@orb44/cli 0.1.1 → 0.1.5

package/README.md

@@ -13,10 +13,13 @@ npx @orb44/cli login --url https://orb44.com
 Open the printed link in a browser where you are already signed in, confirm the domain, then optionally install the systemd daemon (default no). After a global install the command is `orb44`.
 
 ```bash
-npx @orb44/cli status
-npx @orb44/cli pulse
-npx @orb44/cli install     # later: background pulse, starts after reboot
-npx @orb44/cli logout
+npx @orb44/cli@0.1.5 status
+npx @orb44/cli@0.1.5 pulse
+npx @orb44/cli@0.1.5 install     # later: background pulse, starts after reboot
+orb44 update                     # after install: replace /usr/lib/orb44-sat from npm
+npx @orb44/cli@0.1.5 logout
 ```
 
+Do not run bare `npx @orb44/cli` — it can reuse an old cache. Pin the version or use `orb44` after install.
+
 Device key: `~/.config/orb44/device.json` (mode 0600). Not a shell token.

package/bin/orb44.mjs

@@ -8,6 +8,8 @@ import { stdin as input, stdout as output } from "node:process";
 import { collectPulse, formatPulsePreview } from "../server/pulse.mjs";
 import { LANGS, LANG_LABEL, detectLang, normalizeLang, t } from "../server/sat-i18n.mjs";
 import { pickFromList } from "../server/cli-menu.mjs";
+import { SYSTEM_DEVICE, parseDeviceJson, hasExistingInstall, pickLiveDevice, deviceSearchPaths, loadFirstDevice, stripDevicePath } from "../server/sat-local.mjs";
+import { CLI_PACKAGE, cmpVer, readCliVersion, pickSatRoots, applyUpdateTree, fetchLatestMeta, unpackTarball } from "../server/sat-update.mjs";
 
 const DEVICE_FILE = process.env.ORB44_DEVICE_FILE || path.join(os.homedir(), ".config", "orb44", "device.json");
 const CLI_FILE = process.env.ORB44_CLI_FILE || path.join(path.dirname(DEVICE_FILE), "cli.json");
@@ -21,6 +23,8 @@ function args() {
     if (a === "--yes" || a === "-y") out.yes = true;
     else if (a === "--system") out.system = true;
     else if (a === "--daemon") out.daemon = true;
+    else if (a === "--force") out.force = true;
+    else if (a === "--purge") out.purge = true;
     else if (a === "--url" || a === "--code" || a === "--name" || a === "--interval" || a === "--lang") {
       out[a.slice(2)] = argv[++i];
     } else if (!a.startsWith("-")) out._.push(a);
@@ -57,12 +61,12 @@ function storedOrFlag(opts) {
   return normalizeLang(opts.lang) || storedLang() || detectLang();
 }
 
+function loadDeviceRecord() {
+  return loadFirstDevice((p) => fs.readFileSync(p, "utf8"), deviceSearchPaths(DEVICE_FILE));
+}
+
 function loadDevice() {
-  try {
-    return JSON.parse(fs.readFileSync(DEVICE_FILE, "utf8"));
-  } catch {
-    return null;
-  }
+  return stripDevicePath(loadDeviceRecord());
 }
 
 function saveDevice(row) {
@@ -180,14 +184,90 @@ async function sendPulse(device, { preview = true } = {}) {
   return { out, pulse };
 }
 
+async function wantReplace(found, opts) {
+  if (opts.force) return true;
+  if (opts.yes || !input.isTTY || !output.isTTY) return false;
+  const lines = [t(lang, "already_title")];
+  for (const d of found.devices) {
+    lines.push(t(lang, "already_host", { host: d.host || "—", name: d.name || "—" }));
+    lines.push(t(lang, "already_key", { file: d.path }));
+  }
+  if (found.daemon) lines.push(t(lang, "already_daemon"));
+  else if (found.unit) lines.push(t(lang, "already_unit"));
+  const idx = await pickFromList({
+    title: lines.join("\n"),
+    items: [t(lang, "already_keep"), t(lang, "already_replace")],
+    index: 0,
+    hint: "↑↓  Enter",
+    stdin: input,
+    stdout: output,
+  });
+  return idx === 1;
+}
+
+function existingOnBox() {
+  const paths = [...new Set([DEVICE_FILE, SYSTEM_DEVICE])];
+  const devices = [];
+  for (const p of paths) {
+    try {
+      const row = parseDeviceJson(fs.readFileSync(p, "utf8"), p);
+      if (row) devices.push(row);
+    } catch {
+      /* missing or unreadable */
+    }
+  }
+  const unit =
+    fs.existsSync("/etc/systemd/system/orb44-satellite.service") ||
+    fs.existsSync(path.join(os.homedir(), ".config", "systemd", "user", "orb44-satellite.service"));
+  let daemon = false;
+  try {
+    daemon = serviceIsActive(true) || serviceIsActive(false);
+  } catch {
+    daemon = false;
+  }
+  return { devices, daemon, unit };
+}
+
+async function revokeLocalDevices(devices, fallbackApi) {
+  for (const d of devices) {
+    const apiBase = d.api || fallbackApi;
+    if (!apiBase || !d.secret) continue;
+    await api(apiBase, "/api/satellites/logout", { method: "POST", json: { secret: d.secret } }).catch(() => {});
+  }
+  clearDevice();
+  if (SYSTEM_DEVICE !== DEVICE_FILE) {
+    try {
+      fs.unlinkSync(SYSTEM_DEVICE);
+    } catch {
+      /* missing */
+    }
+  }
+}
+
 async function cmdLogin(opts) {
   await ensureLang(opts);
   banner();
   const url = String(opts.url || process.env.ORB44_API || "http://127.0.0.1:8787").replace(/\/$/, "");
-  const prev = loadDevice();
-  if (prev?.secret) {
-    await api(prev.api, "/api/satellites/logout", { method: "POST", json: { secret: prev.secret } }).catch(() => {});
-    clearDevice();
+  const found = existingOnBox();
+  if (hasExistingInstall(found)) {
+    const replace = await wantReplace(found, opts);
+    if (!replace) {
+      const live = pickLiveDevice(found.devices, { daemon: found.daemon });
+      if (!live?.secret) {
+        console.log(t(lang, "already_no_key"));
+        process.exit(0);
+      }
+      const { out } = await sendPulse(live);
+      if (!out.ok) {
+        console.error(`⚠️  ${out.body.error || t(lang, "pulse_fail")}`);
+        process.exit(1);
+      }
+      console.log("\n📡  " + t(lang, "pulse_ok"));
+      printAdvice(out.body?.notes);
+      console.log(dim("\n" + t(lang, "already_kept")));
+      process.exit(0);
+    }
+    await revokeLocalDevices(found.devices, url);
   }
   const hostname = os.hostname();
   const name = opts.name || hostname;
@@ -336,24 +416,26 @@ function systemdUnit({ node, script, deviceFile, interval, user }) {
   return `${lines.join("\n")}\n`;
 }
 
