | ${sink} }`,
+        `  if ($dSet) { try { [SummriseLnk]::Write(${p}, $dId, $dRes); ('desk: ' + ${p} + ' taskbar identity [' + [SummriseLnk]::Read(${p}) + ']') | ${sink} } catch { ('desk: ' + ${p} + ' identity write failed: ' + $_.Exception.Message) | ${sink} } }`,
+    ];
     return [
         `$dLnk = Join-Path $env:PUBLIC 'Desktop\\Summrise.lnk'`,
+        // ALL-USERS Start Menu: the shortcut the shell's app resolver actually reads, and it is
+        // CREATED here when absent — a machine that never had one is exactly the machine whose
+        // taskbar shows the Electron logo, and no amount of desktop-side repair reaches it.
+        // `setup` already requires elevation (HKLM writes, Program Files), so ProgramData is
+        // writable on every path that calls this.
+        `$dSm = Join-Path $env:ProgramData 'Microsoft\\Windows\\Start Menu\\Programs\\Summrise.lnk'`,
         `$dIco = '${deskDirQ}\\icon.ico'`,
         `$dPs1 = '${scriptsQ}\\start-desktop.ps1'`,
+        `$dId = '${id}'`,
+        `$dRes = '${icon}'`,
+        `$dSet = $false`,
+        `$dShell = (Test-Path $dIco) -and (Test-Path $dPs1)`,
+        // Compiled when there is a SHELL to point at, not when a desktop link happens to exist:
+        // the Start Menu shortcut is created from nothing, so gating this on `$dLnk` would skip
+        // the identity on precisely the installs that need it. The `-as [type]` guard keeps a
+        // second call in one process from turning a "type already exists" throw into a silent
+        // skip of every write below.
+        `if ($dShell) {`,
+        `  $dCs = @'\n${LNK_PROPS_CS}\n'@`,
+        `  try { if (-not ('SummriseLnk' -as [type])) { Add-Type -TypeDefinition $dCs }; $dSet = [bool]('SummriseLnk' -as [type]) } catch { ('desk: lnk identity helper unavailable: ' + $_.Exception.Message) | ${sink} }`,
+        `}`,
         `$dNeed = $false`,
         `if (Test-Path $dLnk) {`,
         `  try { $dEx = (New-Object -ComObject WScript.Shell).CreateShortcut($dLnk); if (($dEx.TargetPath -like '*summrise-desktop.exe') -or ($dEx.TargetPath -like '*summrise-tray.exe') -or (-not (Test-Path $dEx.TargetPath))) { $dNeed = $true } } catch { $dNeed = $true }`,
+        // ...and a link that is otherwise healthy still needs repairing when its identity is
+        // missing or names a different ID/icon. `Read` returns "id|icon", so ONE comparison
+        // covers both properties — and it is the same call the verification below prints.
+        `  if ($dSet) { try { if (([SummriseLnk]::Read($dLnk)) -ne ($dId + '|' + $dRes)) { $dNeed = $true } } catch { $dNeed = $true } }`,
         `}`,
-        `if ($dNeed -and (Test-Path $dIco) -and (Test-Path $dPs1)) {`,
-        `  try { $dWs = New-Object -ComObject WScript.Shell; $dSc = $dWs.CreateShortcut($dLnk); $dSc.TargetPath = Join-Path $env:SystemRoot 'System32\\WindowsPowerShell\\v1.0\\powershell.exe'; $dSc.Arguments = '-NoProfile -ExecutionPolicy Bypass -File "' + $dPs1 + '"'; $dSc.WorkingDirectory = '${deskDirQ}'; $dSc.IconLocation = $dIco + ',0'; $dSc.Save(); 'desk: Summrise.lnk repointed to electron shell' | ${sink} } catch { ('desk: Summrise.lnk repair failed: ' + $_.Exception.Message) | ${sink} }`,
+        // The Start Menu link is created when ABSENT and rewritten when its identity is wrong —
+        // it is never deleted, and a link that already matches is left alone so a second `setup`
+        // does not churn the file.
