@opentig/cli 0.1.2 → 0.1.3

package/dist/bin.mjs

@@ -1,12 +1,13 @@
 #!/usr/bin/env node
-import process from "node:process";
-import { r as runCli } from "./chunks/cli-bEPXlEpH.mjs";
-import "node:child_process";
+import process$1 from "node:process";
+import { p as parseCliArguments, C as CliUsageError, r as runCli } from "./chunks/cli-DaYybBfs.mjs";
+import { fileURLToPath } from "node:url";
+import { spawn } from "node:child_process";
+import { realpath } from "node:fs/promises";
+import path from "node:path";
+import { r as readInstallation, n as newerVersion, p as packageDirectory, O as OPEN_TIG_APP_VERSION } from "./chunks/cli-service-CDd3ZvGV.mjs";
 import "./server.mjs";
-import "node:url";
-import "node:path";
 import "node:crypto";
-import "node:fs/promises";
 import "node:string_decoder";
 import "node:util";
 import "node:tty";
@@ -25,4 +26,54 @@ import "fs";
 import "node:net";
 import "node:http";
 import "ws";
-process.exitCode = await runCli(process.argv.slice(2));
+async function delegateToService(args, currentEntry) {
+  if (process.env.OPENTIG_DELEGATED === "1") return null;
+  let config;
+  try {
+    config = parseCliArguments(args);
+  } catch (error) {
+    if (error instanceof CliUsageError) return null;
+    throw error;
+  }
+  if (config.command === "help" || config.command === "version") {
+    const index = args.findIndex((arg) => arg === "--home" || arg.startsWith("--home="));
+    const home = index >= 0 ? args[index] === "--home" ? args[index + 1] : args[index].slice(7) : process.env.OPENTIG_HOME;
+    if (home) config.home = path.resolve(home);
+  }
+  const installed = await readInstallation(config.home);
+  if (!installed || !newerVersion(installed.version, OPEN_TIG_APP_VERSION)) return null;
+  const entry = path.join(packageDirectory(config.home, installed), "dist/bin.mjs");
+  if (await realpath(entry) === await realpath(currentEntry)) return null;
+  if (config.command === "version") {
+    process.stdout.write(`OpenTig service ${installed.version}
+Global launcher ${OPEN_TIG_APP_VERSION}
+`);
+    return 0;
+  }
+  return new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, [entry, ...args], { stdio: "inherit", env: { ...process.env, OPENTIG_DELEGATED: "1" } });
+    const forward = (signal) => child.kill(signal);
+    const interrupt = () => forward("SIGINT"), terminate = () => forward("SIGTERM");
+    process.on("SIGINT", interrupt);
+    process.on("SIGTERM", terminate);
+    const clean = () => {
+      process.off("SIGINT", interrupt);
+      process.off("SIGTERM", terminate);
+    };
+    child.once("error", (error) => {
+      clean();
+      reject(error);
+    });
+    child.once("exit", (code, signal) => {
+      clean();
+      resolve(code ?? (signal === "SIGINT" ? 130 : 143));
+    });
+  });
+}
+try {
+  const args = process$1.argv.slice(2);
+  process$1.exitCode = await delegateToService(args, fileURLToPath(import.meta.url)) ?? await runCli(args);
+} catch {
+  process$1.stderr.write("OpenTig: Could not launch the managed service version. Check the service installation.\n");
+  process$1.exitCode = 1;
+}

package/dist/chunks/{cli-bEPXlEpH.mjs → cli-DaYybBfs.mjs}

@@ -3,9 +3,10 @@ import process$1 from "node:process";
 import { w as writeFileAtomically, r as redactSensitiveText, n as normalizeRuntimePlatform, a as applicationName, runOpenTigServer } from "../server.mjs";
 import os from "node:os";
 import path from "node:path";
-import { access, rm, mkdir, cp, rename, writeFile, chmod, readFile, appendFile, stat } from "node:fs/promises";
-import { fileURLToPath } from "node:url";
-import { randomBytes } from "node:crypto";
+import { r as readInstallation, s as systemctl, S as SERVICE_NAME, a as serviceUnitPath, p as packageDirectory, n as newerVersion, b as atomicWrite, e as execute, c as stableVersion, O as OPEN_TIG_APP_VERSION, m as manageCliService } from "./cli-service-CDd3ZvGV.mjs";
+import { randomUUID, createHash, randomBytes } from "node:crypto";
+import { realpath, readFile, mkdir, rm, mkdtemp, writeFile, rename, chmod, appendFile, stat } from "node:fs/promises";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
 var QrCodeDataType = /* @__PURE__ */ ((QrCodeDataType2) => {
   QrCodeDataType2[QrCodeDataType2["Border"] = -1] = "Border";
   QrCodeDataType2[QrCodeDataType2["Data"] = 0] = "Data";
@@ -64,14 +65,14 @@ class QrCode {
   // error correction level, data codeword bytes, and mask number.