-function satServerDir() {
-  return path.join(path.dirname(SCRIPT), "..", "server");
+const CLI_LINK = "/usr/local/bin/orb44";
+
+function linkSystemCli(node, script) {
+  const body = `#!/bin/sh\nexec ${quote(node)} ${quote(script)} "$@"\n`;
+  fs.writeFileSync(CLI_LINK, body, { mode: 0o755 });
 }
 
 function installSystemTree() {
   const lib = "/usr/lib/orb44-sat";
-  const serverSrc = satServerDir();
+  const srcRoot = path.join(path.dirname(SCRIPT), "..");
   fs.mkdirSync(path.join(lib, "bin"), { recursive: true, mode: 0o755 });
   fs.mkdirSync(path.join(lib, "server"), { recursive: true, mode: 0o755 });
-  const copies = [
-    [SCRIPT, path.join(lib, "bin", "orb44.mjs")],
-    [path.join(serverSrc, "pulse.mjs"), path.join(lib, "server", "pulse.mjs")],
-    [path.join(serverSrc, "sat-i18n.mjs"), path.join(lib, "server", "sat-i18n.mjs")],
-    [path.join(serverSrc, "cli-menu.mjs"), path.join(lib, "server", "cli-menu.mjs")],
-  ];
-  for (const [from, to] of copies) {
-    fs.copyFileSync(from, to);
-    fs.chmodSync(to, 0o644);
+  applyUpdateTree(srcRoot, lib);
+  const ver = readCliVersion(SCRIPT);
+  if (ver && ver !== "0.0.0") {
+    fs.writeFileSync(
+      path.join(lib, "package.json"),
+      JSON.stringify({ name: CLI_PACKAGE, version: ver, type: "module", private: true }, null, 2) + "\n",
+      { mode: 0o644 }
+    );
   }
   return path.join(lib, "bin", "orb44.mjs");
 }
@@ -377,7 +459,9 @@ function ensureSystemServiceAccount(srcDeviceFile) {
     }
   }
   fs.mkdirSync(home, { recursive: true, mode: 0o750 });
-  fs.copyFileSync(srcDeviceFile, dest);
+  if (path.resolve(srcDeviceFile) !== path.resolve(dest)) {
+    fs.copyFileSync(srcDeviceFile, dest);
+  }
   fs.chmodSync(dest, 0o600);
   const chown = spawnSync("chown", ["-R", "orb44:orb44", home], { encoding: "utf8" });
   if (chown.status !== 0) {
@@ -429,18 +513,22 @@ function tryEnable(asSystem) {
 
 function cmdInstall(opts, { enable = false } = {}) {
   applyLang(opts);
-  const device = loadDevice();
-  if (!device?.secret) {
+  const rec = loadDeviceRecord();
+  if (!rec?.secret) {
     console.error("⚠️  " + t(lang, "need_login"));
     process.exit(1);
   }
+  const srcPath = rec.path || DEVICE_FILE;
+  const device = stripDevicePath(rec);
+  if (opts.url) device.api = String(opts.url).replace(/\/$/, "");
+  if (srcPath !== DEVICE_FILE) saveDevice(device);
   const asSystem = Boolean(opts.system) || process.getuid?.() === 0;
   const interval = intervalSec(opts.interval);
   let deviceFile = DEVICE_FILE;
   let user = null;
   let script = SCRIPT;
   if (asSystem) {
-    const acct = ensureSystemServiceAccount(DEVICE_FILE);
+    const acct = ensureSystemServiceAccount(srcPath);
     if (acct.ok) {
       deviceFile = acct.deviceFile;
       user = acct.user;
@@ -463,6 +551,14 @@ function cmdInstall(opts, { enable = false } = {}) {
   fs.mkdirSync(path.dirname(unitPath), { recursive: true });
   fs.writeFileSync(unitPath, unit, { mode: 0o644 });
   console.log("⚙️  " + t(lang, "unit_written", { path: unitPath }));
+  if (asSystem) {
+    try {
+      linkSystemCli(process.execPath, script);
+      console.log(dim(t(lang, "cli_link", { path: CLI_LINK })));
+    } catch {
+      /* /usr/local/bin missing */
+    }
+  }
   if (enable) {
     const on = tryEnable(asSystem);
     if (on.ok) {
@@ -482,6 +578,119 @@ function cmdInstall(opts, { enable = false } = {}) {
   return false;
 }
 