+        `$dSmNeed = $false`,
+        `if ($dShell) {`,
+        `  if (-not (Test-Path $dSm)) { $dSmNeed = $true }`,
+        `  elseif (-not $dSet) { $dSmNeed = $true }`,
+        `  else { try { if (([SummriseLnk]::Read($dSm)) -ne ($dId + '|' + $dRes)) { $dSmNeed = $true } } catch { $dSmNeed = $true } }`,
+        `}`,
+        `if ($dNeed -and $dShell) {`,
+        ...lnk("$dLnk", "1"),
+        `}`,
+        `if ($dSmNeed -and $dShell) {`,
+        ...lnk("$dSm", "2"),
         `}`,
         `foreach ($dRx in @('summrise-desktop.exe','summrise-tray.exe')) { $dRp = '${deskDirQ}\\' + $dRx; if (Test-Path $dRp) { try { Remove-Item -Force -ErrorAction Stop $dRp; ('desk: removed retired ' + $dRx) | ${sink} } catch { ('desk: retired ' + $dRx + ' locked, kept') | ${sink} } } }`,
     ];
@@ -363,7 +568,30 @@ function desktopTaskPs(installQ) {
         `$dt1 = New-ScheduledTaskTrigger -AtLogOn`,
         `$dw1 = New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(3) -RepetitionInterval (New-TimeSpan -Minutes 5)`,
         `$pr = New-ScheduledTaskPrincipal -UserId ('{0}\\{1}' -f $env:USERDOMAIN, $env:USERNAME) -LogonType Interactive -RunLevel Highest`,
-        `$st = New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Minutes 10) -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -MultipleInstances IgnoreNew`,
+        // NO EXECUTION TIME LIMIT -- the same value, in the same spelling, the agent's own task has
+        // carried since round 118 for the same reason: `- ExecutionTimeLimit 0   never kill the
+        // running task`. It was `-Minutes 10` here, and that WAS the defect.
+        //
+        // WHY A LIMIT KILLS A SHELL MEANT TO LIVE INDEFINITELY: this task's action is
+        // desktop-pulse.vbs -> ensure-desktop.ps1 -> start-desktop.ps1, and that last line is
+        // `& electron.exe .` -- the PowerShell CALL OPERATOR, which WAITS. The PowerShell the task
+        // launched therefore stays alive for as long as the shell does, as the shell's PARENT, and
+        // Task Scheduler enforces ExecutionTimeLimit on that process tree. Ten minutes after every
+        // start the scheduler killed the running shell; five minutes later the guarded pulse
+        // correctly brought a fresh one back; ten minutes after that it died again. The operator
+        // reported that as "反复重启", four times.
+        //
+        // NOTHING RELIED ON THE KILL, which is why removing it is the fix rather than a trade. This
+        // repository's recovery for a shell that is GONE is the guarded 5-minute pulse, and
+        // summrise-desktop-electron/src/main.ts says so from the other side, naming a logon-only task
+        // as one that "cannot recover a wedged shell". A shell that is RUNNING but wedged was never
+        // this limit's business either: the pulse's guard is a process-EXISTENCE check
+        // (`if (Get-Process electron) { exit }`), so it cannot see a wedged shell whether the limit is
+        // ten minutes or absent. `summrise update` is what heals a wedged shell, and its log says so.
+        //
+        // Measured on desktop-14rjcr8: under PT10M the four electron PIDs were replaced about every
+        // ten minutes; under PT0S the same four PIDs were still there 11 minutes later.
+        `$st = New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Seconds 0) -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -MultipleInstances IgnoreNew`,
         `Register-ScheduledTask SummriseDesktop -Action $da -Trigger @($dt1,$dw1) -Principal $pr -Settings $st -Force | Out-Null`,
         `Start-ScheduledTask -TaskName SummriseDesktop`,
     ];
@@ -2879,7 +3107,15 @@ const commands = {
             `  $da = New-ScheduledTaskAction -Execute 'wscript.exe' -Argument ('"' + $vb1 + '"') -WorkingDirectory '${q}'`,
             `  $dt1 = New-ScheduledTaskTrigger -AtLogOn`,
             `  $dw1 = New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(3) -RepetitionInterval (New-TimeSpan -Minutes 5)`,
-            `  Set-ScheduledTask -TaskName 'SummriseDesktop' -Action $da -Trigger @($dt1, $dw1) | Out-Null`,
+            // AND THE SETTINGS, WHICH IS THE HALF THAT REACHES A MACHINE ALREADY INSTALLED.