   // This is a low-level API that most users should not use directly.
   // A mid-level API is the encodeSegments() function.
-  constructor(version2, ecc, dataCodewords, msk) {
-    this.version = version2;
+  constructor(version, ecc, dataCodewords, msk) {
+    this.version = version;
     this.ecc = ecc;
-    if (version2 < MIN_VERSION || version2 > MAX_VERSION)
+    if (version < MIN_VERSION || version > MAX_VERSION)
       throw new RangeError("Version value out of range");
     if (msk < -1 || msk > 7)
       throw new RangeError("Mask value out of range");
-    this.size = version2 * 4 + 17;
+    this.size = version * 4 + 17;
     const row = Array.from({ length: this.size }).fill(false);
     for (let i = 0; i < this.size; i++) {
       this.modules.push(row.slice());
@@ -489,10 +490,10 @@ function isNumeric(text) {
 function isAlphanumeric(text) {
   return ALPHANUMERIC_REGEX.test(text);
 }
-function getTotalBits(segs, version2) {
+function getTotalBits(segs, version) {
   let result = 0;
   for (const seg of segs) {
-    const ccbits = numCharCountBits(seg.mode, version2);
+    const ccbits = numCharCountBits(seg.mode, version);
     if (seg.numChars >= 1 << ccbits)
       return Number.POSITIVE_INFINITY;
     result += 4 + ccbits + seg.bitData.length;
@@ -568,37 +569,37 @@ function encodeSegments(segs, ecl, minVersion = 1, maxVersion = 40, mask = -1, b
   if (!(MIN_VERSION <= minVersion && minVersion <= maxVersion && maxVersion <= MAX_VERSION) || mask < -1 || mask > 7) {
     throw new RangeError("Invalid value");
   }
-  let version2;
+  let version;
   let dataUsedBits;
-  for (version2 = minVersion; ; version2++) {
-    const dataCapacityBits2 = getNumDataCodewords(version2, ecl) * 8;
-    const usedBits = getTotalBits(segs, version2);
+  for (version = minVersion; ; version++) {
+    const dataCapacityBits2 = getNumDataCodewords(version, ecl) * 8;
+    const usedBits = getTotalBits(segs, version);
     if (usedBits <= dataCapacityBits2) {
       dataUsedBits = usedBits;
       break;
     }
-    if (version2 >= maxVersion)
+    if (version >= maxVersion)
       throw new RangeError("Data too long");
   }
   for (const newEcl of [MEDIUM, QUARTILE, HIGH]) {
-    if (boostEcl && dataUsedBits <= getNumDataCodewords(version2, newEcl) * 8)
+    if (boostEcl && dataUsedBits <= getNumDataCodewords(version, newEcl) * 8)
       ecl = newEcl;
   }
   const bb = [];
   for (const seg of segs) {
     appendBits(seg.mode[0], 4, bb);
-    appendBits(seg.numChars, numCharCountBits(seg.mode, version2), bb);
+    appendBits(seg.numChars, numCharCountBits(seg.mode, version), bb);
     for (const b of seg.getData())
       bb.push(b);
   }
-  const dataCapacityBits = getNumDataCodewords(version2, ecl) * 8;
+  const dataCapacityBits = getNumDataCodewords(version, ecl) * 8;
   appendBits(0, Math.min(4, dataCapacityBits - bb.length), bb);
   appendBits(0, (8 - bb.length % 8) % 8, bb);
   for (let padByte = 236; bb.length < dataCapacityBits; padByte ^= 236 ^ 17)
     appendBits(padByte, 8, bb);
   const dataCodewords = Array.from({ length: Math.ceil(bb.length / 8) }, () => 0);
   bb.forEach((b, i) => dataCodewords[i >>> 3] |= b << 7 - (i & 7));
-  return new QrCode(version2, ecl, dataCodewords, mask);
+  return new QrCode(version, ecl, dataCodewords, mask);
 }
 function encode(data, options) {
   const {
@@ -806,8 +807,8 @@ function parseCliArguments(args, environment = process.env, currentDirectory = p
     openBrowser: command === "start" && !noBrowser
   };
 }
-function cliHelp(version2) {
-  return `OpenTig ${version2}
+function cliHelp(version) {
+  return `OpenTig ${version}
 
 Usage:
   opentig [options]
@@ -897,166 +898,223 @@ function resolvePath(value, currentDirectory, label) {
   if (!value || value.includes("\0")) throw new CliUsageError(`Invalid ${label}.`);
   return path.resolve(currentDirectory, value);
