Win-Pilot 0.5.0

Win-Pilot 0.5.0

• The task desktop now uses the same pixel size and scale factor as the primary display, so a scaled host no longer renders an over- or undersized task window.
• Opening the task desktop is refused while a remote-control product is attached to the console session: by default the action continues on the current desktop, and remoteControlPolicy: refuse stops instead. The guard only works now because the native probe's child_session_streamers is mapped through getSessionState; a fixture streamer inside the child session yields owned_session_exposed, while a healthy child session still allows.
• Contributor fix: the skill provider returns thenables instead of bare objects, and control-action results stay lossless JSON.
• Bundles are no longer copied with fs.cpSync. On Windows that call terminates the process with 0xC0000409 when the source path contains non-ASCII characters — no exception, nothing try/catch can hold. Since ensureHelper copies lib/wgc beside the helper on the first computer action, an install under C:\Users\<中文名>\.dsh would kill the host on first use. lib/fs-copy.js walks the tree with mkdirSync/copyFileSync instead, and test/unicode-path-copy.check.mjs copies a real Chinese-named tree and fails if fs.cpSync reappears in shipped code.
• The provider checks inject session state instead of probing the real machine, so the guard's own verdicts stay covered by the remote-guard and policy checks while the provider fixtures no longer depend on a built native host.
• Documentation: CrossDeviceResume findings (user-scoped policy, reboot required, no ADMX mapping) plus a recovery harness that only runs behind an explicit --authorized-host-test flag.

Install: npm install -g win-pilot@0.5.0

Verified prebuilt package: win-pilot-0.5.0.tgz (51 files, extracted from the registry and compared with the source build; npm shasum 605ae434b009adf95d4cc245902dee015e7b3e48 matches the local pack).
SHA-256: c4ee8cec41ad129d32defe3e10898e78c7c99878b670aad5bd0932eb81d2e63b

中文：0.5.0 让独立任务桌面采用与主显示器相同的像素尺寸与缩放比例，并在检测到远程控制接入时拒绝打开：默认改在当前桌面执行，选择 remoteControlPolicy: refuse 则直接停止。真正生效依赖本次补上的 child_session_streamers 映射——此前原生探测返回了该字段，但 getSessionState 没有传递，检测形同虚设。本版同时合入贡献者的修复——技能提供者返回 thenable、控制类动作结果保持无损 JSON；并停止用 fs.cpSync 复制随包文件，该调用在非 ASCII 安装路径（如 C:\Users\<中文名>\.dsh）下会以 0xC0000409 直接终止宿主进程，try/catch 无法拦截；改用逐层 mkdirSync + copyFileSync 并新增中文路径回归测试。另附 CrossDeviceResume 调查结论与仅在显式授权参数下运行的恢复脚本。

Merged pull requests

• #4 — fix: return promises from the skill provider and keep control-action results lossless JSON (@NekogamiJam)