summrise-agent 1.2.491 → 1.2.493

package/bin/summrise.js

@@ -39,6 +39,7 @@ exports.psArgv = psArgv;
 exports.lnkIdentity = lnkIdentity;
 exports.deskShortcutRepairPs = deskShortcutRepairPs;
 exports.startDesktopPs = startDesktopPs;
+exports.ensureDesktopPs = ensureDesktopPs;
 exports.desktopTaskPs = desktopTaskPs;
 exports.desktopStartPs = desktopStartPs;
 exports.parseAgentPort = parseAgentPort;
@@ -310,8 +311,42 @@ exports.psq = psq;
  *  silently reverts to the backing executable (stock `electron.exe`, since the shell runs
  *  unpackaged) with nothing on the device to read that says why.
  *  PowerShell/Windows AppUserModelIDs cannot contain spaces, and this one does not.
+ *
+ *  WHY IT IS NOT `online.saisi.summrise.agent`, WHICH IS WHAT IT WAS CALLED BEFORE —
+ *  MEASURED on desktop-14rjcr8 (release 1.2.490), ONE VARIABLE AT A TIME:
+ *
+ *    | window's AppUserModelID          | shortcut carries it  | taskbar draws   |
+ *    | window's AppUserModelID       | shortcuts carrying it          | taskbar draws |
+ *    | online.saisi.summrise.agent   | both desktops + Start Menu     | Electron logo |
+ *    | online.saisi.summrise.desktop | both desktops + Start Menu     | THE SUNRISE   |
+ *    | online.saisi.summrise.desktop | both desktops, Start Menu GONE | Electron logo |
+ *
+ *  That third row is the one that decides where the identity has to live, and it was taken
+ *  WITHOUT restarting anything: the same running shell, the same AppUserModelID already set,
+ *  and the icon fell back to the Electron logo the moment the Start Menu shortcut was
+ *  deleted. So the shortcut this lookup resolves is the **Start Menu** one — a desktop
+ *  shortcut is not enough, and writing the identity onto `Summrise.lnk` in
+ *  `%PUBLIC%\Desktop` alone changes nothing. Microsoft's appids.md does say to apply the ID
+ *  to "all of the shortcuts" when an application has several launch locations, and it lists
+ *  the Start menu FIRST; the measurement is what says which of them the taskbar actually
+ *  reads.
+ *
+ *  The other variables were held: the same `IPropertyStore` call read back on every
+ *  shortcut, the same `icon.ico` (downloaded and RENDERED — it is the orange sunrise), the
+ *  same shell restarted under the `SummriseDesktop` task, and in each restarted run the
+ *  running process appended `AUMID-SET-OK` to a log from inside `setAppUserModelId`, so "the
+ *  ID was set" is measured rather than assumed.
+ *
+ *  WHY THE OLD ID WAS DEAD. Releases up to 1.2.489 set `online.saisi.summrise.agent` on the
+ *  process while no shortcut anywhere carried it, so the shell resolved that ID against the
+ *  backing executable — stock `electron.exe` — and kept the result. `shell:AppsFolder` still
+ *  lists it as `name=[Electron] path=[online.saisi.summrise.agent]`, an app entry named after
+ *  `electron.exe`. An ID already resolved to the wrong image is not repaired by writing the
+ *  shortcut afterwards; the association has to be under a name the machine has never seen.
+ *  Keep this string STABLE from here: changing it again costs the pin and the jump list, so
+ *  this is a one-time migration, not a knob.
  */
-exports.DESKTOP_AUMID = "online.saisi.summrise.agent";
+exports.DESKTOP_AUMID = "online.saisi.summrise.desktop";
 /** The two `IPropertyStore` values `Summrise.lnk` must carry, as DATA.
  *
  *  Deliberately separated from the PowerShell that performs the write, and exported, so the
@@ -442,45 +477,240 @@ public static class SummriseLnk {
 // exported: unit-tested in test/cli.test.mjs.
 function deskShortcutRepairPs(scriptsQ, deskDirQ, sink) {
     const { id, icon } = lnkIdentity(`${deskDirQ}\\icon.ico`);
+    // BOTH shortcuts get the identity, and the START MENU one is the load-bearing half:
+    // deleting it from a running shell reverted the taskbar to the Electron logo with the ID
+    // still set on the process and both desktop shortcuts still carrying it (see DESKTOP_AUMID).
+    // The desktop link is kept because it is what a person double-clicks and because
+    // appids.md says to apply the ID to "all of the shortcuts" a user can launch from.
