@orb44/cli 0.1.0 → 0.1.4

package/README.md

@@ -1,11 +1,13 @@
-# orb44
+# @orb44/cli
 
-Watch satellite for [Orb44](https://github.com/ephemeral172/orb44). Sends a pulse (load, listeners, hardening) to the cabinet. The cabinet does not run commands on the host.
+[Orb44](https://orb44.com) is a street snapshot of your own site: how the shop, payments, and perimeter look from the internet — not a week-long pentest.
 
-Node 18+. Linux or macOS.
+This package is the **Watch satellite**. On a verified host it sends a pulse (load, listeners, hardening) to the Orb44 cabinet. The cabinet does not run commands on the machine.
+
+Node 18+. Linux or macOS. Product: [orb44.com](https://orb44.com)
 
 ```bash
-npx @orb44/cli login --url https://your-orb44
+npx @orb44/cli login --url https://orb44.com
 ```
 
 Open the printed link in a browser where you are already signed in, confirm the domain, then optionally install the systemd daemon (default no). After a global install the command is `orb44`.

package/bin/orb44.mjs

@@ -8,6 +8,7 @@ import { stdin as input, stdout as output } from "node:process";
 import { collectPulse, formatPulsePreview } from "../server/pulse.mjs";
 import { LANGS, LANG_LABEL, detectLang, normalizeLang, t } from "../server/sat-i18n.mjs";
 import { pickFromList } from "../server/cli-menu.mjs";
+import { SYSTEM_DEVICE, parseDeviceJson, hasExistingInstall, pickLiveDevice, deviceSearchPaths, loadFirstDevice, stripDevicePath } from "../server/sat-local.mjs";
 
 const DEVICE_FILE = process.env.ORB44_DEVICE_FILE || path.join(os.homedir(), ".config", "orb44", "device.json");
 const CLI_FILE = process.env.ORB44_CLI_FILE || path.join(path.dirname(DEVICE_FILE), "cli.json");
@@ -21,6 +22,8 @@ function args() {
     if (a === "--yes" || a === "-y") out.yes = true;
     else if (a === "--system") out.system = true;
     else if (a === "--daemon") out.daemon = true;
+    else if (a === "--force") out.force = true;
+    else if (a === "--purge") out.purge = true;
     else if (a === "--url" || a === "--code" || a === "--name" || a === "--interval" || a === "--lang") {
       out[a.slice(2)] = argv[++i];
     } else if (!a.startsWith("-")) out._.push(a);
@@ -57,12 +60,12 @@ function storedOrFlag(opts) {
   return normalizeLang(opts.lang) || storedLang() || detectLang();
 }
 
+function loadDeviceRecord() {
+  return loadFirstDevice((p) => fs.readFileSync(p, "utf8"), deviceSearchPaths(DEVICE_FILE));
+}
+
 function loadDevice() {
-  try {
-    return JSON.parse(fs.readFileSync(DEVICE_FILE, "utf8"));
-  } catch {
-    return null;
-  }
+  return stripDevicePath(loadDeviceRecord());
 }
 
 function saveDevice(row) {
@@ -180,14 +183,90 @@ async function sendPulse(device, { preview = true } = {}) {
   return { out, pulse };
 }
 