+function tryDisable(asSystem) {
+  const args = asSystem
+    ? [
+        ["disable", "--now", "orb44-satellite"],
+        ["daemon-reload"],
+      ]
+    : [
+        ["--user", "disable", "--now", "orb44-satellite"],
+        ["--user", "daemon-reload"],
+      ];
+  for (const a of args) {
+    spawnSync("systemctl", a, { encoding: "utf8" });
+  }
+}
+
+function rmTree(p) {
+  try {
+    fs.rmSync(p, { recursive: true, force: true });
+  } catch {
+    /* missing */
+  }
+}
+
+async function cmdUninstall(opts) {
+  applyLang(opts);
+  const asSystem = Boolean(opts.system) || process.getuid?.() === 0;
+  tryDisable(asSystem);
+  tryDisable(!asSystem);
+  const unitPaths = [
+    "/etc/systemd/system/orb44-satellite.service",
+    path.join(os.homedir(), ".config", "systemd", "user", "orb44-satellite.service"),
+  ];
+  for (const p of unitPaths) {
+    try {
+      fs.unlinkSync(p);
+    } catch {
+      /* missing */
+    }
+  }
+  rmTree("/usr/lib/orb44-sat");
+  try {
+    fs.unlinkSync(CLI_LINK);
+  } catch {
+    /* missing */
+  }
+  if (opts.purge) {
+    const found = existingOnBox();
+    await revokeLocalDevices(found.devices, found.devices[0]?.api);
+    rmTree("/var/lib/orb44");
+    spawnSync("userdel", ["orb44"], { encoding: "utf8" });
+    console.log("✅  " + t(lang, "uninstall_purged"));
+    return;
+  }
+  console.log("✅  " + t(lang, "uninstall_ok"));
+  console.log(dim(t(lang, "uninstall_key_kept", { file: SYSTEM_DEVICE })));
+}
+
+async function cmdUpdate() {
+  applyLang(opts);
+  const current = readCliVersion(SCRIPT);
+  let meta;
+  try {
+    meta = await fetchLatestMeta();
+  } catch (e) {
+    console.error("⚠️  " + t(lang, "update_fail", { err: `: ${String(e.message || e).slice(0, 160)}` }));
+    process.exit(1);
+  }
+  const pin = t(lang, "update_npx", { version: meta.version });
+  if (cmpVer(current, meta.version) >= 0 && !opts.force) {
+    console.log("✅  " + t(lang, "update_same", { version: current }));
+    console.log(dim(pin));
+    return;
+  }
+  const roots = pickSatRoots(SCRIPT);
+  if (!roots.length) {
+    console.error("⚠️  " + t(lang, "update_no_tree"));
+    console.log(dim(pin));
+    process.exit(1);
+  }
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "orb44-upd-"));
+  let wrote = [];
+  try {
+    const pkg = await unpackTarball(meta.tarball, tmp);
+    const blocked = [];
+    for (const root of roots) {
+      try {
+        applyUpdateTree(pkg, root);
+        wrote.push(root);
+      } catch (e) {
+        blocked.push({ root, err: String(e.message || e).slice(0, 160) });
+      }
+    }
+    if (!wrote.length) {
+      console.error("⚠️  " + t(lang, blocked.some((b) => /EACCES|permission/i.test(b.err)) ? "update_need_root" : "update_fail", { err: blocked[0]?.err ? `: ${blocked[0].err}` : "" }));
+      process.exit(1);
+    }
+  } finally {
+    try {
+      fs.rmSync(tmp, { recursive: true, force: true });
+    } catch {
+      /* tmp */
+    }
+  }
+  for (const root of wrote) {
+    console.log("✅  " + t(lang, "update_wrote", { version: meta.version, path: root }));
+  }
+  if (wrote.includes("/usr/lib/orb44-sat") && serviceIsActive(true)) {
+    spawnSync("systemctl", ["try-restart", "orb44-satellite"], { encoding: "utf8" });
+    console.log(dim(t(lang, "update_restarted")));
+  }
+  console.log(dim(pin));
+}
+
 function cmdStatus() {
   applyLang(opts);
   const device = loadDevice();
@@ -548,7 +757,9 @@ const run = {
   pulse: cmdPulse,
   daemon: () => cmdDaemon(opts),
   install: () => cmdInstall(opts, { enable: true }),
+  uninstall: () => cmdUninstall(opts),
   status: cmdStatus,
+  update: cmdUpdate,
   logout: cmdLogout,
   lang: () => cmdLang(opts),
   help,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orb44/cli",
-  "version": "0.1.1",
+  "version": "0.1.5",
   "description": "Orb44: street snapshot of your site. This CLI is the Watch satellite — pulse from the host (load, listeners, hardening). The cabinet does not run commands on the machine.",
   "type": "module",
   "bin": {
@@ -10,7 +10,9 @@
     "bin/orb44.mjs",
     "server/pulse.mjs",
     "server/sat-i18n.mjs",
-    "server/cli-menu.mjs"
+    "server/cli-menu.mjs",
+    "server/sat-local.mjs",
+    "server/sat-update.mjs"
   ],
   "engines": {
     "node": ">=18"

package/server/pulse.mjs

@@ -174,11 +174,32 @@ function topTable() {
 
 function okListenAddr(a) {
   const s = String(a || "");
-  if (s === "0.0.0.0" || s === "::" || s === "::1") return true;
+  if (s === "0.0.0.0" || s === "::" || s === "::1" || s === "*") return true;
   if (/^\d{1,3}(\.\d{1,3}){3}$/.test(s)) return true;
   return /^[0-9a-fA-F:]+$/.test(s) && s.includes(":");
 }
 