+    const lnk = (p, tag) => [
+        `  try { $dWs${tag} = New-Object -ComObject WScript.Shell; $dSc${tag} = $dWs${tag}.CreateShortcut(${p}); $dSc${tag}.TargetPath = Join-Path $env:SystemRoot 'System32\\WindowsPowerShell\\v1.0\\powershell.exe'; $dSc${tag}.Arguments = '-NoProfile -ExecutionPolicy Bypass -File "' + $dPs1 + '"'; $dSc${tag}.WorkingDirectory = '${deskDirQ}'; $dSc${tag}.IconLocation = $dIco + ',0'; $dSc${tag}.Save(); 'desk: ' + ${p} + ' repointed to electron shell' | ${sink} } catch { ('desk: ' + ${p} + ' repair failed: ' + $_.Exception.Message) | ${sink} }`,
+        `  if ($dSet) { try { [SummriseLnk]::Write(${p}, $dId, $dRes); ('desk: ' + ${p} + ' taskbar identity [' + [SummriseLnk]::Read(${p}) + ']') | ${sink} } catch { ('desk: ' + ${p} + ' identity write failed: ' + $_.Exception.Message) | ${sink} } }`,
+    ];
     return [
         `$dLnk = Join-Path $env:PUBLIC 'Desktop\\Summrise.lnk'`,
+        // ALL-USERS Start Menu: the shortcut the shell's app resolver actually reads, and it is
+        // CREATED here when absent — a machine that never had one is exactly the machine whose
+        // taskbar shows the Electron logo, and no amount of desktop-side repair reaches it.
+        // `setup` already requires elevation (HKLM writes, Program Files), so ProgramData is
+        // writable on every path that calls this.
+        `$dSm = Join-Path $env:ProgramData 'Microsoft\\Windows\\Start Menu\\Programs\\Summrise.lnk'`,
         `$dIco = '${deskDirQ}\\icon.ico'`,
         `$dPs1 = '${scriptsQ}\\start-desktop.ps1'`,
         `$dId = '${id}'`,
         `$dRes = '${icon}'`,
         `$dSet = $false`,
-        `$dNeed = $false`,
-        `if (Test-Path $dLnk) {`,
-        // Compiled only when there IS a link to write, so a headless install does not pay for
-        // it. The `-as [type]` guard keeps a second call in one process from turning a
-        // "type already exists" throw into a silent skip of the write below.
+        `$dShell = (Test-Path $dIco) -and (Test-Path $dPs1)`,
+        // Compiled when there is a SHELL to point at, not when a desktop link happens to exist:
+        // the Start Menu shortcut is created from nothing, so gating this on `$dLnk` would skip
+        // the identity on precisely the installs that need it. The `-as [type]` guard keeps a
+        // second call in one process from turning a "type already exists" throw into a silent
+        // skip of every write below.
+        `if ($dShell) {`,
         `  $dCs = @'\n${LNK_PROPS_CS}\n'@`,
         `  try { if (-not ('SummriseLnk' -as [type])) { Add-Type -TypeDefinition $dCs }; $dSet = [bool]('SummriseLnk' -as [type]) } catch { ('desk: lnk identity helper unavailable: ' + $_.Exception.Message) | ${sink} }`,
+        `}`,
+        `$dNeed = $false`,
+        `if (Test-Path $dLnk) {`,
         `  try { $dEx = (New-Object -ComObject WScript.Shell).CreateShortcut($dLnk); if (($dEx.TargetPath -like '*summrise-desktop.exe') -or ($dEx.TargetPath -like '*summrise-tray.exe') -or (-not (Test-Path $dEx.TargetPath))) { $dNeed = $true } } catch { $dNeed = $true }`,
         // ...and a link that is otherwise healthy still needs repairing when its identity is
         // missing or names a different ID/icon. `Read` returns "id|icon", so ONE comparison
         // covers both properties — and it is the same call the verification below prints.
         `  if ($dSet) { try { if (([SummriseLnk]::Read($dLnk)) -ne ($dId + '|' + $dRes)) { $dNeed = $true } } catch { $dNeed = $true } }`,
         `}`,
-        `if ($dNeed -and (Test-Path $dIco) -and (Test-Path $dPs1)) {`,
-        `  try { $dWs = New-Object -ComObject WScript.Shell; $dSc = $dWs.CreateShortcut($dLnk); $dSc.TargetPath = Join-Path $env:SystemRoot 'System32\\WindowsPowerShell\\v1.0\\powershell.exe'; $dSc.Arguments = '-NoProfile -ExecutionPolicy Bypass -File "' + $dPs1 + '"'; $dSc.WorkingDirectory = '${deskDirQ}'; $dSc.IconLocation = $dIco + ',0'; $dSc.Save(); 'desk: Summrise.lnk repointed to electron shell' | ${sink} } catch { ('desk: Summrise.lnk repair failed: ' + $_.Exception.Message) | ${sink} }`,
-        // The verification is the READ-BACK, not the absence of an exception: SetValue+Commit
-        // returning cleanly is a claim about a call, and this records what the file now carries.
-        `  if ($dSet) { try { [SummriseLnk]::Write($dLnk, $dId, $dRes); ('desk: Summrise.lnk taskbar identity [' + [SummriseLnk]::Read($dLnk) + ']') | ${sink} } catch { ('desk: Summrise.lnk identity write failed: ' + $_.Exception.Message) | ${sink} } }`,
+        // The Start Menu link is created when ABSENT and rewritten when its identity is wrong —
+        // it is never deleted, and a link that already matches is left alone so a second `setup`
+        // does not churn the file.