+            // This call used to pass only -Action and -Trigger, and `Set-ScheduledTask` PRESERVES the
+            // components it is not given — so an execution limit already on the task survived every
+            // update. That is the wrong shape for a heal: `summrise update` is the only mechanism that
+            // reaches the fleet, and a device carrying the old 10-minute limit would have kept it
+            // forever while its log said "hardened". The value is the same one `setup` writes, so the
+            // two cannot diverge — and installer_integrity.rs holds both ends to it.
+            `  $dst = New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Seconds 0) -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -MultipleInstances IgnoreNew`,
+            `  Set-ScheduledTask -TaskName 'SummriseDesktop' -Action $da -Trigger @($dt1, $dw1) -Settings $dst | Out-Null`,
             `  "[$(Get-Date -Format o)] desk: SummriseDesktop hardened (guarded 5-min pulse)" | ${log}`,
             `}`,
             `if ((Test-Path $deskDir) -and (Test-Path $deskStart)) {`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "summrise-agent",
-  "version": "1.2.490",
+  "version": "1.2.492",
   "description": "Summrise Agent — Windows device MCP server (terminal/SSH/serial) + panel. Self-hosted npm distribution.",
   "//build": "唯一构建路径：在本目录执行 npm run build。它是自包含的：经 npm exec 按需拉取 typescript@5，无需预装任何 node_modules（干净检出可跑；旧脚本引用 ../summrise-desktop-electron/node_modules/.bin/tsc，干净检出必 ENOENT）。必须用 npm exec --package … -- tsc 的形式：npx 会吃掉传给 tsc 的 -p/--outDir 等参数（round-435：npx 写法从未真正跑通过）。先编 electron TS（--noCheck 纯 emit，与 release.yml 一致）同步两处 src/*.js，再编 src/summrise.ts 到 bin/summrise.js 并校验 round-298 标记（弱 oracle，只证某次构建发生，新鲜性由 publish-release.sh 的 tsc 重编 + cmp 门保证）。",
   "bin": {

package/summrise-desktop-electron/src/main.js

@@ -47,6 +47,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 // No spawn() of summrise-agent.exe from JS — that was the d1 Chrome-OOM root
 // cause (a bind-failed child wedged on "Press Enter to exit" forever).
 const electron_1 = require("electron");
+// IPC audit #6: execSync/ChildProcess were vestigial imports from the
+// pre-async-spawn era (round-117 removed the call sites) — dropped so
+// eslint/tsc keep the surface honest. The last one to go was the empty
+// `import type {} from "child_process"` that stood here: it imported
+// NOTHING (the schtasks runner reaches the module through require() with its
+// own `as typeof import(...)` type), and a type-only import of a module the
+// shell does not otherwise import is a "dependency" no reader can act on.