+async function wantReplace(found, opts) {
+  if (opts.force) return true;
+  if (opts.yes || !input.isTTY || !output.isTTY) return false;
+  const lines = [t(lang, "already_title")];
+  for (const d of found.devices) {
+    lines.push(t(lang, "already_host", { host: d.host || "—", name: d.name || "—" }));
+    lines.push(t(lang, "already_key", { file: d.path }));
+  }
+  if (found.daemon) lines.push(t(lang, "already_daemon"));
+  else if (found.unit) lines.push(t(lang, "already_unit"));
+  const idx = await pickFromList({
+    title: lines.join("\n"),
+    items: [t(lang, "already_keep"), t(lang, "already_replace")],
+    index: 0,
+    hint: "↑↓  Enter",
+    stdin: input,
+    stdout: output,
+  });
+  return idx === 1;
+}
+
+function existingOnBox() {
+  const paths = [...new Set([DEVICE_FILE, SYSTEM_DEVICE])];
+  const devices = [];
+  for (const p of paths) {
+    try {
+      const row = parseDeviceJson(fs.readFileSync(p, "utf8"), p);
+      if (row) devices.push(row);
+    } catch {
+      /* missing or unreadable */
+    }
+  }
+  const unit =
+    fs.existsSync("/etc/systemd/system/orb44-satellite.service") ||
+    fs.existsSync(path.join(os.homedir(), ".config", "systemd", "user", "orb44-satellite.service"));
+  let daemon = false;
+  try {
+    daemon = serviceIsActive(true) || serviceIsActive(false);
+  } catch {
+    daemon = false;
+  }
+  return { devices, daemon, unit };
+}
+
+async function revokeLocalDevices(devices, fallbackApi) {
+  for (const d of devices) {
+    const apiBase = d.api || fallbackApi;
+    if (!apiBase || !d.secret) continue;
+    await api(apiBase, "/api/satellites/logout", { method: "POST", json: { secret: d.secret } }).catch(() => {});
+  }
+  clearDevice();
+  if (SYSTEM_DEVICE !== DEVICE_FILE) {
+    try {
+      fs.unlinkSync(SYSTEM_DEVICE);
+    } catch {
+      /* missing */
+    }
+  }
+}
+
 async function cmdLogin(opts) {
   await ensureLang(opts);
   banner();
   const url = String(opts.url || process.env.ORB44_API || "http://127.0.0.1:8787").replace(/\/$/, "");
-  const prev = loadDevice();
-  if (prev?.secret) {
-    await api(prev.api, "/api/satellites/logout", { method: "POST", json: { secret: prev.secret } }).catch(() => {});
-    clearDevice();
+  const found = existingOnBox();
+  if (hasExistingInstall(found)) {
+    const replace = await wantReplace(found, opts);
+    if (!replace) {
+      const live = pickLiveDevice(found.devices, { daemon: found.daemon });
+      if (!live?.secret) {
+        console.log(t(lang, "already_no_key"));
+        process.exit(0);
+      }
+      const { out } = await sendPulse(live);
+      if (!out.ok) {
+        console.error(`⚠️  ${out.body.error || t(lang, "pulse_fail")}`);
+        process.exit(1);
+      }
+      console.log("\n📡  " + t(lang, "pulse_ok"));
+      printAdvice(out.body?.notes);
+      console.log(dim("\n" + t(lang, "already_kept")));
+      process.exit(0);
+    }
+    await revokeLocalDevices(found.devices, url);
   }
   const hostname = os.hostname();
   const name = opts.name || hostname;
@@ -336,6 +415,13 @@ function systemdUnit({ node, script, deviceFile, interval, user }) {
   return `${lines.join("\n")}\n`;
 }
 
+const CLI_LINK = "/usr/local/bin/orb44";
+
+function linkSystemCli(node, script) {
+  const body = `#!/bin/sh\nexec ${quote(node)} ${quote(script)} "$@"\n`;
+  fs.writeFileSync(CLI_LINK, body, { mode: 0o755 });
+}
+
 function satServerDir() {
   return path.join(path.dirname(SCRIPT), "..", "server");
 }
@@ -350,6 +436,7 @@ function installSystemTree() {
     [path.join(serverSrc, "pulse.mjs"), path.join(lib, "server", "pulse.mjs")],
     [path.join(serverSrc, "sat-i18n.mjs"), path.join(lib, "server", "sat-i18n.mjs")],
     [path.join(serverSrc, "cli-menu.mjs"), path.join(lib, "server", "cli-menu.mjs")],
+    [path.join(serverSrc, "sat-local.mjs"), path.join(lib, "server", "sat-local.mjs")],
   ];
   for (const [from, to] of copies) {
     fs.copyFileSync(from, to);
@@ -377,7 +464,9 @@ function ensureSystemServiceAccount(srcDeviceFile) {
     }
   }
   fs.mkdirSync(home, { recursive: true, mode: 0o750 });
-  fs.copyFileSync(srcDeviceFile, dest);
+  if (path.resolve(srcDeviceFile) !== path.resolve(dest)) {
+    fs.copyFileSync(srcDeviceFile, dest);
+  }
   fs.chmodSync(dest, 0o600);
   const chown = spawnSync("chown", ["-R", "orb44:orb44", home], { encoding: "utf8" });
   if (chown.status !== 0) {
@@ -429,18 +518,22 @@ function tryEnable(asSystem) {
 
