summrise-agent 1.2.494 → 1.2.505

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "summrise-agent",
-  "version": "1.2.494",
-  "description": "Summrise Agent — Windows device MCP server (terminal/SSH/serial) + panel. Self-hosted npm distribution.",
-  "//build": "唯一构建路径：在本目录执行 npm run build。它是自包含的：经 npm exec 按需拉取 typescript@5，无需预装任何 node_modules（干净检出可跑；旧脚本引用 ../summrise-desktop-electron/node_modules/.bin/tsc，干净检出必 ENOENT）。必须用 npm exec --package … -- tsc 的形式：npx 会吃掉传给 tsc 的 -p/--outDir 等参数（round-435：npx 写法从未真正跑通过）。先编 electron TS（--noCheck 纯 emit，与 release.yml 一致）同步两处 src/*.js，再编 src/summrise.ts 到 bin/summrise.js 并校验 round-298 标记（弱 oracle，只证某次构建发生，新鲜性由 publish-release.sh 的 tsc 重编 + cmp 门保证）。",
+  "version": "1.2.505",
+  "description": "Summrise Agent \u2014 Windows device MCP server (terminal/SSH/serial) + panel. Self-hosted npm distribution.",
+  "//build": "\u552f\u4e00\u6784\u5efa\u8def\u5f84\uff1a\u5728\u672c\u76ee\u5f55\u6267\u884c npm run build\u3002\u5b83\u662f\u81ea\u5305\u542b\u7684\uff1a\u7ecf npm exec \u6309\u9700\u62c9\u53d6 typescript@5\uff0c\u65e0\u9700\u9884\u88c5\u4efb\u4f55 node_modules\uff08\u5e72\u51c0\u68c0\u51fa\u53ef\u8dd1\uff1b\u65e7\u811a\u672c\u5f15\u7528 ../summrise-desktop-electron/node_modules/.bin/tsc\uff0c\u5e72\u51c0\u68c0\u51fa\u5fc5 ENOENT\uff09\u3002\u5fc5\u987b\u7528 npm exec --package \u2026 -- tsc \u7684\u5f62\u5f0f\uff1anpx \u4f1a\u5403\u6389\u4f20\u7ed9 tsc \u7684 -p/--outDir \u7b49\u53c2\u6570\uff08round-435\uff1anpx \u5199\u6cd5\u4ece\u672a\u771f\u6b63\u8dd1\u901a\u8fc7\uff09\u3002\u5148\u7f16 electron TS\uff08--noCheck \u7eaf emit\uff0c\u4e0e release.yml \u4e00\u81f4\uff09\u540c\u6b65\u4e24\u5904 src/*.js\uff0c\u518d\u7f16 src/summrise.ts \u5230 bin/summrise.js \u5e76\u6821\u9a8c round-298 \u6807\u8bb0\uff08\u5f31 oracle\uff0c\u53ea\u8bc1\u67d0\u6b21\u6784\u5efa\u53d1\u751f\uff0c\u65b0\u9c9c\u6027\u7531 publish-release.sh \u7684 tsc \u91cd\u7f16 + cmp \u95e8\u4fdd\u8bc1\uff09\u3002",
   "bin": {
     "summrise": "bin/summrise.js"
   },