 const path = __importStar(require("path"));
 const fs = __importStar(require("fs"));
 const http = __importStar(require("http"));
@@ -319,13 +326,7 @@ function buildMenu() {
                 { label: "New Serial Connection…", accelerator: "CmdOrCtrl+Shift+P", click: () => sendMenu("new-serial") },
                 { label: "New Browser Session…", accelerator: "CmdOrCtrl+Shift+B", click: () => sendMenu("new-browser") },
                 { type: "separator" },
-                { label: "Browser", accelerator: "CmdOrCtrl+Shift+G", click: () => sendMenu("open-browser") },
-                { label: "Memory", accelerator: "CmdOrCtrl+Shift+M", click: () => sendMenu("open-memory") },
-                { label: "Settings", accelerator: "CmdOrCtrl+Shift+,", click: () => sendMenu("open-settings") },
-                { label: "Plugins", click: () => sendMenu("open-plugins") },
-                { type: "separator" },
                 { label: "Close Session", accelerator: "CmdOrCtrl+W", click: () => sendMenu("close-session") },
-                { label: "Close Window", accelerator: isMac ? "Cmd+Shift+W" : "Alt+F4", role: "close" },
                 { type: "separator" },
                 isMac ? { role: "close" } : { role: "quit", label: "Exit" },
             ],
@@ -353,8 +354,6 @@ function buildMenu() {
                 { role: "resetZoom" },
                 { role: "zoomIn" },
                 { role: "zoomOut" },
-                { type: "separator" },
-                { label: "Toggle Theme", accelerator: "CmdOrCtrl+Shift+D", click: () => sendMenu("toggle-theme") },
                 { role: "toggleDevTools" },
             ],
         },
@@ -363,28 +362,13 @@ function buildMenu() {
             submenu: [
                 { label: "Next Session", accelerator: "Ctrl+Tab", click: () => sendMenu("next-session") },
                 { label: "Previous Session", accelerator: "Ctrl+Shift+Tab", click: () => sendMenu("prev-session") },
-                { type: "separator" },
-                { label: "Export Session Log…", accelerator: "CmdOrCtrl+Shift+E", click: () => sendMenu("export-session") },
-                { type: "separator" },
                 // IPC audit #6: the "List Sessions" entry dispatched 'list-sessions',
                 // a command with NO SPA-side handler — deleted (dead menu surface).
-            ],
-        },
-        {
-            label: "Window",
-            submenu: [
-                { role: "minimize" },
-                { role: "zoom" },
-                ...(isMac ? [
-                    { type: "separator" },
-                    { role: "front" },
-                ] : []),
-            ],
-        },
-        {
-            role: "help",
-            submenu: [
-                { label: "Summrise Agent Status", click: () => { focusMain(); sendMenu("show-status"); } },
+                // The "Export Session Log…" entry (^⇧E) was deleted for the same kind of
+                // reason read the other way: the per-tab export mark IS the action
+                // (TabBar's .tab-export, one mark per session, so it exports what you
+                // point at rather than whatever happens to be active). The accelerator
+                // is still handled by the SPA's own keydown map in a plain browser.
             ],
         },
     ];
@@ -671,7 +655,9 @@ function embeddedRecover() {
         return { ok: false };
     // Already decided by loadTarget() when embeddedUrl was set (the ONE load
     // door) — recovery re-loads that decision, it does not re-open the policy.
-    const url = embeddedUrl && embeddedUrl !== "about:blank" ? embeddedUrl : "https://www.bing.com";
+    // The fallback is about:blank, NOT a third-party home page: recovering a
+    // crashed view must not make a request to a search engine to do it.
+    const url = embeddedUrl || "about:blank";
     view.webContents.loadURL(url).catch(() => { });
     // Re-show if the SPA slot is live (bounds were placed before the crash).
     if (embeddedVisible && win && embeddedBounds) {
@@ -906,12 +892,38 @@ const httpServer = http.createServer((req, res) => {
     }
 });
 if (gotTheLock) {
-    // Taskbar grouping/identity on Windows (taskbar button + jump list group
-    // under Summrise instead of Electron). Must be set before ready.
+    // TASKBAR GROUPING AND THE TASKBAR GROUP'S ICON — HALF ONE OF TWO, AND THIS IS THE HALF
+    // THAT IS A PRECONDITION RATHER THAN A HINT.
+    // Microsoft's rule for System.AppUserModel.RelaunchIconResource is a three-step lookup:
+    // the property ON THE WINDOW; else "the system attempts to find a shortcut with the same
+    // AppUserModelID, and pins that shortcut to the taskbar to represent the window"; else
+    // "the backing executable of the process that owns it is used". Which step is reachable
+    // at all depends on THIS call — the same page: the shortcut lookup happens only "If an
+    // explicit AppUserModelID is set on the window", and without one the property "is ignored
+    // and the window is grouped and pinned as if it were part of its owning process".