 function cmdInstall(opts, { enable = false } = {}) {
   applyLang(opts);
-  const device = loadDevice();
-  if (!device?.secret) {
+  const rec = loadDeviceRecord();
+  if (!rec?.secret) {
     console.error("⚠️  " + t(lang, "need_login"));
     process.exit(1);
   }
+  const srcPath = rec.path || DEVICE_FILE;
+  const device = stripDevicePath(rec);
+  if (opts.url) device.api = String(opts.url).replace(/\/$/, "");
+  if (srcPath !== DEVICE_FILE) saveDevice(device);
   const asSystem = Boolean(opts.system) || process.getuid?.() === 0;
   const interval = intervalSec(opts.interval);
   let deviceFile = DEVICE_FILE;
   let user = null;
   let script = SCRIPT;
   if (asSystem) {
-    const acct = ensureSystemServiceAccount(DEVICE_FILE);
+    const acct = ensureSystemServiceAccount(srcPath);
     if (acct.ok) {
       deviceFile = acct.deviceFile;
       user = acct.user;
@@ -463,6 +556,14 @@ function cmdInstall(opts, { enable = false } = {}) {
   fs.mkdirSync(path.dirname(unitPath), { recursive: true });
   fs.writeFileSync(unitPath, unit, { mode: 0o644 });
   console.log("⚙️  " + t(lang, "unit_written", { path: unitPath }));
+  if (asSystem) {
+    try {
+      linkSystemCli(process.execPath, script);
+      console.log(dim(t(lang, "cli_link", { path: CLI_LINK })));
+    } catch {
+      /* /usr/local/bin missing */
+    }
+  }
   if (enable) {
     const on = tryEnable(asSystem);
     if (on.ok) {
@@ -482,6 +583,63 @@ function cmdInstall(opts, { enable = false } = {}) {
   return false;
 }
 
+function tryDisable(asSystem) {
+  const args = asSystem
+    ? [
+        ["disable", "--now", "orb44-satellite"],
+        ["daemon-reload"],
+      ]
+    : [
+        ["--user", "disable", "--now", "orb44-satellite"],
+        ["--user", "daemon-reload"],
+      ];
+  for (const a of args) {
+    spawnSync("systemctl", a, { encoding: "utf8" });
+  }
+}
+
+function rmTree(p) {
+  try {
+    fs.rmSync(p, { recursive: true, force: true });
+  } catch {
+    /* missing */
+  }
+}
+
+async function cmdUninstall(opts) {
+  applyLang(opts);
+  const asSystem = Boolean(opts.system) || process.getuid?.() === 0;
+  tryDisable(asSystem);
+  tryDisable(!asSystem);
+  const unitPaths = [
+    "/etc/systemd/system/orb44-satellite.service",
+    path.join(os.homedir(), ".config", "systemd", "user", "orb44-satellite.service"),
+  ];
+  for (const p of unitPaths) {
+    try {
+      fs.unlinkSync(p);
+    } catch {
+      /* missing */
+    }
+  }
+  rmTree("/usr/lib/orb44-sat");
+  try {
+    fs.unlinkSync(CLI_LINK);
+  } catch {
+    /* missing */
+  }
+  if (opts.purge) {
+    const found = existingOnBox();
+    await revokeLocalDevices(found.devices, found.devices[0]?.api);
+    rmTree("/var/lib/orb44");
+    spawnSync("userdel", ["orb44"], { encoding: "utf8" });
+    console.log("✅  " + t(lang, "uninstall_purged"));
+    return;
+  }
+  console.log("✅  " + t(lang, "uninstall_ok"));
+  console.log(dim(t(lang, "uninstall_key_kept", { file: SYSTEM_DEVICE })));
+}
+
 function cmdStatus() {
   applyLang(opts);
   const device = loadDevice();
@@ -548,6 +706,7 @@ const run = {
   pulse: cmdPulse,
   daemon: () => cmdDaemon(opts),
   install: () => cmdInstall(opts, { enable: true }),
+  uninstall: () => cmdUninstall(opts),
   status: cmdStatus,
   logout: cmdLogout,
   lang: () => cmdLang(opts),

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@orb44/cli",
-  "version": "0.1.0",
-  "description": "Orb44 Watch satellite: outgoing pulse from the host. Not a remote shell.",
+  "version": "0.1.4",
+  "description": "Orb44: street snapshot of your site. This CLI is the Watch satellite — pulse from the host (load, listeners, hardening). The cabinet does not run commands on the machine.",
   "type": "module",
   "bin": {
     "orb44": "bin/orb44.mjs"
@@ -10,7 +10,8 @@
     "bin/orb44.mjs",
     "server/pulse.mjs",
     "server/sat-i18n.mjs",
-    "server/cli-menu.mjs"
+    "server/cli-menu.mjs",
+    "server/sat-local.mjs"
   ],
   "engines": {
     "node": ">=18"
@@ -20,7 +21,7 @@
     "url": "git+https://github.com/ephemeral172/orb44.git",
     "directory": "packages/orb44"
   },
-  "homepage": "https://github.com/ephemeral172/orb44",
+  "homepage": "https://orb44.com",
   "bugs": {
     "url": "https://github.com/ephemeral172/orb44/issues"
   },
@@ -28,7 +29,8 @@
     "orb44",
     "watch",
     "satellite",
-    "pulse"
+    "pulse",
+    "perimeter"
   ],
   "license": "MIT",
   "publishConfig": {