+export function collapseListen(rows = []) {
+  const groups = new Map();
+  for (const r of rows) {
+    const key = `${Number(r.port)}|${r.comm || ""}`;
+    if (!groups.has(key)) groups.set(key, []);
+    groups.get(key).push(r);
+  }
+  const out = [];
+  for (const list of groups.values()) {
+    const addrs = new Set(list.map((x) => x.addr));
+    const rest = list.filter((x) => x.addr !== "0.0.0.0" && x.addr !== "::" && x.addr !== "*");
+    if (addrs.has("*") || (addrs.has("0.0.0.0") && addrs.has("::"))) {
+      out.push({ addr: "*", port: list[0].port, comm: list[0].comm });
+      out.push(...rest);
+    } else {
+      out.push(...list);
+    }
+  }
+  return out;
+}
+
 export function sanitizePulse(raw = {}) {
   const top = Array.isArray(raw.top)
     ? raw.top
@@ -190,16 +211,18 @@ export function sanitizePulse(raw = {}) {
         }))
         .filter((r) => r.comm)
     : [];
-  const listen = Array.isArray(raw.listen)
-    ? raw.listen
-        .slice(0, 40)
-        .map((r) => ({
-          addr: String(r.addr || "").slice(0, 45),
-          port: Number(r.port) || 0,
-          comm: sanitizeComm(r.comm),
-        }))
-        .filter((r) => r.port > 0 && r.port < 65536 && okListenAddr(r.addr))
-    : [];
+  const listen = collapseListen(
+    Array.isArray(raw.listen)
+      ? raw.listen
+          .slice(0, 40)
+          .map((r) => ({
+            addr: String(r.addr || "").slice(0, 45),
+            port: Number(r.port) || 0,
+            comm: sanitizeComm(r.comm),
+          }))
+          .filter((r) => r.port > 0 && r.port < 65536 && okListenAddr(r.addr))
+      : []
+  );
   const originA = Array.isArray(raw.originA)
     ? raw.originA.map((x) => String(x || "")).filter((x) => /^\d{1,3}(\.\d{1,3}){3}$/.test(x)).slice(0, 8)
     : [];
@@ -672,33 +695,71 @@ export function collectPulse() {
   });
 }
 
+function clip(s, n) {
+  const t = String(s ?? "");
+  if (t.length <= n) return t;
+  return `${t.slice(0, Math.max(1, n - 1))}…`;
+}
+
+function asciiTable(headers, rows) {
+  const cells = [headers, ...rows].map((r) => r.map((c) => String(c ?? "")));
+  const widths = headers.map((_, i) => Math.max(1, ...cells.map((r) => [...(r[i] || "")].length)));
+  const fill = (ch) => widths.map((w) => ch.repeat(w + 2)).join("┼");
+  const line = (row) =>
+    "│ " +
+    row
+      .map((c, i) => {
+        const s = clip(c, widths[i]);
+        return s + " ".repeat(Math.max(0, widths[i] - [...s].length));
+      })
+      .join(" │ ") +
+    " │";
+  return [`┌${fill("─").replaceAll("┼", "┬")}┐`, line(headers), `├${fill("─")}┤`, ...rows.map(line), `└${fill("─").replaceAll("┼", "┴")}┘`].join("\n");
+}
+
 export function formatPulsePreview(pulse, lang = "en") {
   const gb = (n) => (Number(n) / 1024 / 1024 / 1024).toFixed(1);
   const none = t(lang, "preview_none");
-  const lines = [
-    t(lang, "preview_host", { h: pulse.hostname || "—" }),
-    t(lang, "preview_load", { load: pulse.load1, used: gb(pulse.memUsed), total: gb(pulse.memTotal), disk: pulse.diskUsedPct ?? "—" }),
-    t(lang, "preview_listen", {
-      list: (pulse.listen || []).slice(0, 12).map((r) => `${r.addr}:${r.port}${r.comm ? ` ${r.comm}` : ""}`).join(", ") || none,
-    }),
-    t(lang, "preview_top", {
-      list: (pulse.top || []).slice(0, 5).map((r) => `${r.comm} ${r.cpuPct}% ${r.rssMb}M`).join(", ") || none,
-    }),
-  ];
-  const h = pulse.hardening;
-  if (h) {
-    const ssh = h.sshPassword ? t(lang, "preview_ssh_pass") : h.sshPassword === false ? t(lang, "preview_ssh_key") : "?";
-    lines.push(
-      t(lang, "preview_guard", {
-        fw: h.firewall || t(lang, "preview_fw_no"),
-        ban: h.fail2ban || t(lang, "preview_ban_no"),
-        upd: h.updates ? t(lang, "preview_yes") : t(lang, "preview_no"),
-        sync: h.timesync || t(lang, "preview_no"),
-        ssh,
-        grade: pulse.gradeInside || "—",
-      })
-    );
-  }
-  if (pulse.limited) lines.push(t(lang, "preview_limited"));
-  return lines.join("\n");
+  const h = pulse.hardening || {};
+  const grade = pulse.gradeInside || gradeInside(pulse) || "—";
+  const ssh = h.sshPassword ? t(lang, "preview_ssh_pass") : h.sshPassword === false ? t(lang, "preview_ssh_key") : "—";
+  const machine = asciiTable(
+    [t(lang, "preview_col_check"), t(lang, "preview_col_value")],
+    [
+      [t(lang, "preview_row_host"), pulse.hostname || "—"],
+      [t(lang, "preview_row_load"), Number(pulse.load1).toFixed(2)],
+      [t(lang, "preview_row_ram"), `${gb(pulse.memUsed)} / ${gb(pulse.memTotal)}`],
+      [t(lang, "preview_row_disk"), `${pulse.diskUsedPct ?? "—"}%`],
+      [t(lang, "preview_row_grade"), grade],
+    ]
+  );
+  const listenRows = collapseListen([...(pulse.listen || [])])
+    .sort((a, b) => {
+      const rank = (addr) =>
+        addr === "0.0.0.0" || addr === "::" || addr === "*" ? 0 : String(addr).startsWith("127.") || addr === "::1" ? 2 : 1;
+      return rank(a.addr) - rank(b.addr) || Number(a.port) - Number(b.port);
+    })
+    .slice(0, 16)
+    .map((r) => [r.addr || "—", String(r.port ?? ""), r.comm || "—"]);
+  const listen = asciiTable(
+    [t(lang, "preview_col_bind"), t(lang, "preview_col_port"), t(lang, "preview_col_proc")],
+    listenRows.length ? listenRows : [[none, "", ""]]
+  );
+  const topRows = (pulse.top || []).slice(0, 6).map((r) => [r.comm || "—", `${r.cpuPct}%`, `${r.rssMb}M`]);
+  const top = asciiTable(
+    [t(lang, "preview_col_proc"), t(lang, "preview_col_cpu"), t(lang, "preview_col_rss")],
+    topRows.length ? topRows : [[none, "", ""]]
+  );
+  const guard = asciiTable(
+    [t(lang, "preview_col_check"), t(lang, "preview_col_value")],
+    [
+      [t(lang, "preview_row_fw"), h.firewall || t(lang, "preview_fw_no")],
+      [t(lang, "preview_row_ban"), h.fail2ban || t(lang, "preview_ban_no")],
+      [t(lang, "preview_row_upd"), h.updates ? t(lang, "preview_yes") : t(lang, "preview_no")],
+      [t(lang, "preview_row_sync"), h.timesync || t(lang, "preview_no")],
+      [t(lang, "preview_row_ssh"), ssh],
+    ]
+  );
+  const extra = pulse.limited ? `\n${t(lang, "preview_limited")}` : "";
+  return `${machine}\n\n${listen}\n\n${top}\n\n${guard}${extra}`;
 }