+    // This shell is launched UNPACKAGED (`electron.exe .` out of the staged runtime), so
+    // step three is stock electron.exe — the Electron logo. Removing this call (d4edbb64)
+    // could not fix that: it deleted the caller's half of an association whose OTHER half is
+    // the shortcut, which left step three as the only reachable step in BOTH states. The
+    // shortcut half is written in agent/summrise-agent-npm/src/summrise.ts (see DESKTOP_AUMID
+    // there) as System.AppUserModel.ID — the same string — plus RelaunchIconResource pointing
+    // at the sunrise .ico. KEEP THE TWO IN STEP; the literal below is a copy because this file
+    // is emitted to plain JS in two packages and cannot import the CLI's module.
+    // THE VALUE IS NOT THE ONE THIS FILE USED BEFORE ("…summrise.agent"), and that is the
+    // measured half of the fix rather than a rename. On desktop-14rjcr8, with that string set
+    // on the window AND read back off the shortcut, the taskbar still drew the Electron logo:
+    // releases up to 1.2.489 had already resolved that AUMID — set with no shortcut anywhere —
+    // against the backing executable and kept the answer, and `shell:AppsFolder` still lists it
+    // as an app named "Electron". The same machine drew the SUNRISE under a string it had never
+    // seen, with every other variable held. DESKTOP_AUMID carries the two-row table.
+    // (The same shortcut association is also the documented precondition for the hide-to-tray
+    // toast below: Electron requires a Start Menu shortcut carrying the ID and a
+    // ToastActivatorCLSID, and this one carries neither — unchanged by this call.)
+    const AUMID = "online.saisi.summrise.desktop";
     try {
         if (process.platform === "win32")
-            electron_1.app.setAppUserModelId("online.saisi.summrise.agent");
-        iconReport["appUserModelId"] = process.platform === "win32" ? "online.saisi.summrise.agent" : "(non-windows)";
+            electron_1.app.setAppUserModelId(AUMID);
+        iconReport["appUserModelId"] = process.platform === "win32" ? AUMID : "(non-windows)";
     }
     catch {
         iconReport["appUserModelId"] = "(set-failed)";
@@ -934,6 +946,16 @@ if (gotTheLock) {
         electron_1.Menu.setApplicationMenu(buildMenu());
         win = new electron_1.BrowserWindow({
             width: 1200, height: 800, title: "Summrise",
+            // NO WHITE FLASH (window-creation honesty, round-275). The window used to be
+            // created VISIBLE, before loadDesktop() runs its ~800 ms /api/status probe and
+            // before the first loadURL — so every launch painted a blank white frame and then
+            // whatever the agent turned out to be. show:false keeps it off screen until the
+            // first document has painted (ready-to-show, below); backgroundColor paints that
+            // first frame in the shell's own ink instead of Chromium's white, which is the one
+            // of the two documents that had NOT already fixed this (WAIT_HTML hardcodes
+            // background:#111, and the SPA's chrome is dark).
+            show: false,
+            backgroundColor: "#111",
             // Taskbar + title-bar icon: without this Windows shows the stock
             // electron.exe icon (the running binary is stock Electron). PNG —
             // see windowIcon() on why not .ico here.
@@ -955,6 +977,11 @@ if (gotTheLock) {
                 backgroundThrottling: false,
             },
         });
+        // The other half of show:false — the first paint shows the window. It fires on the
+        // first document to paint (the SPA when the agent answers, the wait page when it does
+        // not), and the handler is registered in the same tick as the constructor, before any
+        // loadURL can happen, so there is no window in which the event is missed.