 }
-const version = "0.1.2";
-const packageMetadata = {
-  version
-};
-const OPEN_TIG_APP_VERSION = packageMetadata.version;
-const UNIT_NAME = "opentig.service";
-async function manageCliService(config, io) {
-  if (process$1.platform !== "linux") {
-    throw new Error("Background service management currently supports Linux with systemd. On this platform, start OpenTig with your preferred service manager.");
+const DESKTOP_UPDATE_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
+const REPOSITORY = "jorgefl8/opentig";
+const REGISTRY = "https://registry.npmjs.org";
+const MAX_PACKAGE_BYTES = 100 * 1024 * 1024;
+class ServiceUpdater {
+  constructor(version, backend, failedUpdate = false) {
+    this.backend = backend;
+    this.status = {
+      phase: backend ? failedUpdate ? "error" : "idle" : "unavailable",
+      currentVersion: version,
+      availableVersion: null,
+      progress: null,
+      checkedAt: null,
+      releaseUrl: null,
+      releaseNotes: null,
+      message: backend ? failedUpdate ? "The new server could not start. The previous version was restored. Check for updates to retry." : null : "Browser updates require an OpenTig Linux service. Install with opentig service install; temporary CLI and Dev instances are updated from the terminal."
+    };
   }
-  const action = config.serviceAction;
-  if (!action) throw new Error("A service action is required.");
-  const unitPath = path.join(os.homedir(), ".config", "systemd", "user", UNIT_NAME);
-  if (action === "status") return serviceStatus(unitPath, io);
-  if (action === "uninstall") return uninstallService(config.home, unitPath, io);
-  return installService(config, unitPath, io);
-}
-async function installService(config, unitPath, io) {
-  const packageRoot = await findPackageRoot(fileURLToPath(import.meta.url));
-  await assertPackageBuild(packageRoot);
-  const serviceRoot = path.join(config.home, "service");
-  const target = path.join(serviceRoot, `app-${OPEN_TIG_APP_VERSION}`);
-  const temporary = path.join(serviceRoot, `.install-${process$1.pid}-${Date.now()}`);
-  await mkdir(serviceRoot, { recursive: true, mode: 448 });
-  await rm(temporary, { recursive: true, force: true });
-  try {
-    await mkdir(temporary, { recursive: true, mode: 448 });
-    await cp(path.join(packageRoot, "dist"), path.join(temporary, "dist"), { recursive: true, force: true });
-    for (const name of ["package.json", "README.md", "LICENSE", "THIRD_PARTY_NOTICES.md"]) {
-      await cp(path.join(packageRoot, name), path.join(temporary, name), { force: true });
-    }
-    await installProductionDependencies(temporary);
-    await rm(target, { recursive: true, force: true });
-    await rename(temporary, target);
-  } catch (error) {
-    await rm(temporary, { recursive: true, force: true });
-    throw error;
+  backend;
+  status;
+  offered = null;
+  timer;
+  stopped = false;
+  work = null;
+  getStatus = async () => ({ ...this.status });
+  start() {
+    if (this.backend && this.status.phase !== "error") this.schedule(1e4);
   }
-  const unit = renderSystemdUnit({
-    nodeExecutable: process$1.execPath,
-    cliEntrypoint: path.join(target, "dist", "bin.mjs"),
-    host: config.host,
-    port: config.port,
-    home: config.home
-  });
-  await mkdir(path.dirname(unitPath), { recursive: true, mode: 448 });
-  const temporaryUnit = `${unitPath}.${process$1.pid}.tmp`;
-  await writeFile(temporaryUnit, unit, { encoding: "utf8", mode: 384 });
-  await rename(temporaryUnit, unitPath);
-  await chmod(unitPath, 384);
-  await runRequired("systemctl", ["--user", "daemon-reload"]);
-  await runRequired("systemctl", ["--user", "enable", "--now", UNIT_NAME]);
-  await runRequired("loginctl", ["enable-linger"]);
-  io.out(`OpenTig service installed and started on ${config.host}:${config.port}.`);