package/server/sat-i18n.mjs

@@ -21,7 +21,7 @@ export function detectLang(env = process.env) {
 const STR = {
   en: {
     banner_title: "Orb44 satellite",
-    banner_sub: "Device key is pulse only, not a shell. Advice comes back on the pulse; you run commands.",
+    banner_sub: "Inside analysis of this host: load, listeners, hardening.",
     lang_pick: "Language  ·  Язык  ·  언어  ·  Idioma",
     lang_saved: "Language saved: {label}",
     lang_now: "CLI language: {label}  (--lang en|ru|ko|es)",
@@ -45,6 +45,7 @@ const STR = {
     daemon_run: "daemon every {sec}s · {host}",
     daemon_revoked: "key revoked",
     unit_written: "unit {path}",
+    cli_link: "command {path}",
     daemon_on: "daemon enabled: background pulse, starts again after reboot.",
     login_done: "Done. You can close this session — the daemon is already in the background.",
     daemon_user: "service user {user} · key {file}",
@@ -55,6 +56,25 @@ const STR = {
     not_paired: "Not paired. orb44 login",
     now_on_box: "On the machine now",
     logged_out: "Disconnected. Cabinet dropped the device.",
+    uninstall_ok: "Daemon stopped and unit removed. Pairing key kept.",
+    uninstall_purged: "Daemon, key, and service user orb44 removed. Cabinet dropped the device.",
+    uninstall_key_kept: "Key still at {file}. Later: npx @orb44/cli install",
+    already_title: "Already on this machine",
+    already_host: "{host}  ({name})",
+    already_key: "key {file}",
+    already_daemon: "Watch daemon is already running",
+    already_unit: "systemd unit is already installed",
+    already_keep: "Keep — do not pair again",
+    already_replace: "Replace — new login, old device is revoked",
+    already_kept: "Left as is. Pulse sent. Same device in the cabinet.",
+    already_no_key: "Daemon is on, but this user cannot read the key. Try: sudo orb44 status",
+    update_same: "Already {version}.",
+    update_wrote: "Updated to {version} → {path}",
+    update_need_root: "Cannot write the install tree. Run: sudo orb44 update",
+    update_no_tree: "No satellite install to overwrite. After install: sudo orb44 update. Until then pin npx.",
+    update_fail: "Update failed{err}",
+    update_npx: "Do not run bare npx @orb44/cli — pin: npx @orb44/cli@{version}",
+    update_restarted: "Restarted orb44-satellite.",
     advice_title: "What to do on this machine",
     advice_sub: "The cabinet will not run this — a leaked key must not become a remote shell.",
     preview_host: "host {h}",
@@ -62,6 +82,23 @@ const STR = {
     preview_listen: "listening: {list}",
     preview_top: "top: {list}",
     preview_none: "not visible",
+    preview_col_check: "check",
+    preview_col_value: "value",
+    preview_col_bind: "bind",
+    preview_col_port: "port",
+    preview_col_proc: "process",
+    preview_col_cpu: "CPU",
+    preview_col_rss: "RSS",
+    preview_row_host: "host",
+    preview_row_load: "load",
+    preview_row_ram: "RAM",
+    preview_row_disk: "disk",
+    preview_row_grade: "grade",
+    preview_row_fw: "firewall",
+    preview_row_ban: "fail2ban",
+    preview_row_upd: "updates",
+    preview_row_sync: "time",
+    preview_row_ssh: "SSH",
     preview_guard: "guard: firewall {fw} · {ban} · unattended-upgrades {upd} · time {sync} · SSH {ssh} · grade {grade}",
     preview_fw_no: "none",
     preview_ban_no: "no fail2ban",
@@ -72,12 +109,14 @@ const STR = {
     preview_limited: "limited: cannot see which process owns the ports",
     help: `Orb44 satellite — admin device.
 