package/server/pulse.mjs

@@ -672,33 +672,70 @@ export function collectPulse() {
   });
 }
 
+function clip(s, n) {
+  const t = String(s ?? "");
+  if (t.length <= n) return t;
+  return `${t.slice(0, Math.max(1, n - 1))}…`;
+}
+
+function asciiTable(headers, rows) {
+  const cells = [headers, ...rows].map((r) => r.map((c) => String(c ?? "")));
+  const widths = headers.map((_, i) => Math.max(1, ...cells.map((r) => [...(r[i] || "")].length)));
+  const fill = (ch) => widths.map((w) => ch.repeat(w + 2)).join("┼");
+  const line = (row) =>
+    "│ " +
+    row
+      .map((c, i) => {
+        const s = clip(c, widths[i]);
+        return s + " ".repeat(Math.max(0, widths[i] - [...s].length));
+      })
+      .join(" │ ") +
+    " │";
+  return [`┌${fill("─").replaceAll("┼", "┬")}┐`, line(headers), `├${fill("─")}┤`, ...rows.map(line), `└${fill("─").replaceAll("┼", "┴")}┘`].join("\n");
+}
+
 export function formatPulsePreview(pulse, lang = "en") {
   const gb = (n) => (Number(n) / 1024 / 1024 / 1024).toFixed(1);
   const none = t(lang, "preview_none");
-  const lines = [
-    t(lang, "preview_host", { h: pulse.hostname || "—" }),
-    t(lang, "preview_load", { load: pulse.load1, used: gb(pulse.memUsed), total: gb(pulse.memTotal), disk: pulse.diskUsedPct ?? "—" }),
-    t(lang, "preview_listen", {
-      list: (pulse.listen || []).slice(0, 12).map((r) => `${r.addr}:${r.port}${r.comm ? ` ${r.comm}` : ""}`).join(", ") || none,
-    }),
-    t(lang, "preview_top", {
-      list: (pulse.top || []).slice(0, 5).map((r) => `${r.comm} ${r.cpuPct}% ${r.rssMb}M`).join(", ") || none,
-    }),
-  ];
-  const h = pulse.hardening;
-  if (h) {
-    const ssh = h.sshPassword ? t(lang, "preview_ssh_pass") : h.sshPassword === false ? t(lang, "preview_ssh_key") : "?";
-    lines.push(
-      t(lang, "preview_guard", {
-        fw: h.firewall || t(lang, "preview_fw_no"),
-        ban: h.fail2ban || t(lang, "preview_ban_no"),
-        upd: h.updates ? t(lang, "preview_yes") : t(lang, "preview_no"),
-        sync: h.timesync || t(lang, "preview_no"),
-        ssh,
-        grade: pulse.gradeInside || "—",
-      })
-    );
-  }
-  if (pulse.limited) lines.push(t(lang, "preview_limited"));
-  return lines.join("\n");
+  const h = pulse.hardening || {};
+  const grade = pulse.gradeInside || gradeInside(pulse) || "—";
+  const ssh = h.sshPassword ? t(lang, "preview_ssh_pass") : h.sshPassword === false ? t(lang, "preview_ssh_key") : "—";
+  const machine = asciiTable(
+    [t(lang, "preview_col_check"), t(lang, "preview_col_value")],
+    [
+      [t(lang, "preview_row_host"), pulse.hostname || "—"],
+      [t(lang, "preview_row_load"), Number(pulse.load1).toFixed(2)],
+      [t(lang, "preview_row_ram"), `${gb(pulse.memUsed)} / ${gb(pulse.memTotal)}`],
+      [t(lang, "preview_row_disk"), `${pulse.diskUsedPct ?? "—"}%`],
+      [t(lang, "preview_row_grade"), grade],
+    ]
+  );
+  const listenRows = [...(pulse.listen || [])]
+    .sort((a, b) => {
+      const rank = (addr) => (addr === "0.0.0.0" || addr === "::" ? 0 : String(addr).startsWith("127.") || addr === "::1" ? 2 : 1);
+      return rank(a.addr) - rank(b.addr) || Number(a.port) - Number(b.port);
+    })
+    .slice(0, 16)
+    .map((r) => [r.addr || "—", String(r.port ?? ""), r.comm || "—"]);
+  const listen = asciiTable(
+    [t(lang, "preview_col_bind"), t(lang, "preview_col_port"), t(lang, "preview_col_proc")],
+    listenRows.length ? listenRows : [[none, "", ""]]
+  );
+  const topRows = (pulse.top || []).slice(0, 6).map((r) => [r.comm || "—", `${r.cpuPct}%`, `${r.rssMb}M`]);
+  const top = asciiTable(
+    [t(lang, "preview_col_proc"), t(lang, "preview_col_cpu"), t(lang, "preview_col_rss")],
+    topRows.length ? topRows : [[none, "", ""]]
+  );
+  const guard = asciiTable(
+    [t(lang, "preview_col_check"), t(lang, "preview_col_value")],
+    [
+      [t(lang, "preview_row_fw"), h.firewall || t(lang, "preview_fw_no")],
+      [t(lang, "preview_row_ban"), h.fail2ban || t(lang, "preview_ban_no")],
+      [t(lang, "preview_row_upd"), h.updates ? t(lang, "preview_yes") : t(lang, "preview_no")],
+      [t(lang, "preview_row_sync"), h.timesync || t(lang, "preview_no")],
+      [t(lang, "preview_row_ssh"), ssh],
+    ]
+  );
+  const extra = pulse.limited ? `\n${t(lang, "preview_limited")}` : "";
+  return `${machine}\n\n${listen}\n\n${top}\n\n${guard}${extra}`;
 }