package/summrise-desktop-electron/src/main.js

@@ -692,6 +692,148 @@ ipcHandle("embedded-browser:place", (bounds) => {
     return { ok: true };
 });
 ipcHandle("embedded-browser:state", () => embeddedState());
+// ── THE DSH VIEW: the harness's own UI, embedded in summrise ────────────────────────────────
+//
+// WHY LOOPBACK AND NOT THE PUBLIC HOSTNAME. The DSH runs on THIS machine (127.0.0.1:18081), and
+// this view is a window ON this machine — so loopback is the correct address, not the remote
+// one. Going out to the tunnel hostname instead would mean: a Cloudflare round trip for every
+// asset, an Access login inside the shell, and a certificate story — for a service that is
+// already here. (The spec's warning about loopback applies to the OTHER direction: a page viewed
+// REMOTELY resolves 127.0.0.1 to the viewer's machine, which is why the panel's /dsh/ proxy was
+// proposed. A native view on the device has no such problem.)
+//
+// A SECOND view, not a re-use of the browser one: the browser view is a single-tab internet
+// browser an AI drives over CDP, and navigating it to the DSH would throw that session away.
+let dshView = null;
+let dshVisible = false;
+let dshBounds = null;
+/** The DSH's port. Env first (a deployment may move it), else the component's default. */
+function resolveDshPort() {
+    const fromEnv = Number(process.env.SUMMRISE_DSH_PORT);
+    return Number.isInteger(fromEnv) && fromEnv > 0 && fromEnv < 65536 ? fromEnv : 18081;
+}
+/** The ONE load door for this view: its own origin, or nothing. */
+function dshTarget(raw) {
+    return (0, url_policy_1.isDshUrl)(raw) ? new URL(raw).toString() : "about:blank";
+}
+function dshViewEnsure() {
+    if (dshView && !dshView.webContents.isDestroyed())
+        return dshView;
+    const view = new electron_1.WebContentsView({
+        webPreferences: {
+            contextIsolation: true,
+            nodeIntegration: false,
+            sandbox: true,
+            // No preload: the DSH SPA needs no Node surface, and a view that cannot reach one cannot
+            // be talked into using one.
+        },
+    });
+    view.setVisible(false);
+    dshVisible = false;
+    // The DSH opens links (docs, the operator's own pages) with target=_blank. Deny the POPUP but
+    // keep the click meaningful where the door allows it — and the door allows one origin, so in
+    // practice an external link is simply dropped rather than silently navigating this view away
+    // from the harness.
+    view.webContents.setWindowOpenHandler(({ url }) => {
+        const target = dshTarget(url);
+        if (target !== "about:blank")
+            dshNavigate(target);
+        return { action: "deny" };
+    });
+    view.webContents.on("render-process-gone", (_e, details) => {
+        try {
+            view.setVisible(false);
+        }
+        catch { /* already gone */ }
+        dshVisible = false;
+        // The SAME signal the browser view sends, for the same reason (round-256 there): without it
+        // the pane shows "starting…" forever over a view that will never paint, and the operator has
+        // no way to tell a slow load from a dead renderer.
+        if (win && !win.isDestroyed()) {
+            win.webContents.send("embedded-dsh:gone", { reason: details.reason, exitCode: details.exitCode });
+        }
+    });
+    dshView = view;
+    if (win)
+        win.contentView.addChildView(view);
+    return view;
+}
+function dshNavigate(url) {
+    const target = dshTarget(url);
+    const view = dshViewEnsure();
+    view.webContents.loadURL(target).catch(() => { });
+    return { ok: true, url: target };
+}
+/** Open (or re-focus) the DSH at its configured address. Idempotent. */
+function dshOpen() {
+    return dshNavigate((0, url_policy_1.dshBase)() + "/");
+}
+/** Place the view over the SPA's slot. Empty bounds hide it (the same contract as the browser). */
+function dshPlace(bounds) {
+    const view = dshViewEnsure();
+    if (!win)
+        return;
+    if (!bounds || bounds.width < 50 || bounds.height < 50) {
+        view.setVisible(false);
+        dshVisible = false;
+        return;
+    }
+    dshBounds = bounds;
+    view.setBounds(bounds);
+    view.setVisible(true);
+    dshVisible = true;
+    win.contentView.addChildView(view);
+}
+function dshReload() {
+    const view = dshView;
+    if (!view || view.webContents.isDestroyed())
+        return { ok: false };
+    try {
+        view.webContents.reload();
+        return { ok: true };
+    }
+    catch {
+        return { ok: false };
+    }
+}
+/** Recover after a renderer crash: a dead webContents never recovers, so re-create the view. */
+function dshRecover() {
+    try {
+        if (dshView && !dshView.webContents.isDestroyed())
+            dshView.webContents.close({ waitForBeforeUnload: false });
+        if (dshView) {
+            try {
+                win?.contentView.removeChildView(dshView);
+            }
+            catch { /* already gone */ }
+            dshView = null;
+        }
+    }
+    catch { /* fall through to ensure() */ }
+    const view = dshViewEnsure();
+    if (!view || view.webContents.isDestroyed())
+        return { ok: false };
+    view.webContents.loadURL((0, url_policy_1.dshBase)() + "/").catch(() => { });
+    if (dshVisible && win && dshBounds) {
+        view.setBounds(dshBounds);
+        view.setVisible(true);
+        win.contentView.addChildView(view);
+    }
+    return { ok: true };
+}
+function dshState() {
+    const view = dshView;
+    const wc = view && !view.webContents.isDestroyed() ? view.webContents : null;
+    return { ok: true, url: wc ? wc.getURL() : "", title: wc ? wc.getTitle() : "", visible: dshVisible && !!wc };
+}
+ipcHandle("embedded-dsh:open", () => dshOpen());
+ipcHandle("embedded-dsh:place", (bounds) => {
+    dshPlace(bounds);
+    return { ok: true };
+});
+ipcHandle("embedded-dsh:state", () => dshState());
+ipcHandle("embedded-dsh:reload", () => dshReload());
+ipcHandle("embedded-dsh:recover", () => dshRecover());
 // Desktop-app settings (auto-launch) — the Settings page toggles this. We
 // manage a per-user scheduled task ("SummriseDesktop", onlogon) instead of
 // Electron's setLoginItemSettings: in dev mode (electron .) the login-item
@@ -932,6 +1074,9 @@ if (gotTheLock) {
         // Custom-port installs: pin every origin predicate + probe/load URL to
         // the agent's actual bind port BEFORE any window or probe exists.
         (0, url_policy_1.setAgentPort)(resolveAgentPort());
+        // The DSH view's door, pinned the same way and for the same reason: a predicate that ran
+        // before this line would check a port nothing is listening on.
+        (0, url_policy_1.setDshPort)(resolveDshPort());
         // review #7: with no handler Electron AUTO-GRANTS every permission
         // request (media/geolocation/clipboard) — deny by default for all
         // windows, esp. the remote-browser ones loading arbitrary pages.