-  orb44 login [--url http://127.0.0.1:8787] [--daemon] [--lang en|ru|ko|es]
+  orb44 login [--url http://127.0.0.1:8787] [--daemon] [--force] [--lang en|ru|ko|es]
   orb44 pulse
   orb44 daemon [--interval 300]
   orb44 install [--system] [--interval 300]
+  orb44 uninstall [--purge]
   orb44 lang [en|ru|ko|es]
   orb44 status
+  orb44 update
   orb44 logout
 
 Login asks language (saved) then daemon (default no).
@@ -86,7 +125,7 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
   },
   ru: {
     banner_title: "Orb44 сателлит",
-    banner_sub: "Ключ устройства — только пульс, не шелл. Советы приходят ответом, команды выполняете вы.",
+    banner_sub: "Анализ хоста изнутри: нагрузка, слушатели, hardening.",
     lang_pick: "Language  ·  Язык  ·  언어  ·  Idioma",
     lang_saved: "Язык сохранён: {label}",
     lang_now: "Язык консоли: {label}  (--lang en|ru|ko|es)",
@@ -110,6 +149,7 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     daemon_run: "демон каждые {sec}с · {host}",
     daemon_revoked: "ключ отозван",
     unit_written: "unit {path}",
+    cli_link: "command {path}",
     daemon_on: "демон включён: пульс в фоне, поднимается после перезагрузки.",
     login_done: "Готово. Эту сессию можно закрыть — демон уже в фоне.",
     daemon_user: "пользователь службы {user} · ключ {file}",
@@ -120,6 +160,25 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     not_paired: "Не связано. orb44 login",
     now_on_box: "Сейчас на машине",
     logged_out: "Отключено. В кабинете устройство снято.",
+    uninstall_ok: "Демон остановлен, unit снят. Ключ пары оставлен.",
+    uninstall_purged: "Демон, ключ и пользователь orb44 сняты. В кабинете устройство отозвано.",
+    uninstall_key_kept: "Ключ на месте: {file}. Потом: npx @orb44/cli install",
+    already_title: "На этой машине уже стоит",
+    already_host: "{host}  ({name})",
+    already_key: "ключ {file}",
+    already_daemon: "Демон Watch уже работает",
+    already_unit: "systemd unit уже установлен",
+    already_keep: "Оставить — не логиниться заново",
+    already_replace: "Заменить — новый login, старое устройство отзовётся",
+    already_kept: "Оставили как есть. Пульс ушёл. В кабинете то же устройство.",
+    already_no_key: "Демон работает, но этот пользователь не читает ключ. Попробуйте: sudo orb44 status",
+    update_same: "Уже {version}.",
+    update_wrote: "Обновлено до {version} → {path}",
+    update_need_root: "Нельзя записать дерево установки. Запустите: sudo orb44 update",
+    update_no_tree: "Нет дерева сателлита для перезаписи. После install: sudo orb44 update. До этого — pin в npx.",
+    update_fail: "Обновление не вышло{err}",
+    update_npx: "Не вызывайте голый npx @orb44/cli — pin: npx @orb44/cli@{version}",
+    update_restarted: "Демон orb44-satellite перезапущен.",
     advice_title: "Что сделать на этой машине",
     advice_sub: "Кабинет это не выполнит — иначе утечка ключа была бы удалённым шеллом.",
     preview_host: "хост {h}",
@@ -127,6 +186,23 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     preview_listen: "слушает: {list}",
     preview_top: "топ: {list}",
     preview_none: "не видно",
+    preview_col_check: "проверка",
+    preview_col_value: "значение",
+    preview_col_bind: "адрес",
+    preview_col_port: "порт",
+    preview_col_proc: "процесс",
+    preview_col_cpu: "CPU",
+    preview_col_rss: "RSS",
+    preview_row_host: "хост",
+    preview_row_load: "load",
+    preview_row_ram: "RAM",
+    preview_row_disk: "диск",
+    preview_row_grade: "грейд",
+    preview_row_fw: "файрвол",
+    preview_row_ban: "fail2ban",
+    preview_row_upd: "обновления",
+    preview_row_sync: "время",
+    preview_row_ssh: "SSH",
     preview_guard: "защита: файрвол {fw} · {ban} · автообновления {upd} · время {sync} · SSH {ssh} · грейд {grade}",
     preview_fw_no: "нет",
     preview_ban_no: "fail2ban нет",
@@ -137,12 +213,14 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     preview_limited: "ограничено: не видно, какой процесс слушает порты",
     help: `Orb44 сателлит — устройство админа.
 
-  orb44 login [--url http://127.0.0.1:8787] [--daemon] [--lang en|ru|ko|es]
+  orb44 login [--url http://127.0.0.1:8787] [--daemon] [--force] [--lang en|ru|ko|es]
   orb44 pulse
   orb44 daemon [--interval 300]
   orb44 install [--system] [--interval 300]
+  orb44 uninstall [--purge]
   orb44 lang [en|ru|ko|es]
   orb44 status
+  orb44 update
   orb44 logout
 