-  io.out(`Unit: ${unitPath}`);
-  io.out(`Pair another browser with: opentig pair --home ${config.home}`);
-  return 0;
-}
-async function serviceStatus(unitPath, io) {
-  try {
-    await access(unitPath);
-  } catch {
-    io.out("OpenTig service is not installed.");
-    return 1;
+  async stop() {
+    this.stopped = true;
+    clearTimeout(this.timer);
+    await this.work;
   }
-  const enabled = await run("systemctl", ["--user", "is-enabled", UNIT_NAME]);
-  const active = await run("systemctl", ["--user", "is-active", UNIT_NAME]);
-  io.out(`OpenTig service: ${active.stdout.trim() || "unknown"} (${enabled.stdout.trim() || "unknown"}).`);
-  io.out(`Unit: ${unitPath}`);
-  return active.code === 0 ? 0 : 1;
-}
-async function uninstallService(home, unitPath, io) {
-  await run("systemctl", ["--user", "disable", "--now", UNIT_NAME]);
-  await rm(unitPath, { force: true });
-  await runRequired("systemctl", ["--user", "daemon-reload"]);
-  await rm(path.join(home, "service"), { recursive: true, force: true });
-  io.out("OpenTig service removed. Repository settings and paired sessions were kept.");
-  return 0;
-}
-function renderSystemdUnit(input) {
-  const args = [
-    input.nodeExecutable,
-    input.cliEntrypoint,
-    "serve",
-    "--host",
-    input.host,
-    "--port",
-    String(input.port),
-    "--home",
-    input.home
-  ];
-  return `[Unit]
-Description=OpenTig browser Git client
-After=network.target
-
-[Service]
-Type=simple
-WorkingDirectory=${systemdQuote(input.home)}
-ExecStart=${args.map(systemdQuote).join(" ")}
-Environment=NODE_ENV=production
-Restart=on-failure
-RestartSec=3
-KillSignal=SIGTERM
-TimeoutStopSec=10
-
-[Install]
-WantedBy=default.target
-`;
-}
-function systemdQuote(value) {
-  if (value.includes("\0") || value.includes("\r") || value.includes("\n")) throw new Error("Service paths and arguments cannot contain control characters.");
-  return `"${value.replaceAll("%", "%%").replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
-}
-async function assertPackageBuild(packageRoot) {
-  await Promise.all([
-    access(path.join(packageRoot, "dist", "bin.mjs")),
-    access(path.join(packageRoot, "dist", "client", "index.html")),
-    readFile(path.join(packageRoot, "package.json"), "utf8")
-  ]).catch(() => {
-    throw new Error("The OpenTig package is incomplete and cannot be installed as a service.");
-  });
-}
-async function findPackageRoot(modulePath) {
-  let directory = path.dirname(modulePath);
-  for (let depth = 0; depth < 4; depth += 1) {
+  schedule(delay2 = DESKTOP_UPDATE_CHECK_INTERVAL_MS) {
+    clearTimeout(this.timer);
+    if (!this.stopped) {
+      this.timer = setTimeout(() => void this.check(), delay2);
+      this.timer.unref();
+    }
+  }
+  check = async () => {
+    if (!this.backend || this.stopped || !["idle", "error"].includes(this.status.phase)) return this.getStatus();
+    this.status = { ...this.status, phase: "checking", message: null, progress: null };
     try {
-      await Promise.all([
-        access(path.join(directory, "package.json")),
-        access(path.join(directory, "dist", "bin.mjs"))
-      ]);
-      return directory;
+      const release = await this.backend.release();
+      this.offered = release && newerVersion(release.version, this.status.currentVersion) ? release : null;
+      this.status = {
+        ...this.status,
+        phase: this.offered ? "available" : "idle",
+        availableVersion: this.offered?.version ?? null,
+        releaseUrl: this.offered?.url ?? null,
+        releaseNotes: this.offered?.notes ?? null,
+        checkedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
     } catch {
+      this.fail("Could not check for updates. Check your connection and try again.");
+    } finally {
+      this.schedule();
     }
-    const parent = path.dirname(directory);