package/summrise-desktop-electron/src/preload.js

@@ -56,6 +56,32 @@ electron_1.contextBridge.exposeInMainWorld("summriseEmbedded", {
         return () => electron_1.ipcRenderer.removeListener("embedded-browser:gone", listener);
     },
 });
+// THE DSH VIEW (the shell's second embedded view). The harness's own UI runs on THIS
+// machine's loopback, so the panel never learns its port: `open()` asks the MAIN process to
+// navigate the view to its configured base, and the door that decides what that view may load
+// (url-policy.isDshUrl) has exactly one origin to check. Same placeholder-bounds handshake as
+// the browser view above, because it is the same problem: a native view overlays an empty slot
+// the SPA positions.
+electron_1.contextBridge.exposeInMainWorld("summriseDsh", {
+    open: () => electron_1.ipcRenderer.invoke("embedded-dsh:open"),
+    place: (bounds) => electron_1.ipcRenderer.invoke("embedded-dsh:place", bounds),
+    state: () => electron_1.ipcRenderer.invoke("embedded-dsh:state"),
+    reload: () => electron_1.ipcRenderer.invoke("embedded-dsh:reload"),
+    // Recovery after a renderer crash: the main process force-re-creates the view.
+    recover: () => electron_1.ipcRenderer.invoke("embedded-dsh:recover"),
+    // The view's renderer crashed (reason + exitCode) — without this the pane would show
+    // "starting…" forever over a view that will never paint. Returns an unsubscribe fn.
+    onGone: (handler) => {
+        const listener = (_e, d) => {
+            try {
+                handler(d);
+            }
+            catch { /* SPA-side */ }
+        };
+        electron_1.ipcRenderer.on("embedded-dsh:gone", listener);
+        return () => electron_1.ipcRenderer.removeListener("embedded-dsh:gone", listener);
+    },
+});
 // Desktop-app settings + menu bridge (Electron-specific — hidden when running
 // in a plain browser; the SPA detects the bridge and shows the card only when
 // present).

package/summrise-desktop-electron/src/url-policy.js

@@ -21,6 +21,10 @@ exports.isDesktopSpaUrl = isDesktopSpaUrl;
 exports.isPrivateHost = isPrivateHost;
 exports.certBypassAllowed = certBypassAllowed;
 exports.sanitizeBrowserUrl = sanitizeBrowserUrl;
+exports.setDshPort = setDshPort;
+exports.getDshPort = getDshPort;
+exports.dshBase = dshBase;
+exports.isDshUrl = isDshUrl;
 exports.BASE = "http://127.0.0.1:18080";
 exports.BASE_ORIGIN = new URL(exports.BASE).origin;
 // Configurable agent port (custom-port installs): the shell follows the
@@ -203,3 +207,32 @@ function sanitizeBrowserUrl(url) {
     catch { /* fall through */ }
     return "about:blank";
 }
+// THE DSH VIEW'S DOOR. The shell's SECOND embedded view shows the harness's own UI, which
+// runs on THIS machine's loopback — so this door is one origin and nothing else, and it is a
+// SEPARATE predicate from sanitizeBrowserUrl on purpose: the browser view's door is the open
+// internet (an AI drives it), this one is a single port, and a door that is wide for one view
+// must not quietly become wide for the other. The DSH view has no address bar and nothing
+// drives it but the operator, so there is nothing here to widen it for.
+//
+// The port is the DSH's own (default 18081 — main.ts resolves SUMMRISE_DSH_PORT first), and
+// it is deliberately NOT the agent's port: the agent's origin is where the panel lives, and a
+// view that could load the panel could also load /api/* with the panel's own authority.
+let dshPort = null;
+function setDshPort(port) {
+    if (Number.isInteger(port) && port > 0 && port < 65536)
+        dshPort = port;
+}
+function getDshPort() {
+    return dshPort ?? 18081;
+}
+function dshBase() {
+    return `http://127.0.0.1:${getDshPort()}`;
+}
+function isDshUrl(url) {
+    try {
+        return new URL(url).origin === new URL(dshBase()).origin;
+    }
+    catch {
+        return false;
+    }
+}