 После login спрашивает язык (запоминает), затем демон — по умолчанию нет.
@@ -151,7 +229,7 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
   },
   ko: {
     banner_title: "Orb44 위성",
-    banner_sub: "장치 키는 펄스만입니다. 셸이 아닙니다. 조언은 펄스 응답으로 오고, 명령은 직접 실행합니다.",
+    banner_sub: "이 호스트를 안에서 분석합니다: 부하, 리스너, hardening.",
     lang_pick: "Language  ·  Язык  ·  언어  ·  Idioma",
     lang_saved: "언어 저장됨: {label}",
     lang_now: "CLI 언어: {label}  (--lang en|ru|ko|es)",
@@ -175,6 +253,7 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     daemon_run: "데몬 {sec}초마다 · {host}",
     daemon_revoked: "키 취소됨",
     unit_written: "unit {path}",
+    cli_link: "command {path}",
     daemon_on: "데몬이 켜졌습니다: 백그라운드 펄스, 재부팅 후에도 올라옵니다.",
     login_done: "끝났습니다. 이 세션을 닫아도 됩니다 — 데몬은 이미 백그라운드에 있습니다.",
     daemon_user: "서비스 사용자 {user} · 키 {file}",
@@ -185,6 +264,25 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     not_paired: "연결되지 않음. orb44 login",
     now_on_box: "지금 이 기기",
     logged_out: "해제됨. 콘솔에서 장치가 제거되었습니다.",
+    uninstall_ok: "데몬을 멈추고 unit을 제거했습니다. 페어링 키는 남겼습니다.",
+    uninstall_purged: "데몬, 키, 사용자 orb44를 제거했습니다. 콘솔에서 장치를 취소했습니다.",
+    uninstall_key_kept: "키는 그대로입니다: {file}. 나중에: npx @orb44/cli install",
+    already_title: "이 기기에 이미 있습니다",
+    already_host: "{host}  ({name})",
+    already_key: "키 {file}",
+    already_daemon: "Watch 데몬이 이미 실행 중입니다",
+    already_unit: "systemd unit이 이미 설치되어 있습니다",
+    already_keep: "유지 — 다시 페어링하지 않음",
+    already_replace: "교체 — 새 login, 이전 장치는 취소됨",
+    already_kept: "그대로 두었습니다. 펄스를 보냈습니다. 콘솔의 장치는 같습니다.",
+    already_no_key: "데몬은 켜져 있지만 이 사용자는 키를 읽지 못합니다. sudo orb44 status",
+    update_same: "이미 {version}.",
+    update_wrote: "{version}(으)로 갱신 → {path}",
+    update_need_root: "설치 트리를 쓸 수 없습니다. sudo orb44 update",
+    update_no_tree: "덮어쓸 위성 설치가 없습니다. install 후 sudo orb44 update. 그 전에는 npx를 pin 하세요.",
+    update_fail: "업데이트 실패{err}",
+    update_npx: "버전 없는 npx @orb44/cli 는 쓰지 마세요 — pin: npx @orb44/cli@{version}",
+    update_restarted: "orb44-satellite 를 재시작했습니다.",
     advice_title: "이 기기에서 할 일",
     advice_sub: "콘솔은 실행하지 않습니다. 키 유출이 원격 셸이 되면 안 됩니다.",
     preview_host: "호스트 {h}",
@@ -192,6 +290,23 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     preview_listen: "수신: {list}",
     preview_top: "top: {list}",
     preview_none: "없음",
+    preview_col_check: "항목",
+    preview_col_value: "값",
+    preview_col_bind: "주소",
+    preview_col_port: "포트",
+    preview_col_proc: "프로세스",
+    preview_col_cpu: "CPU",
+    preview_col_rss: "RSS",
+    preview_row_host: "호스트",
+    preview_row_load: "load",
+    preview_row_ram: "RAM",
+    preview_row_disk: "디스크",
+    preview_row_grade: "등급",
+    preview_row_fw: "방화벽",
+    preview_row_ban: "fail2ban",
+    preview_row_upd: "업데이트",
+    preview_row_sync: "시간",
+    preview_row_ssh: "SSH",
     preview_guard: "보호: 방화벽 {fw} · {ban} · 자동업데이트 {upd} · 시간 {sync} · SSH {ssh} · 등급 {grade}",
     preview_fw_no: "없음",
     preview_ban_no: "fail2ban 없음",
@@ -202,12 +317,14 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     preview_limited: "제한: 포트를 연 프로세스를 볼 수 없음",
     help: `Orb44 위성 — 관리자 장치.
 
-  orb44 login [--url http://127.0.0.1:8787] [--daemon] [--lang en|ru|ko|es]
+  orb44 login [--url http://127.0.0.1:8787] [--daemon] [--force] [--lang en|ru|ko|es]
   orb44 pulse
   orb44 daemon [--interval 300]
   orb44 install [--system] [--interval 300]
+  orb44 uninstall [--purge]
   orb44 lang [en|ru|ko|es]
   orb44 status
+  orb44 update
   orb44 logout
 