+        win.once("ready-to-show", () => { win?.show(); });
         // review #6 (MED) TOP RISK: the main window carries the summriseDesktop/
         // summriseBrowser preload bridge (setAutoLaunch → schtasks /create …
         // -File <ps1>, browser-session:open). Without a navigation veto a
@@ -1048,25 +1075,15 @@ if (gotTheLock) {
         let retryMs = 2000;
         const nextRetry = () => { retryMs = Math.min(retryMs * 2, 30000); return retryMs; };
         const resetRetry = () => { retryMs = 2000; };
-        /** Window title carries the agent version for at-a-glance diagnosis:
-         *  "Summrise — v1.2.x" (the npm RELEASE version — /api/status `release`,
-         *  written by the update/setup swap paths; falls back to the Cargo
-         *  protocol `version` when the marker is absent). "Summrise" when down. */
-        const setVersionTitle = async () => {
-            try {
-                const ctrl = new AbortController();
-                const t = setTimeout(() => ctrl.abort(), 3000);
-                const r = await fetch(`${(0, url_policy_1.agentBase)()}/api/status`, { signal: ctrl.signal, headers: authHeaders() });
-                clearTimeout(t);
-                if (r.ok) {
-                    const j = await r.json();
-                    const v = j.release || j.version;
-                    if (v)
-                        win?.setTitle(`Summrise — v${v}`);
-                }
-            }
-            catch { /* agent down — keep default title */ }
-        };
+        // NO setVersionTitle() HERE, DELETED. It fetched /api/status with the device token and
+        // called win.setTitle("Summrise — v1.2.x"), and that title NEVER REACHED THE SCREEN: the
+        // SPA owns document.title (`useAttentionTitle` assigns it on every attention change,
+        // panel-react/src/hooks/useAttention.ts:96 — plain "Summrise Agent" in the desktop window)
+        // and no page-title-updated handler on THIS window stops it, so the renderer's title
+        // replaced the native one on the first render. The version it wanted to show is already on
+        // screen, in the panel's own status bar (DesktopShell's .desktop-status) and in the tray
+        // tooltip, both of which read the same /api/status. A native title that only the process
+        // could read was also the LAST credentialed fetch on this path — the tray keeps its own.
         // stage-n: SELF-HEAL watchdog. The wait-page button needed a human, but
         // when the AGENT is down the cloudflared tunnel (agent-supervised) dies
         // too — a remote operator then has NO channel left to click anything
@@ -1085,7 +1102,6 @@ if (gotTheLock) {
             if (await agentReady()) {
                 agentMissCount = 0;
                 resetRetry();
-                setVersionTitle();
                 win?.loadURL(`${(0, url_policy_1.agentBase)()}/desktop/`).catch(() => { });
             }
             else {
@@ -1125,11 +1141,13 @@ if (gotTheLock) {
         // without it, playwright grabbed the MAIN window (now tripwired) or the
         // user had to open the Browser page first. The view is hidden until the
         // SPA's Browser page reports bounds (embeddedViewPlace shows it).
+        // NO EAGER NAVIGATION: this used to loadURL("https://www.bing.com"), i.e. a
+        // request to a third party on EVERY launch before anyone asked for a page.
+        // The view is still created — about:blank is a first-class CDP target (the
+        // reason it exists here is that a target be available, not that a page be
+        // loaded), and the user/AI navigates it next (loadTarget is the one door).
         try {
-            const v = embeddedViewEnsure();
-            if (v && !v.webContents.isDestroyed()) {
-                v.webContents.loadURL("https://www.bing.com").catch(() => { });
-            }
+            embeddedViewEnsure();
         }
         catch { /* non-fatal */ }
         console.log(`[summrise] CDP endpoint: http://127.0.0.1:${CDP_PORT} (playwright connectOverCDP)`);
@@ -1195,6 +1213,9 @@ if (gotTheLock) {
         // status strip shows the same pair).