package/server/sat-i18n.mjs

@@ -21,7 +21,7 @@ export function detectLang(env = process.env) {
 const STR = {
   en: {
     banner_title: "Orb44 satellite",
-    banner_sub: "Device key is pulse only, not a shell. Advice comes back on the pulse; you run commands.",
+    banner_sub: "Inside analysis of this host: load, listeners, hardening.",
     lang_pick: "Language  ·  Язык  ·  언어  ·  Idioma",
     lang_saved: "Language saved: {label}",
     lang_now: "CLI language: {label}  (--lang en|ru|ko|es)",
@@ -45,6 +45,7 @@ const STR = {
     daemon_run: "daemon every {sec}s · {host}",
     daemon_revoked: "key revoked",
     unit_written: "unit {path}",
+    cli_link: "command {path}",
     daemon_on: "daemon enabled: background pulse, starts again after reboot.",
     login_done: "Done. You can close this session — the daemon is already in the background.",
     daemon_user: "service user {user} · key {file}",
@@ -55,6 +56,18 @@ const STR = {
     not_paired: "Not paired. orb44 login",
     now_on_box: "On the machine now",
     logged_out: "Disconnected. Cabinet dropped the device.",
+    uninstall_ok: "Daemon stopped and unit removed. Pairing key kept.",
+    uninstall_purged: "Daemon, key, and service user orb44 removed. Cabinet dropped the device.",
+    uninstall_key_kept: "Key still at {file}. Later: npx @orb44/cli install",
+    already_title: "Already on this machine",
+    already_host: "{host}  ({name})",
+    already_key: "key {file}",
+    already_daemon: "Watch daemon is already running",
+    already_unit: "systemd unit is already installed",
+    already_keep: "Keep — do not pair again",
+    already_replace: "Replace — new login, old device is revoked",
+    already_kept: "Left as is. Pulse sent. Same device in the cabinet.",
+    already_no_key: "Daemon is on, but this user cannot read the key. Try: sudo orb44 status",
     advice_title: "What to do on this machine",
     advice_sub: "The cabinet will not run this — a leaked key must not become a remote shell.",
     preview_host: "host {h}",
@@ -62,6 +75,23 @@ const STR = {
     preview_listen: "listening: {list}",
     preview_top: "top: {list}",
     preview_none: "not visible",
+    preview_col_check: "check",
+    preview_col_value: "value",
+    preview_col_bind: "bind",
+    preview_col_port: "port",
+    preview_col_proc: "process",
+    preview_col_cpu: "CPU",
+    preview_col_rss: "RSS",
+    preview_row_host: "host",
+    preview_row_load: "load",
+    preview_row_ram: "RAM",
+    preview_row_disk: "disk",
+    preview_row_grade: "grade",
+    preview_row_fw: "firewall",
+    preview_row_ban: "fail2ban",
+    preview_row_upd: "updates",
+    preview_row_sync: "time",
+    preview_row_ssh: "SSH",
     preview_guard: "guard: firewall {fw} · {ban} · unattended-upgrades {upd} · time {sync} · SSH {ssh} · grade {grade}",
     preview_fw_no: "none",
     preview_ban_no: "no fail2ban",
@@ -72,10 +102,11 @@ const STR = {
     preview_limited: "limited: cannot see which process owns the ports",
     help: `Orb44 satellite — admin device.
 