+        `$dSmNeed = $false`,
+        `if ($dShell) {`,
+        `  if (-not (Test-Path $dSm)) { $dSmNeed = $true }`,
+        `  elseif (-not $dSet) { $dSmNeed = $true }`,
+        `  else { try { if (([SummriseLnk]::Read($dSm)) -ne ($dId + '|' + $dRes)) { $dSmNeed = $true } } catch { $dSmNeed = $true } }`,
+        `}`,
+        `if ($dNeed -and $dShell) {`,
+        ...lnk("$dLnk", "1"),
+        `}`,
+        `if ($dSmNeed -and $dShell) {`,
+        ...lnk("$dSm", "2"),
         `}`,
         `foreach ($dRx in @('summrise-desktop.exe','summrise-tray.exe')) { $dRp = '${deskDirQ}\\' + $dRx; if (Test-Path $dRp) { try { Remove-Item -Force -ErrorAction Stop $dRp; ('desk: removed retired ' + $dRx) | ${sink} } catch { ('desk: retired ' + $dRx + ' locked, kept') | ${sink} } } }`,
     ];
 }
-// exported: the start-desktop.ps1 launcher (the SummriseDesktop onlogon task +
-// desktop Summrise.lnk both call it). Launches the Electron shell from
-// components\summrise-desktop-electron\ with the working directory set there
-// (electron . resolves src/main.js via package.json main). The script is
-// intentionally tiny + ASCII-only (system-locale PS). unit-tested.
-function startDesktopPs(deskDirQ) {
+// ── THE DESKTOP SHELL'S RECORD: WHAT THE LAUNCHERS CAN SEE, AND WHAT THEY CANNOT ──
+//
+// MEASURED on desktop-14rjcr8 (2026-09-28). The desktop shell was KILLED every ten minutes
+// by `<ExecutionTimeLimit>PT10M</ExecutionTimeLimit>` on the SummriseDesktop task: the
+// launcher ends on `& electron.exe .` — the PowerShell CALL OPERATOR, which WAITS — so the
+// shell lives inside the task's process tree and the scheduler killed the whole tree when
+// the limit expired. The guarded 5-minute pulse then revived it, correctly, and ten minutes
+// later it died again. `logs\startup.log` held 4,015 lines and answered ZERO for `desktop`,
+// ZERO for `electron` and ZERO for `ExecutionTimeLimit`. Nothing in the product recorded
+// it; the operator said "还一直在重启呢" four times, and the answer had to be recovered from
+// the Task Scheduler's own operational log, where Summrise is one line among a stream of
+// Edge update tasks.
+//
+// THE SHAPE ALREADY EXISTED ONE PROCESS OVER. The agent has exactly the right sentence
+// about itself in its own run journal — `runstate.rs`: "previous run DID NOT EXIT CLEANLY —
+// REPLACED by a restart" — and the shell, which is the process that IS killed from outside,
+// had no counterpart. These are that counterpart.
+//
+// WHERE THE LINES GO, AND WHY THERE. `logs\startup.log`, under the SAME registry-first DataDir
+// the agent's own `paths.rs` resolves (`DATA_DIR` above — never a hardcoded ProgramData, and
+// the value is baked in at generation time by the process that DID the lookup). `startup.log`
+// is the file the operator actually grepped. A record in a second file nobody knows to open
+// would be tonight's failure one level down.
+//
+// EVERY LINE CONTAINS THE WHOLE WORD `desktop` — the search that failed was
+// `findstr /i desktop ...\logs\startup.log` — and names `electron` wherever it is the subject.
+//
+// AND THE ONE CASE THAT CANNOT BE RECORDED IS WRITTEN DOWN WHERE IT HAPPENS, in
+// `startDesktopPs` below: a Task Scheduler kill takes the logging process with it, so it
+// leaves NO exit code, ever. The next pulse reports that ABSENCE out loud.
+/** The desktop shell's launcher — and the only place in the product that can see it EXIT.
+ *
+ *  `exit code N` is what tells a crash from a kill, and GETTING IT COST A MEASUREMENT. The
+ *  obvious form was `& "$dir\node_modules\electron\dist\electron.exe" .` then `$LASTEXITCODE`,
+ *  and it does not work: **electron.exe is a GUI-subsystem binary and Windows PowerShell 5.1
+ *  does not set `$LASTEXITCODE` for one.** Measured on desktop-14rjcr8, 2026-09-28:
+ *
+ *      & cmd /c 'exit 7'             -> $LASTEXITCODE = 7
+ *      & electron.exe --version      -> returned in 0.05s, $LASTEXITCODE STILL 7 (unchanged)
+ *      [Diagnostics.Process] variant -> waited, .ExitCode = 0
+ *
+ *  The first version of this file used `&`, and the line it wrote on a real restart read
+ *  `desktop: electron.exe exited (start=1790589628 exit code  lived=1s)` — an empty field
+ *  where a number belongs. That is the same defect this whole record exists to remove (a
+ *  surface reporting a step in the grammar of an outcome), so the launch goes through
+ *  `System.Diagnostics.Process` with `UseShellExecute = $false`: the SAME CreateProcess the
+ *  call operator uses, same inherited handles, same working directory — plus `WaitForExit()`
+ *  and a real `.ExitCode`.