         let trayAgentCpu = null;
         let trayAgentMem = null;
+        /** WHEN /api/status last ANSWERED (null = it never has since launch) — the tray's
+         *  tooltip reports this instead of asserting a state it cannot date. */
+        let trayLastAnsweredAt = null;
         /** "3m 24s" / "1h 5m" / "2d 3h" — compact uptime for the tray. */
         const fmtUptime = (secs) => {
             if (secs < 60)
@@ -1205,10 +1226,16 @@ if (gotTheLock) {
                 return `${Math.floor(secs / 3600)}h ${Math.floor((secs % 3600) / 60)}m`;
             return `${Math.floor(secs / 86400)}d ${Math.floor((secs % 86400) / 3600)}h`;
         };
+        /** "14:02:31" local — the WHEN of an observation, for the one surface that cannot
+         *  re-derive it (a tray tooltip is a string set once per poll, not a render). */
+        const fmtClock = (at) => new Date(at).toTimeString().slice(0, 8);
         const refreshTray = async () => {
             // HTTP liveness, not the TCP probe (see agentReady above): a wedged-
             // but-listening agent must show as STOPPED, not "running".
             const running = await agentResponds(1000);
+            const observedAt = Date.now();
+            if (running)
+                trayLastAnsweredAt = observedAt;
             let version = trayAgentVersion;
             let uptime = trayAgentUptime;
             let sessions = trayAgentSessions;
@@ -1248,9 +1275,19 @@ if (gotTheLock) {
             const vitals = running && mem !== null
                 ? `, CPU ${cpu === null ? "?" : Math.round(cpu)}% · MEM ${Math.round(mem)}%`
                 : "";
+            // THE TOOLTIP NAMES THE OBSERVATION, NOT A VERDICT (round-275). It used to print
+            // "Agent stopped" as present tense from ONE un-timestamped probe, recomputed every
+            // 30 s — half a minute stale while reading as now, the shape the panel's liveness
+            // strings were already fixed for (`checked 12s ago`, `reachability NOT VERIFIED`).
+            // The WHEN is a CLOCK rather than "answered 12s ago", deliberately: a tooltip is a
+            // string written once per poll and Electron gives it no way to recompute, so a
+            // relative age would freeze at the value it had when written and read as "now" for
+            // the next 30 s — the very failure this line removes. A timestamp does not decay.
             const health = running
-                ? `Agent running (v${version || "?"}${uptime ? `, up ${uptime}` : ""}${sessions ? `, ${sessions} session${sessions === 1 ? "" : "s"}` : ""}${vitals})`
-                : "Agent stopped";
+                ? `answered ${fmtClock(observedAt)} · v${version || "?"}${uptime ? `, up ${uptime}` : ""}${sessions ? `, ${sessions} session${sessions === 1 ? "" : "s"}` : ""}${vitals}`
+                : trayLastAnsweredAt === null
+                    ? "reachability NOT VERIFIED · no reply since launch"
+                    : `not answering · last reply ${fmtClock(trayLastAnsweredAt)}`;
             // stage-n: the agent died WHILE the window was showing the SPA (the
             // wait page only renders when the boot probe fails). Swap the window
             // to the wait page — its "Start Agent" button is now actually visible
@@ -1266,16 +1303,15 @@ if (gotTheLock) {
             if (running && agentWatchActive)
                 agentWatchActive = false;
             tray.setToolTip(`Summrise — ${health}`);
+            // THE FOUR "New …" ROWS ARE GONE (round-275): they duplicated the desktop
+            // header's `+ New` menu item for item (pty/ssh/serial/browser), one click
+            // cheaper than the tray path, which had to restore and focus the window
+            // first anyway. "Open" is the tray's job; creating sessions is the app's.
             tray.setContextMenu(electron_1.Menu.buildFromTemplate([
                 { label: "Open", click: () => { focusMain(); } },
                 { type: "separator" },
                 { label: health, enabled: false },
                 { type: "separator" },
-                { label: "New Terminal", click: () => { focusMain(); sendMenu("new-pty"); } },
-                { label: "New SSH…", click: () => { focusMain(); sendMenu("new-ssh"); } },
-                { label: "New Serial…", click: () => { focusMain(); sendMenu("new-serial"); } },
-                { label: "New Browser…", click: () => { focusMain(); sendMenu("new-browser"); } },
-                { type: "separator" },
                 { label: "Quit", click: () => { electron_1.app.isQuitting = true; electron_1.app.quit(); } },
             ]));
         };