-  orb44 login [--url http://127.0.0.1:8787] [--daemon] [--lang en|ru|ko|es]
+  orb44 login [--url http://127.0.0.1:8787] [--daemon] [--force] [--lang en|ru|ko|es]
   orb44 pulse
   orb44 daemon [--interval 300]
   orb44 install [--system] [--interval 300]
+  orb44 uninstall [--purge]
   orb44 lang [en|ru|ko|es]
   orb44 status
   orb44 logout
@@ -86,7 +117,7 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
   },
   ru: {
     banner_title: "Orb44 сателлит",
-    banner_sub: "Ключ устройства — только пульс, не шелл. Советы приходят ответом, команды выполняете вы.",
+    banner_sub: "Анализ хоста изнутри: нагрузка, слушатели, hardening.",
     lang_pick: "Language  ·  Язык  ·  언어  ·  Idioma",
     lang_saved: "Язык сохранён: {label}",
     lang_now: "Язык консоли: {label}  (--lang en|ru|ko|es)",
@@ -110,6 +141,7 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     daemon_run: "демон каждые {sec}с · {host}",
     daemon_revoked: "ключ отозван",
     unit_written: "unit {path}",
+    cli_link: "command {path}",
     daemon_on: "демон включён: пульс в фоне, поднимается после перезагрузки.",
     login_done: "Готово. Эту сессию можно закрыть — демон уже в фоне.",
     daemon_user: "пользователь службы {user} · ключ {file}",
@@ -120,6 +152,18 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     not_paired: "Не связано. orb44 login",
     now_on_box: "Сейчас на машине",
     logged_out: "Отключено. В кабинете устройство снято.",
+    uninstall_ok: "Демон остановлен, unit снят. Ключ пары оставлен.",
+    uninstall_purged: "Демон, ключ и пользователь orb44 сняты. В кабинете устройство отозвано.",
+    uninstall_key_kept: "Ключ на месте: {file}. Потом: npx @orb44/cli install",
+    already_title: "На этой машине уже стоит",
+    already_host: "{host}  ({name})",
+    already_key: "ключ {file}",
+    already_daemon: "Демон Watch уже работает",
+    already_unit: "systemd unit уже установлен",
+    already_keep: "Оставить — не логиниться заново",
+    already_replace: "Заменить — новый login, старое устройство отзовётся",
+    already_kept: "Оставили как есть. Пульс ушёл. В кабинете то же устройство.",
+    already_no_key: "Демон работает, но этот пользователь не читает ключ. Попробуйте: sudo orb44 status",
     advice_title: "Что сделать на этой машине",
     advice_sub: "Кабинет это не выполнит — иначе утечка ключа была бы удалённым шеллом.",
     preview_host: "хост {h}",
@@ -127,6 +171,23 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     preview_listen: "слушает: {list}",
     preview_top: "топ: {list}",
     preview_none: "не видно",
+    preview_col_check: "проверка",
+    preview_col_value: "значение",
+    preview_col_bind: "адрес",
+    preview_col_port: "порт",
+    preview_col_proc: "процесс",
+    preview_col_cpu: "CPU",
+    preview_col_rss: "RSS",
+    preview_row_host: "хост",
+    preview_row_load: "load",
+    preview_row_ram: "RAM",
+    preview_row_disk: "диск",
+    preview_row_grade: "грейд",
+    preview_row_fw: "файрвол",
+    preview_row_ban: "fail2ban",
+    preview_row_upd: "обновления",
+    preview_row_sync: "время",
+    preview_row_ssh: "SSH",
     preview_guard: "защита: файрвол {fw} · {ban} · автообновления {upd} · время {sync} · SSH {ssh} · грейд {grade}",
     preview_fw_no: "нет",
     preview_ban_no: "fail2ban нет",
@@ -137,10 +198,11 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     preview_limited: "ограничено: не видно, какой процесс слушает порты",
     help: `Orb44 сателлит — устройство админа.
 