+ *
+ *  `WaitForExit()` IS LOAD-BEARING BEYOND THE EXIT CODE: it is why this PowerShell stays
+ *  alive as the shell's parent, which is why the shell lives inside the task's process tree.
+ *
+ *  WHAT IT CANNOT SEE, AND IT IS THE CASE THAT HAPPENED. The task's action is
+ *  desktop-pulse.vbs -> ensure-desktop.ps1 -> THIS FILE, and Task Scheduler's
+ *  `<ExecutionTimeLimit>` terminates that whole tree — electron, this PowerShell and the
+ *  wscript above it. So a scheduler kill records NOTHING here, and neither do `taskkill /T`
+ *  and a machine going down: the process that would write the line dies with the shell. On
+ *  2026-09-28 PT10M killed the shell every ten minutes and this file, as it stood, said
+ *  nothing at all. The signature is therefore the ABSENCE of an `exited (start=N …)` line for
+ *  a start the watchdog watched disappear, and `ensureDesktopPs` says those words on the next
+ *  pulse rather than leaving the gap to be interpreted.
+ *
+ *  Launches the Electron shell from components\summrise-desktop-electron\ with the working
+ *  directory set there (electron . resolves src/main.js via package.json main). Intentionally
+ *  small + ASCII-only (system-locale PS). unit-tested. */
+function startDesktopPs(deskDirQ, logsQ) {
     return [
+        "# written by `summrise setup` / `summrise desktop` / `summrise update` -- start the",
+        "# Electron shell, and leave a record of the launch and of the exit. The comments stay",
+        "# IN the file on purpose: this is what an operator reads when the window is gone.",
+        "#",
+        "# WHAT THIS CANNOT SEE. The launch below WAITS, so it returns with the shell's exit code",
+        "# when the shell exits OR crashes. It does NOT return when the whole process tree is",
+        "# killed from outside -- a Task Scheduler execution limit, a `taskkill /T`, a machine",
+        "# going down -- because this PowerShell dies first, and then NO exit code is written at",
+        "# all. ensure-desktop.ps1 reports that absence on the next pulse; a log that recorded",
+        "# only exits would silently omit the one death that actually happens here.",
+        "#",
+        "# WHY NOT `& electron.exe .` AND $LASTEXITCODE (measured on desktop-14rjcr8, 2026-09-28):",
+        "# electron.exe is a GUI-subsystem binary and Windows PowerShell 5.1 does not set",
+        "# $LASTEXITCODE for one. `& cmd /c 'exit 7'` set it to 7; the next `& electron.exe",
+        "# --version` left it at 7, unchanged. The first version of this file used `&` and wrote",
+        "# `exit code ` with the number missing -- a field that looks like a value and is not one.",
+        "# System.Diagnostics.Process is the same CreateProcess, and its ExitCode is real.",
         `$dir = '${deskDirQ}'`,
-        `Set-Location $dir`,
-        `& "$dir\\node_modules\\electron\\dist\\electron.exe" .`,
+        `$log = '${logsQ}\\startup.log'`,
+        "New-Item -ItemType Directory -Force -Path (Split-Path $log) | Out-Null",
+        "$E = [DateTimeOffset]::UtcNow.ToUnixTimeSeconds()",
+        "Add-Content -Path $log -Value ('[' + (Get-Date -Format o) + '] desktop: electron.exe launching from ' + $dir + ' (start=' + $E + ')') -ErrorAction SilentlyContinue",
+        "Set-Location $dir",
+        "$code = $null",
+        "try {",
+        "  $si = New-Object System.Diagnostics.ProcessStartInfo",
+        "  $si.FileName = \"$dir\\node_modules\\electron\\dist\\electron.exe\"",
+        "  $si.Arguments = '.'",
+        "  $si.WorkingDirectory = $dir",
+        "  $si.UseShellExecute = $false",
+        "  $p = [System.Diagnostics.Process]::Start($si)",
+        "  $p.WaitForExit()",
+        "  $code = $p.ExitCode",
+        "} catch { $code = $null }",
+        "$L = [int]([DateTimeOffset]::UtcNow.ToUnixTimeSeconds() - $E)",
+        "if ($null -ne $code) {",
+        "  Add-Content -Path $log -Value ('[' + (Get-Date -Format o) + '] desktop: electron.exe exited (start=' + $E + ' exit code ' + $code + ' lived=' + $L + 's)') -ErrorAction SilentlyContinue",
+        "} else {",
+        "  Add-Content -Path $log -Value ('[' + (Get-Date -Format o) + '] desktop: electron.exe DID NOT RUN (start=' + $E + ') -- the launcher could not start it, so there is no exit code') -ErrorAction SilentlyContinue",
+        "}",
+    ];
+}
+/** The desktop shell's WATCHDOG: start the shell when none is running, and RECORD WHICH OF
+ *  THE TWO THINGS HAPPENED — in the words a person would search for.