-    if (parent === directory) break;
-    directory = parent;
+    return this.getStatus();
+  };
+  download = async () => {
+    if (!this.backend || !this.offered || this.stopped || this.status.phase !== "available") return this.getStatus();
+    this.status = { ...this.status, phase: "downloading", progress: 0, message: null };
+    this.work = this.backend.stage(this.offered, (progress) => {
+      this.status.progress = progress;
+    }).then(() => {
+      this.status = { ...this.status, phase: "ready", progress: 100 };
+    }).catch(() => this.fail("Could not prepare the update. The running service has not been replaced."));
+    return this.getStatus();
+  };
+  install = async () => {
+    if (!this.backend || !this.offered || this.stopped || this.status.phase !== "ready") return this.getStatus();
+    this.status = { ...this.status, phase: "installing", message: "Restarting the server. This browser will reconnect shortly." };
+    void this.backend.install(this.offered).catch(() => {
+      this.fail("Could not apply the update. Check the service status and try again.");
+    });
+    return this.getStatus();
+  };
+  fail(message) {
+    this.status = { ...this.status, phase: "error", progress: null, message };
   }
-  throw new Error("Could not locate the installed OpenTig package.");
 }
-async function installProductionDependencies(directory) {
-  const npmCli = process$1.env.npm_execpath;
-  if (npmCli) {
-    await runRequired(process$1.execPath, [npmCli, "install", "--omit=dev", "--ignore-scripts", "--no-audit", "--no-fund"], directory);
-    return;
-  }
-  await runRequired("npm", ["install", "--omit=dev", "--ignore-scripts", "--no-audit", "--no-fund"], directory);
+async function json(url) {
+  const response = await fetch(url, { headers: { Accept: "application/json" }, signal: AbortSignal.timeout(15e3) });
+  if (response.status === 404) return null;
+  if (!response.ok) throw new Error("Release metadata request failed.");
+  const text = await response.text();
+  if (text.length > 1e6) throw new Error("Release metadata is too large.");
+  return JSON.parse(text);
+}
+async function latestCliRelease() {
+  const release = await json(`https://api.github.com/repos/${REPOSITORY}/releases/latest`);
+  if (!release || release.draft || release.prerelease || typeof release.tag_name !== "string") return null;
+  const version = release.tag_name.replace(/^v/, "");
+  if (!stableVersion(version) || release.tag_name !== `v${version}`) return null;
+  const pkg = await json(`${REGISTRY}/@opentig%2fcli/${version}`);
+  if (!pkg) return null;
+  const dist = pkg.dist;
+  const tarball = `${REGISTRY}/@opentig/cli/-/cli-${version}.tgz`;
+  if (pkg.name !== "@opentig/cli" || pkg.version !== version || dist?.tarball !== tarball || typeof dist.integrity !== "string" || !/^sha512-[A-Za-z0-9+/]{86}==$/.test(dist.integrity)) throw new Error("Invalid CLI release metadata.");
+  return {
+    version,
+    tarball,
+    integrity: dist.integrity,
+    url: `https://github.com/${REPOSITORY}/releases/tag/v${version}`,
+    notes: typeof release.body === "string" ? release.body.slice(0, 64e3) : null
+  };
 }
-function runRequired(command, args, cwd) {
-  return run(command, args, cwd).then((result) => {
-    if (result.code !== 0) throw new Error(`${command} failed: ${result.stderr.trim() || result.stdout.trim() || `exit code ${result.code}`}`);
-  });
+function verifyTarball(bytes, integrity) {
+  if (`sha512-${createHash("sha512").update(bytes).digest("base64")}` !== integrity) throw new Error("CLI download integrity mismatch.");
 }
-function run(command, args, cwd) {
-  return new Promise((resolve, reject) => {
-    execFile(command, args, { cwd, timeout: 12e4, windowsHide: true }, (error, stdout, stderr) => {
-      const code = typeof error?.code === "number" ? error.code : error ? 1 : 0;