-  orb44 login [--url http://127.0.0.1:8787] [--daemon] [--lang en|ru|ko|es]
+  orb44 login [--url http://127.0.0.1:8787] [--daemon] [--force] [--lang en|ru|ko|es]
   orb44 pulse
   orb44 daemon [--interval 300]
   orb44 install [--system] [--interval 300]
+  orb44 uninstall [--purge]
   orb44 lang [en|ru|ko|es]
   orb44 status
   orb44 logout
@@ -151,7 +213,7 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
   },
   ko: {
     banner_title: "Orb44 위성",
-    banner_sub: "장치 키는 펄스만입니다. 셸이 아닙니다. 조언은 펄스 응답으로 오고, 명령은 직접 실행합니다.",
+    banner_sub: "이 호스트를 안에서 분석합니다: 부하, 리스너, hardening.",
     lang_pick: "Language  ·  Язык  ·  언어  ·  Idioma",
     lang_saved: "언어 저장됨: {label}",
     lang_now: "CLI 언어: {label}  (--lang en|ru|ko|es)",
@@ -175,6 +237,7 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     daemon_run: "데몬 {sec}초마다 · {host}",
     daemon_revoked: "키 취소됨",
     unit_written: "unit {path}",
+    cli_link: "command {path}",
     daemon_on: "데몬이 켜졌습니다: 백그라운드 펄스, 재부팅 후에도 올라옵니다.",
     login_done: "끝났습니다. 이 세션을 닫아도 됩니다 — 데몬은 이미 백그라운드에 있습니다.",
     daemon_user: "서비스 사용자 {user} · 키 {file}",
@@ -185,6 +248,18 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     not_paired: "연결되지 않음. orb44 login",
     now_on_box: "지금 이 기기",
     logged_out: "해제됨. 콘솔에서 장치가 제거되었습니다.",
+    uninstall_ok: "데몬을 멈추고 unit을 제거했습니다. 페어링 키는 남겼습니다.",
+    uninstall_purged: "데몬, 키, 사용자 orb44를 제거했습니다. 콘솔에서 장치를 취소했습니다.",
+    uninstall_key_kept: "키는 그대로입니다: {file}. 나중에: npx @orb44/cli install",
+    already_title: "이 기기에 이미 있습니다",
+    already_host: "{host}  ({name})",
+    already_key: "키 {file}",
+    already_daemon: "Watch 데몬이 이미 실행 중입니다",
+    already_unit: "systemd unit이 이미 설치되어 있습니다",
+    already_keep: "유지 — 다시 페어링하지 않음",
+    already_replace: "교체 — 새 login, 이전 장치는 취소됨",
+    already_kept: "그대로 두었습니다. 펄스를 보냈습니다. 콘솔의 장치는 같습니다.",
+    already_no_key: "데몬은 켜져 있지만 이 사용자는 키를 읽지 못합니다. sudo orb44 status",
     advice_title: "이 기기에서 할 일",
     advice_sub: "콘솔은 실행하지 않습니다. 키 유출이 원격 셸이 되면 안 됩니다.",
     preview_host: "호스트 {h}",
@@ -192,6 +267,23 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     preview_listen: "수신: {list}",
     preview_top: "top: {list}",
     preview_none: "없음",
+    preview_col_check: "항목",
+    preview_col_value: "값",
+    preview_col_bind: "주소",
+    preview_col_port: "포트",
+    preview_col_proc: "프로세스",
+    preview_col_cpu: "CPU",
+    preview_col_rss: "RSS",
+    preview_row_host: "호스트",
+    preview_row_load: "load",
+    preview_row_ram: "RAM",
+    preview_row_disk: "디스크",
+    preview_row_grade: "등급",
+    preview_row_fw: "방화벽",
+    preview_row_ban: "fail2ban",
+    preview_row_upd: "업데이트",
+    preview_row_sync: "시간",
+    preview_row_ssh: "SSH",
     preview_guard: "보호: 방화벽 {fw} · {ban} · 자동업데이트 {upd} · 시간 {sync} · SSH {ssh} · 등급 {grade}",
     preview_fw_no: "없음",
     preview_ban_no: "fail2ban 없음",
@@ -202,10 +294,11 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     preview_limited: "제한: 포트를 연 프로세스를 볼 수 없음",
     help: `Orb44 위성 — 관리자 장치.
 