+ *
+ *  Run every 5 minutes by `desktop-pulse.vbs` under the SummriseDesktop task, and once at
+ *  logon. `desktop-pulse.vbs` itself takes no decision and carries no record.
+ *
+ *  WRITTEN FROM ONE BUILDER, BY ALL THREE PATHS THAT WRITE IT — `summrise setup`,
+ *  `summrise desktop` and the update swap — because a second copy of this text is a copy
+ *  that drifts, and the drift would silently revert the record on whichever path was not
+ *  edited (the shape `installer_integrity.rs` already holds the task definition against).
+ *
+ *  THE HEALTHY CASE IS LOGGED, ONCE AN HOUR, AND BOTH HALVES OF THAT ARE DELIBERATE.
+ *
+ *  A line per 5-minute pulse is 288 lines a day of "still fine" in `startup.log`, which is
+ *  the AGENT's boot record and rotates at 1 MB (`main.rs::log_line`). That heartbeat would
+ *  evict the history of a real incident — the opposite of the point — and an operator
+ *  grepping `desktop` after a restart would have to wade through it to find the restart.
+ *
+ *  Writing NOTHING in the healthy case is worse in the other direction: a watchdog that has
+ *  stopped and a watchdog that is fine would look identical, because both are SILENCE — this
+ *  repository's own recorded defect class, where "if nothing was checked, say that" is the
+ *  honest form. So: ONE line an hour (~2 KB a day), deduplicated against the LOG ITSELF
+ *  rather than a state file (the record is the state, so there is nothing to get out of
+ *  sync), and a gap longer than about two hours is the signal that the pulse itself stopped.
+ *
+ *  THE DECISION IS STATED AS THE OBSERVATION, NOT AS THE STEP: "no electron shell is
+ *  running" is what the pulse SAW; the launch it then performs is the consequence. When the
+ *  shell that disappeared left no `exited (start=N …)` line, this says so in words — that is
+ *  the scheduler-kill signature, and it is exactly the case `startDesktopPs` cannot record.
+ *
+ *  ASCII-only (system-locale PS). unit-tested. */
+function ensureDesktopPs(scriptsQ, logsQ) {
+    return [
+        "# written by `summrise setup` / `summrise desktop` / `summrise update` -- the desktop",
+        "# shell's watchdog, run every 5 minutes by desktop-pulse.vbs under SummriseDesktop.",
+        "# Start the shell if none is running, and RECORD WHICH OF THE TWO THINGS HAPPENED:",
+        "# silence is not a status. The builder in src/summrise.ts carries the full reasoning,",
+        "# including why the healthy case is one line an hour and not one per pulse.",
+        `$log = '${logsQ}\\startup.log'`,
+        "New-Item -ItemType Directory -Force -Path (Split-Path $log) | Out-Null",
+        "$now = [DateTimeOffset]::UtcNow.ToUnixTimeSeconds()",
+        "$tail = @(Get-Content -Path $log -Tail 400 -ErrorAction SilentlyContinue)",
+        "$p = @(Get-Process electron -ErrorAction SilentlyContinue)",
+        "if ($p.Count -gt 0) {",
+        "  $h = 'hour=' + (Get-Date -Format 'yyyy-MM-ddTHH')",
+        "  if (-not ($tail -match ('desktop: electron shell alive .*' + $h))) {",
+        "    $up = ($p | Sort-Object StartTime | Select-Object -First 1).StartTime",
+        "    Add-Content -Path $log -Value ('[' + (Get-Date -Format o) + '] desktop: electron shell alive -- ' + $p.Count + ' process(es), oldest since ' + $up + ' ' + $h) -ErrorAction SilentlyContinue",
+        "  }",
+        "  exit",
+        "}",
+        "$was = 'no earlier launch is recorded in the log tail'",
+        // THE PATTERN MUST MATCH THE LINE `startDesktopPs` ACTUALLY WRITES, and the first version of
+        // it did NOT: it read `launching \(start=` while the launcher writes `launching from <dir>
+        // (start=`. Every pulse therefore fell through to "no earlier launch is recorded in the log
+        // tail" and the previous shell's lifetime was never reported. MEASURED on desktop-14rjcr8 —
+        // the pulse said exactly that at 18:06:53 while the launching line it was looking for sat
+        // thirty lines above it in the same file. The ` .*` is the fix, and test/cli.test.mjs now
+        // runs THIS pattern against a REAL captured line, which is the check that would have caught it.