-      if (error && error.code === "ENOENT") return reject(new Error(`${command} is required but was not found.`));
-      resolve({ code, stdout, stderr });
+async function stageCliRelease(home, release, progress) {
+  if (!stableVersion(release.version)) throw new Error("Invalid update version.");
+  const existing = path.join(home, "service", `app-${release.version}`);
+  try {
+    const marker = JSON.parse(await readFile(path.join(existing, "update-integrity.json"), "utf8"));
+    if (marker.version !== release.version || marker.integrity !== release.integrity) throw new Error("Existing candidate does not match the release.");
+    progress(100);
+    return;
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  const temporary = await mkdtemp(path.join(home, "service/.download-"));
+  try {
+    const response = await fetch(release.tarball, { signal: AbortSignal.timeout(12e4), redirect: "error" });
+    if (!response.ok || !response.body) throw new Error("CLI download failed.");
+    const total = Number(response.headers.get("content-length"));
+    if (total > MAX_PACKAGE_BYTES) throw new Error("CLI package too large.");
+    let size = 0;
+    const chunks = [];
+    for await (const chunk of response.body) {
+      size += chunk.length;
+      if (size > MAX_PACKAGE_BYTES) throw new Error("CLI package too large.");
+      chunks.push(chunk);
+      progress(Number.isFinite(total) && total > 0 ? Math.min(85, size / total * 85) : 0);
+    }
+    const bytes = Buffer.concat(chunks);
+    verifyTarball(bytes, release.integrity);
+    const tarball = path.join(temporary, "cli.tgz");
+    await writeFile(tarball, bytes, { mode: 384 });
+    const target = path.join(temporary, "app");
+    await mkdir(target);
+    await execute("npm", ["install", "--prefix", target, "--ignore-scripts", "--omit=dev", "--no-audit", "--no-fund", "--registry", REGISTRY, tarball], { timeout: 18e4, maxBuffer: 2e6 });
+    const pkgRoot = path.join(target, "node_modules/@opentig/cli");
+    const pkg = JSON.parse(await readFile(path.join(pkgRoot, "package.json"), "utf8"));
+    if (pkg.name !== "@opentig/cli" || pkg.version !== release.version) throw new Error("Installed CLI identity mismatch.");
+    const result = await execute(process.execPath, [path.join(pkgRoot, "dist/bin.mjs"), "--version"], {
+      timeout: 15e3,
+      env: { ...process.env, OPENTIG_DELEGATED: "1" }
     });
-  });
+    if (result.stdout.trim() !== release.version) throw new Error("New CLI cannot run.");
+    await readFile(path.join(pkgRoot, "dist/client/index.html"));
+    await readFile(path.join(pkgRoot, "dist/service-update.mjs"));
+    progress(95);
+    const destination = path.join(home, "service", `app-${release.version}`);
+    await atomicWrite(path.join(target, "update-integrity.json"), JSON.stringify({ version: release.version, integrity: release.integrity }));
+    await rename(target, destination);
+  } finally {
+    await rm(temporary, { recursive: true, force: true });
+  }
+}
+async function createServiceUpdater(home, version, profile, address) {
+  let installation = null;
+  try {
+    if (profile === "production" && process.platform === "linux" && process.env.INVOCATION_ID) {
+      installation = await readInstallation(home);
+      if (!installation || installation.version !== version || installation.host !== address.host || installation.port !== address.port || await systemctl("show", SERVICE_NAME, "--property=FragmentPath", "--value") !== serviceUnitPath() || await realpath(process.argv[1]) !== await realpath(path.join(packageDirectory(home, installation), "dist/bin.mjs")) || await systemctl("show", SERVICE_NAME, "--property=MainPID", "--value") !== String(process.pid)) installation = null;
+    }
+  } catch {
+    installation = null;
+  }
+  if (!installation) return new ServiceUpdater(version, null);