-  orb44 login [--url http://127.0.0.1:8787] [--daemon] [--lang en|ru|ko|es]
+  orb44 login [--url http://127.0.0.1:8787] [--daemon] [--force] [--lang en|ru|ko|es]
   orb44 pulse
   orb44 daemon [--interval 300]
   orb44 install [--system] [--interval 300]
+  orb44 uninstall [--purge]
   orb44 lang [en|ru|ko|es]
   orb44 status
   orb44 logout
@@ -216,7 +309,7 @@ login에서 언어를 묻고 저장한 뒤, 데몬은 기본값 아니오입니
   },
   es: {
     banner_title: "Satélite Orb44",
-    banner_sub: "La clave del dispositivo es solo pulso, no un shell. Los consejos vuelven en la respuesta; las órdenes las ejecuta usted.",
+    banner_sub: "Análisis del host desde dentro: carga, listeners, hardening.",
     lang_pick: "Language  ·  Язык  ·  언어  ·  Idioma",
     lang_saved: "Idioma guardado: {label}",
     lang_now: "Idioma de la consola: {label}  (--lang en|ru|ko|es)",
@@ -240,6 +333,7 @@ login에서 언어를 묻고 저장한 뒤, 데몬은 기본값 아니오입니
     daemon_run: "demonio cada {sec}s · {host}",
     daemon_revoked: "clave revocada",
     unit_written: "unit {path}",
+    cli_link: "command {path}",
     daemon_on: "demonio activado: pulso en segundo plano, arranca de nuevo tras el reinicio.",
     login_done: "Listo. Puede cerrar esta sesión: el demonio ya está en segundo plano.",
     daemon_user: "usuario del servicio {user} · clave {file}",
@@ -250,6 +344,18 @@ login에서 언어를 묻고 저장한 뒤, 데몬은 기본값 아니오입니
     not_paired: "Sin vincular. orb44 login",
     now_on_box: "Ahora en la máquina",
     logged_out: "Desconectado. El gabinete quitó el dispositivo.",
+    uninstall_ok: "Demonio parado y unit quitado. Se guarda la clave de emparejamiento.",
+    uninstall_purged: "Demonio, clave y usuario orb44 eliminados. El gabinete revocó el dispositivo.",
+    uninstall_key_kept: "La clave sigue en {file}. Luego: npx @orb44/cli install",
+    already_title: "Ya está en esta máquina",
+    already_host: "{host}  ({name})",
+    already_key: "clave {file}",
+    already_daemon: "El demonio Watch ya está en marcha",
+    already_unit: "El unit systemd ya está instalado",
+    already_keep: "Dejar — no volver a emparejar",
+    already_replace: "Sustituir — login nuevo, se revoca el dispositivo anterior",
+    already_kept: "Se dejó igual. Pulso enviado. El mismo dispositivo en el gabinete.",
+    already_no_key: "El demonio está activo, pero este usuario no lee la clave. Pruebe: sudo orb44 status",
     advice_title: "Qué hacer en esta máquina",
     advice_sub: "El gabinete no lo ejecutará: una clave filtrada no debe ser un shell remoto.",
     preview_host: "host {h}",
@@ -257,6 +363,23 @@ login에서 언어를 묻고 저장한 뒤, 데몬은 기본값 아니오입니
     preview_listen: "escucha: {list}",
     preview_top: "top: {list}",
     preview_none: "no se ve",
+    preview_col_check: "dato",
+    preview_col_value: "valor",
+    preview_col_bind: "bind",
+    preview_col_port: "puerto",
+    preview_col_proc: "proceso",
+    preview_col_cpu: "CPU",
+    preview_col_rss: "RSS",
+    preview_row_host: "host",
+    preview_row_load: "load",
+    preview_row_ram: "RAM",
+    preview_row_disk: "disco",
+    preview_row_grade: "grado",
+    preview_row_fw: "cortafuegos",
+    preview_row_ban: "fail2ban",
+    preview_row_upd: "updates",
+    preview_row_sync: "hora",
+    preview_row_ssh: "SSH",
     preview_guard: "defensa: cortafuegos {fw} · {ban} · actualizaciones {upd} · hora {sync} · SSH {ssh} · grado {grade}",
     preview_fw_no: "no",
     preview_ban_no: "sin fail2ban",
@@ -267,10 +390,11 @@ login에서 언어를 묻고 저장한 뒤, 데몬은 기본값 아니오입니
     preview_limited: "limitado: no se ve qué proceso tiene los puertos",
     help: `Satélite Orb44 — dispositivo de admin.
 
-  orb44 login [--url http://127.0.0.1:8787] [--daemon] [--lang en|ru|ko|es]
+  orb44 login [--url http://127.0.0.1:8787] [--daemon] [--force] [--lang en|ru|ko|es]
   orb44 pulse
   orb44 daemon [--interval 300]
   orb44 install [--system] [--interval 300]
+  orb44 uninstall [--purge]
   orb44 lang [en|ru|ko|es]
   orb44 status
   orb44 logout

package/server/sat-local.mjs

@@ -0,0 +1,46 @@
+export const SYSTEM_DEVICE = "/var/lib/orb44/device.json";
+
+export function parseDeviceJson(raw, filePath) {
+  try {
+    const row = JSON.parse(raw);
+    if (!row?.secret) return null;
+    return { ...row, path: filePath };
+  } catch {
+    return null;
+  }
+}
+
+export function deviceSearchPaths(homeFile, systemdPath = SYSTEM_DEVICE) {
+  return [...new Set([homeFile, systemdPath].filter(Boolean))];
+}
+
+export function loadFirstDevice(readFile, paths) {
+  for (const p of paths) {
+    try {
+      const row = parseDeviceJson(readFile(p), p);
+      if (row) return row;
+    } catch {
+      /* missing or unreadable */
+    }
+  }
+  return null;
+}
+
+export function stripDevicePath(row) {
+  if (!row) return null;
+  const { path: _p, ...rest } = row;
+  return rest;
+}
+
+export function hasExistingInstall({ devices = [], daemon = false, unit = false } = {}) {
+  return Boolean((devices && devices.length) || daemon || unit);
+}
+
+export function pickLiveDevice(devices, { daemon = false, systemdPath = SYSTEM_DEVICE } = {}) {
+  const list = Array.isArray(devices) ? devices.filter((d) => d?.secret) : [];
+  if (daemon) {
+    const sys = list.find((d) => d.path === systemdPath);
+    if (sys) return sys;
+  }
+  return list[0] || null;
+}