+        "$prev = $tail | Select-String -Pattern 'desktop: electron.exe launching .*\\(start=(\\d+)\\)' | Select-Object -Last 1",
+        "if ($prev -and ($prev.Line -match '\\(start=(\\d+)\\)')) {",
+        "  $E = [int]$Matches[1]",
+        "  if ($tail -match ('desktop: electron\\.exe exited \\(start=' + $E + ' ')) { $was = 'the previous shell exited and its code is in the exited (start=' + $E + ') line' }",
+        "  else { $was = 'the previous shell lived ' + ([int]$now - $E) + 's and left NO exit line -- it was KILLED, not exited: a Task Scheduler stop, a taskkill /T or a reboot leaves no exit code (start=' + $E + ')' }",
+        "}",
+        "Add-Content -Path $log -Value ('[' + (Get-Date -Format o) + '] desktop: no electron shell is running -- the watchdog is starting it; previous: ' + $was) -ErrorAction SilentlyContinue",
+        `& powershell -NoProfile -ExecutionPolicy Bypass -File "${scriptsQ}\\start-desktop.ps1"`,
     ];
 }
 /** The desktop shell's watchdog pair + its task, as ONE PowerShell script.
@@ -492,20 +722,52 @@ function startDesktopPs(deskDirQ) {
  *  never ran setup can still get a working task by asking for the window. Idempotent:
  *  ensure-desktop.ps1 exits when electron is already alive, so the 5-minute trigger never
  *  steals focus. unit-tested. */
-function desktopTaskPs(installQ) {
+function desktopTaskPs(installQ, logsQ) {
     return [
         "# written by `summrise setup` / `summrise desktop` -- the desktop shell's task + watchdog.",
         "$ErrorActionPreference = 'Stop'",
         `$q = '${installQ}'`,
         `$en = Join-Path $q 'scripts\\ensure-desktop.ps1'`,
         `$vb = Join-Path $q 'scripts\\desktop-pulse.vbs'`,
-        `Set-Content -Path $en -Value ('if (Get-Process electron -ErrorAction SilentlyContinue) { exit }; & powershell -NoProfile -ExecutionPolicy Bypass -File "' + $q + '\\scripts\\start-desktop.ps1"') -Force`,
+        // THE WATCHDOG'S BODY COMES FROM ITS OWN BUILDER, not from a second hand-typed copy of
+        // the same one-liner. Three paths write this file — `summrise setup`, `summrise desktop`
+        // and the update swap — and a copy that drifts is a copy that silently reverts the
+        // shell's record on whichever path was not edited. A single-quoted here-string
+        // (`@'` … `'@`, each alone on its line) carries it byte for byte: nothing in the body is
+        // expanded, and nothing in the body can end it early.
+        `$enBody = @'`,
+        ...ensureDesktopPs(`${installQ}\\scripts`, logsQ),
+        `'@`,
+        `Set-Content -Path $en -Value $enBody -Force`,
         `Set-Content -Path $vb -Value ('CreateObject("WScript.Shell").Run "powershell -NoProfile -ExecutionPolicy Bypass -File " & Chr(34) & "' + $en + '" & Chr(34), 0, False') -Force`,
         `$da = New-ScheduledTaskAction -Execute 'wscript.exe' -Argument ('"' + $vb + '"') -WorkingDirectory $q`,
         `$dt1 = New-ScheduledTaskTrigger -AtLogOn`,
         `$dw1 = New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(3) -RepetitionInterval (New-TimeSpan -Minutes 5)`,
         `$pr = New-ScheduledTaskPrincipal -UserId ('{0}\\{1}' -f $env:USERDOMAIN, $env:USERNAME) -LogonType Interactive -RunLevel Highest`,
-        `$st = New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Minutes 10) -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -MultipleInstances IgnoreNew`,
+        // NO EXECUTION TIME LIMIT -- the same value, in the same spelling, the agent's own task has
+        // carried since round 118 for the same reason: `- ExecutionTimeLimit 0   never kill the
+        // running task`. It was `-Minutes 10` here, and that WAS the defect.
+        //
+        // WHY A LIMIT KILLS A SHELL MEANT TO LIVE INDEFINITELY: this task's action is
+        // desktop-pulse.vbs -> ensure-desktop.ps1 -> start-desktop.ps1, and that last line is
+        // `& electron.exe .` -- the PowerShell CALL OPERATOR, which WAITS. The PowerShell the task
+        // launched therefore stays alive for as long as the shell does, as the shell's PARENT, and
+        // Task Scheduler enforces ExecutionTimeLimit on that process tree. Ten minutes after every
+        // start the scheduler killed the running shell; five minutes later the guarded pulse
+        // correctly brought a fresh one back; ten minutes after that it died again. The operator
+        // reported that as "反复重启", four times.