+  const current = installation;
+  let failedUpdate = false;
+  try {
+    const result = JSON.parse(await readFile(path.join(home, "service/update-result.json"), "utf8"));
+    failedUpdate = result.success === false && result.version === version;
+  } catch {
+  }
+  const updater = new ServiceUpdater(version, {
+    release: latestCliRelease,
+    stage: (release, progress) => stageCliRelease(home, release, progress),
+    install: async (release) => {
+      const lock = path.join(home, "service/update-lock");
+      await mkdir(lock, { mode: 448 });
+      const unit = `opentig-update-${randomUUID()}`;
+      try {
+        const next = { ...current, version: release.version, layout: "npm" };
+        const previousUnit = await readFile(serviceUnitPath(), "utf8");
+        await atomicWrite(path.join(lock, "plan.json"), JSON.stringify({ home, current, next, previousUnit, integrity: release.integrity }));
+        await execute("systemd-run", [
+          "--user",
+          "--collect",
+          "--unit",
+          unit,
+          "--property=Type=exec",
+          process.execPath,
+          path.join(packageDirectory(home, current), "dist/service-update.mjs"),
+          home
+        ], { timeout: 15e3 });
+      } catch (error) {
+        await rm(lock, { recursive: true, force: true });
+        throw error;
+      }
+      for (let attempt = 0; attempt < 120; attempt++) {
+        await setTimeout$1(1e3);
+        const state = await systemctl("show", unit, "--property=ActiveState", "--value").catch(() => "inactive");
+        if (!["active", "activating", "deactivating"].includes(state)) {
+          await rm(lock, { recursive: true, force: true });
+          throw new Error("Update worker exited without replacing the server.");
+        }
+      }
+      throw new Error("Update worker did not restart the service.");
+    }
+  }, failedUpdate);
+  return updater;
 }
 const RUNTIME_STATE_VERSION = 1;
 function resolveCliPaths(home) {
@@ -1114,7 +1172,7 @@ async function readRuntimeState(filePath) {
   try {
     value = JSON.parse(await readFile(filePath, "utf8"));
   } catch (error) {
-    if (error.code === "ENOENT") throw new Error("No running OpenTig server was found for this home.");
+    if (error.code === "ENOENT") throw new Error("No running OpenTig server was found for this home.", { cause: error });
     throw new Error("OpenTig runtime state is unreadable.", { cause: error });
   }
   if (!isRuntimeState(value)) throw new Error("OpenTig runtime state is invalid.");
@@ -1219,10 +1277,12 @@ async function startCliServer(config, io, profile) {
   const adminToken = await loadOrCreateAdminToken(paths.adminToken);
   const instanceId = newInstanceId();
   const log = new CliServerLog(paths.serverLog);
+  const updates = await createServiceUpdater(config.home, OPEN_TIG_APP_VERSION, profile, config);
   let server = null;
   try {
     server = await startOnConfiguredPort({
       appVersion: OPEN_TIG_APP_VERSION,
+      updates,
       profile,
       auth: { consumeDesktopSecret: () => false },
       settingsPath: paths.settings,
@@ -1261,11 +1321,14 @@ async function startCliServer(config, io, profile) {
         io.error("Could not open the system browser. Open the one-time pairing link shown above manually.");
       });
     }
+    updates.start();
     return await waitForShutdown(server, async () => {
+      await updates.stop();
       await clearRuntimeState(paths.runtimeState, instanceId);
       await log.close();
     }, io);
   } catch (error) {
+    await updates.stop();
     if (server) await server.close().catch(() => void 0);
     await clearRuntimeState(paths.runtimeState, instanceId).catch(() => void 0);
     await log.close();
@@ -1403,5 +1466,6 @@ function assertGitAvailable() {
 }
 export {
   CliUsageError as C,
+  parseCliArguments as p,
   runCli as r
 };