+        //
+        // NOTHING RELIED ON THE KILL, which is why removing it is the fix rather than a trade. This
+        // repository's recovery for a shell that is GONE is the guarded 5-minute pulse, and
+        // summrise-desktop-electron/src/main.ts says so from the other side, naming a logon-only task
+        // as one that "cannot recover a wedged shell". A shell that is RUNNING but wedged was never
+        // this limit's business either: the pulse's guard is a process-EXISTENCE check
+        // (`if (Get-Process electron) { exit }`), so it cannot see a wedged shell whether the limit is
+        // ten minutes or absent. `summrise update` is what heals a wedged shell, and its log says so.
+        //
+        // Measured on desktop-14rjcr8: under PT10M the four electron PIDs were replaced about every
+        // ten minutes; under PT0S the same four PIDs were still there 11 minutes later.
+        `$st = New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Seconds 0) -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -MultipleInstances IgnoreNew`,
         `Register-ScheduledTask SummriseDesktop -Action $da -Trigger @($dt1,$dw1) -Principal $pr -Settings $st -Force | Out-Null`,
         `Start-ScheduledTask -TaskName SummriseDesktop`,
     ];
@@ -2206,7 +2468,7 @@ const commands = {
         // repetition is what reborns a dead shell.
         try {
             const reg = path.join(SCRIPTS_DIR, "register-desktop-task.ps1");
-            fs.writeFileSync(reg, desktopTaskPs(DIR).join("\r\n") + "\r\n");
+            fs.writeFileSync(reg, desktopTaskPs((0, exports.psq)(DIR), (0, exports.psq)(LOGS_DIR)).join("\r\n") + "\r\n");
             // THE STATUS WAS DISCARDED AND THE SUCCESS LINE WAS UNCONDITIONAL, which is the defect the AGENT
             // task's check ten lines below names in its own comment: "audit #7: used to claim success
             // regardless". Worse, the `catch` below could not fire for this — `sh()` RETURNS, it does not
@@ -2237,7 +2499,7 @@ const commands = {
         // SummriseDesktop onlogon task + desktop Summrise.lnk both call it). Was never
         // written before — a real gap that left the shell unlaunchable.
         fs.mkdirSync(SCRIPTS_DIR, { recursive: true });
-        fs.writeFileSync(path.join(SCRIPTS_DIR, "start-desktop.ps1"), startDesktopPs((0, exports.psq)(DESK_DIR)).join("\r\n"), "utf8");
+        fs.writeFileSync(path.join(SCRIPTS_DIR, "start-desktop.ps1"), startDesktopPs((0, exports.psq)(DESK_DIR), (0, exports.psq)(LOGS_DIR)).join("\r\n"), "utf8");
         console.log("setup: scripts\\start-desktop.ps1 written");
         // Register boot-start task (SYSTEM) and kick it once; the agent's own
         // first-run flow registers the device with the console using the key.
@@ -2474,7 +2736,7 @@ const commands = {
         if (!fs.existsSync(reg)) {
             // A machine that never ran setup still gets a working task: the same script setup
             // writes, from the same builder, so the two cannot drift.
-            fs.writeFileSync(reg, desktopTaskPs(DIR).join("\r\n") + "\r\n");
+            fs.writeFileSync(reg, desktopTaskPs((0, exports.psq)(DIR), (0, exports.psq)(LOGS_DIR)).join("\r\n") + "\r\n");
         }
         // THE START SCRIPT GOES IN A FILE, AND ONLY IT DECIDES WHETHER TO REGISTER. Spawning with
         // `shell: true` means cmd.exe, and **cmd splits a command on `&`** — the PowerShell call
@@ -2924,7 +3186,7 @@ const commands = {
         // the swap script's migration, and a headless install simply never
         // calls the launcher (shortcut repair is Test-Path guarded anyway).
         fs.mkdirSync(SCRIPTS_DIR, { recursive: true });
-        fs.writeFileSync(path.join(SCRIPTS_DIR, "start-desktop.ps1"), startDesktopPs((0, exports.psq)(DESK_DIR)).join("\r\n"), "utf8");
+        fs.writeFileSync(path.join(SCRIPTS_DIR, "start-desktop.ps1"), startDesktopPs((0, exports.psq)(DESK_DIR), (0, exports.psq)(LOGS_DIR)).join("\r\n"), "utf8");
         // round-298: record the release version on a PROVABLY successful swap
         // so agent_update (which reads <install>/.summrise-release as its local
         // version) reports up_to_date instead of re-swapping every call.
@@ -3015,13 +3277,29 @@ const commands = {
             //    wscript wrapper runs it with no console flash.
             `$en1 = '${q}\\scripts\\ensure-desktop.ps1'`,
             `$vb1 = '${q}\\scripts\\desktop-pulse.vbs'`,
-            `Set-Content -Path $en1 -Value 'if (Get-Process electron -ErrorAction SilentlyContinue) { exit }; & powershell -NoProfile -ExecutionPolicy Bypass -File "${q}\\scripts\\start-desktop.ps1"' -Force`,
+            // THE SAME BUILDER `setup` USES, and this is the path that matters most: an update is
+            // the ONLY mechanism that reaches a machine already installed, so a watchdog written
+            // here from a second, hand-typed copy would silently overwrite the instrumented one on
+            // every fleet device while `setup` looked correct. `$en1` is assigned above and the
+            // here-string needs no interpolation, so the body travels verbatim.
+            `$enBody = @'`,
+            ...ensureDesktopPs(`${q}\\scripts`, qd),
+            `'@`,
+            `Set-Content -Path $en1 -Value $enBody -Force`,
             `Set-Content -Path $vb1 -Value 'CreateObject("WScript.Shell").Run "powershell -NoProfile -ExecutionPolicy Bypass -File " & Chr(34) & "${q}\\scripts\\ensure-desktop.ps1" & Chr(34), 0, False' -Force`,
             `if ($null -ne (Get-ScheduledTask -TaskName 'SummriseDesktop' -ErrorAction SilentlyContinue)) {`,
             `  $da = New-ScheduledTaskAction -Execute 'wscript.exe' -Argument ('"' + $vb1 + '"') -WorkingDirectory '${q}'`,
             `  $dt1 = New-ScheduledTaskTrigger -AtLogOn`,
             `  $dw1 = New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(3) -RepetitionInterval (New-TimeSpan -Minutes 5)`,
-            `  Set-ScheduledTask -TaskName 'SummriseDesktop' -Action $da -Trigger @($dt1, $dw1) | Out-Null`,
+            // AND THE SETTINGS, WHICH IS THE HALF THAT REACHES A MACHINE ALREADY INSTALLED.
+            // This call used to pass only -Action and -Trigger, and `Set-ScheduledTask` PRESERVES the
+            // components it is not given — so an execution limit already on the task survived every
+            // update. That is the wrong shape for a heal: `summrise update` is the only mechanism that
+            // reaches the fleet, and a device carrying the old 10-minute limit would have kept it
+            // forever while its log said "hardened". The value is the same one `setup` writes, so the
+            // two cannot diverge — and installer_integrity.rs holds both ends to it.
+            `  $dst = New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Seconds 0) -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -MultipleInstances IgnoreNew`,
+            `  Set-ScheduledTask -TaskName 'SummriseDesktop' -Action $da -Trigger @($dt1, $dw1) -Settings $dst | Out-Null`,
             `  "[$(Get-Date -Format o)] desk: SummriseDesktop hardened (guarded 5-min pulse)" | ${log}`,
             `}`,
             `if ((Test-Path $deskDir) -and (Test-Path $deskStart)) {`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "summrise-agent",
-  "version": "1.2.491",
+  "version": "1.2.493",
   "description": "Summrise Agent — Windows device MCP server (terminal/SSH/serial) + panel. Self-hosted npm distribution.",
   "//build": "唯一构建路径：在本目录执行 npm run build。它是自包含的：经 npm exec 按需拉取 typescript@5，无需预装任何 node_modules（干净检出可跑；旧脚本引用 ../summrise-desktop-electron/node_modules/.bin/tsc，干净检出必 ENOENT）。必须用 npm exec --package … -- tsc 的形式：npx 会吃掉传给 tsc 的 -p/--outDir 等参数（round-435：npx 写法从未真正跑通过）。先编 electron TS（--noCheck 纯 emit，与 release.yml 一致）同步两处 src/*.js，再编 src/summrise.ts 到 bin/summrise.js 并校验 round-298 标记（弱 oracle，只证某次构建发生，新鲜性由 publish-release.sh 的 tsc 重编 + cmp 门保证）。",
   "bin": {

package/summrise-desktop-electron/src/main.js

@@ -909,10 +909,17 @@ if (gotTheLock) {
     // there) as System.AppUserModel.ID — the same string — plus RelaunchIconResource pointing
     // at the sunrise .ico. KEEP THE TWO IN STEP; the literal below is a copy because this file
     // is emitted to plain JS in two packages and cannot import the CLI's module.
+    // THE VALUE IS NOT THE ONE THIS FILE USED BEFORE ("…summrise.agent"), and that is the
+    // measured half of the fix rather than a rename. On desktop-14rjcr8, with that string set
+    // on the window AND read back off the shortcut, the taskbar still drew the Electron logo:
+    // releases up to 1.2.489 had already resolved that AUMID — set with no shortcut anywhere —
+    // against the backing executable and kept the answer, and `shell:AppsFolder` still lists it
+    // as an app named "Electron". The same machine drew the SUNRISE under a string it had never
+    // seen, with every other variable held. DESKTOP_AUMID carries the two-row table.
     // (The same shortcut association is also the documented precondition for the hide-to-tray
     // toast below: Electron requires a Start Menu shortcut carrying the ID and a
     // ToastActivatorCLSID, and this one carries neither — unchanged by this call.)
-    const AUMID = "online.saisi.summrise.agent";
+    const AUMID = "online.saisi.summrise.desktop";
     try {
         if (process.platform === "win32")
             electron_1.app.setAppUserModelId(AUMID);