 login에서 언어를 묻고 저장한 뒤, 데몬은 기본값 아니오입니다.
@@ -216,7 +333,7 @@ login에서 언어를 묻고 저장한 뒤, 데몬은 기본값 아니오입니
   },
   es: {
     banner_title: "Satélite Orb44",
-    banner_sub: "La clave del dispositivo es solo pulso, no un shell. Los consejos vuelven en la respuesta; las órdenes las ejecuta usted.",
+    banner_sub: "Análisis del host desde dentro: carga, listeners, hardening.",
     lang_pick: "Language  ·  Язык  ·  언어  ·  Idioma",
     lang_saved: "Idioma guardado: {label}",
     lang_now: "Idioma de la consola: {label}  (--lang en|ru|ko|es)",
@@ -240,6 +357,7 @@ login에서 언어를 묻고 저장한 뒤, 데몬은 기본값 아니오입니
     daemon_run: "demonio cada {sec}s · {host}",
     daemon_revoked: "clave revocada",
     unit_written: "unit {path}",
+    cli_link: "command {path}",
     daemon_on: "demonio activado: pulso en segundo plano, arranca de nuevo tras el reinicio.",
     login_done: "Listo. Puede cerrar esta sesión: el demonio ya está en segundo plano.",
     daemon_user: "usuario del servicio {user} · clave {file}",
@@ -250,6 +368,25 @@ login에서 언어를 묻고 저장한 뒤, 데몬은 기본값 아니오입니
     not_paired: "Sin vincular. orb44 login",
     now_on_box: "Ahora en la máquina",
     logged_out: "Desconectado. El gabinete quitó el dispositivo.",
+    uninstall_ok: "Demonio parado y unit quitado. Se guarda la clave de emparejamiento.",
+    uninstall_purged: "Demonio, clave y usuario orb44 eliminados. El gabinete revocó el dispositivo.",
+    uninstall_key_kept: "La clave sigue en {file}. Luego: npx @orb44/cli install",
+    already_title: "Ya está en esta máquina",
+    already_host: "{host}  ({name})",
+    already_key: "clave {file}",
+    already_daemon: "El demonio Watch ya está en marcha",
+    already_unit: "El unit systemd ya está instalado",
+    already_keep: "Dejar — no volver a emparejar",
+    already_replace: "Sustituir — login nuevo, se revoca el dispositivo anterior",
+    already_kept: "Se dejó igual. Pulso enviado. El mismo dispositivo en el gabinete.",
+    already_no_key: "El demonio está activo, pero este usuario no lee la clave. Pruebe: sudo orb44 status",
+    update_same: "Ya está {version}.",
+    update_wrote: "Actualizado a {version} → {path}",
+    update_need_root: "No se puede escribir el árbol. Ejecute: sudo orb44 update",
+    update_no_tree: "No hay instalación del satélite que sobrescribir. Tras install: sudo orb44 update. Mientras tanto, fije npx.",
+    update_fail: "La actualización falló{err}",
+    update_npx: "No use npx @orb44/cli sin versión — fije: npx @orb44/cli@{version}",
+    update_restarted: "orb44-satellite reiniciado.",
     advice_title: "Qué hacer en esta máquina",
     advice_sub: "El gabinete no lo ejecutará: una clave filtrada no debe ser un shell remoto.",
     preview_host: "host {h}",
@@ -257,6 +394,23 @@ login에서 언어를 묻고 저장한 뒤, 데몬은 기본값 아니오입니
     preview_listen: "escucha: {list}",
     preview_top: "top: {list}",
     preview_none: "no se ve",
+    preview_col_check: "dato",
+    preview_col_value: "valor",
+    preview_col_bind: "bind",
+    preview_col_port: "puerto",
+    preview_col_proc: "proceso",
+    preview_col_cpu: "CPU",
+    preview_col_rss: "RSS",
+    preview_row_host: "host",
+    preview_row_load: "load",
+    preview_row_ram: "RAM",
+    preview_row_disk: "disco",
+    preview_row_grade: "grado",
+    preview_row_fw: "cortafuegos",
+    preview_row_ban: "fail2ban",
+    preview_row_upd: "updates",
+    preview_row_sync: "hora",
+    preview_row_ssh: "SSH",
     preview_guard: "defensa: cortafuegos {fw} · {ban} · actualizaciones {upd} · hora {sync} · SSH {ssh} · grado {grade}",
     preview_fw_no: "no",
     preview_ban_no: "sin fail2ban",
@@ -267,12 +421,14 @@ login에서 언어를 묻고 저장한 뒤, 데몬은 기본값 아니오입니
     preview_limited: "limitado: no se ve qué proceso tiene los puertos",
     help: `Satélite Orb44 — dispositivo de admin.
 
-  orb44 login [--url http://127.0.0.1:8787] [--daemon] [--lang en|ru|ko|es]
+  orb44 login [--url http://127.0.0.1:8787] [--daemon] [--force] [--lang en|ru|ko|es]
   orb44 pulse
   orb44 daemon [--interval 300]
   orb44 install [--system] [--interval 300]
+  orb44 uninstall [--purge]
   orb44 lang [en|ru|ko|es]
   orb44 status
+  orb44 update
   orb44 logout
 
 Login pregunta idioma (lo guarda) y luego demonio (por defecto no).

package/server/sat-local.mjs

@@ -0,0 +1,46 @@
+export const SYSTEM_DEVICE = "/var/lib/orb44/device.json";
+
+export function parseDeviceJson(raw, filePath) {
+  try {
+    const row = JSON.parse(raw);
+    if (!row?.secret) return null;
+    return { ...row, path: filePath };
+  } catch {
+    return null;
+  }
+}
+
+export function deviceSearchPaths(homeFile, systemdPath = SYSTEM_DEVICE) {
+  return [...new Set([homeFile, systemdPath].filter(Boolean))];
+}
+
+export function loadFirstDevice(readFile, paths) {
+  for (const p of paths) {
+    try {
+      const row = parseDeviceJson(readFile(p), p);
+      if (row) return row;
+    } catch {
+      /* missing or unreadable */
+    }
+  }
+  return null;
+}
+
+export function stripDevicePath(row) {
+  if (!row) return null;
+  const { path: _p, ...rest } = row;
+  return rest;
+}
+
+export function hasExistingInstall({ devices = [], daemon = false, unit = false } = {}) {
+  return Boolean((devices && devices.length) || daemon || unit);
+}
+
+export function pickLiveDevice(devices, { daemon = false, systemdPath = SYSTEM_DEVICE } = {}) {
+  const list = Array.isArray(devices) ? devices.filter((d) => d?.secret) : [];
+  if (daemon) {
+    const sys = list.find((d) => d.path === systemdPath);
+    if (sys) return sys;
+  }
+  return list[0] || null;
+}

package/server/sat-update.mjs

@@ -0,0 +1,104 @@
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+
+export const CLI_PACKAGE = "@orb44/cli";
+export const SAT_TREE_FILES = [
+  "bin/orb44.mjs",
+  "server/pulse.mjs",
+  "server/sat-i18n.mjs",
+  "server/cli-menu.mjs",
+  "server/sat-local.mjs",
+  "server/sat-update.mjs",
+  "package.json",
+];
+
+const REGISTRY_LATEST = "https://registry.npmjs.org/@orb44%2fcli/latest";
+
+export function cmpVer(a, b) {
+  const pa = String(a || "0").split(".").map((n) => Number(n) || 0);
+  const pb = String(b || "0").split(".").map((n) => Number(n) || 0);
+  const n = Math.max(pa.length, pb.length);
+  for (let i = 0; i < n; i++) {
+    const d = (pa[i] || 0) - (pb[i] || 0);
+    if (d) return d < 0 ? -1 : 1;
+  }
+  return 0;
+}
+
+export function looksLikeSat(root) {
+  const r = path.resolve(root);
+  if (!fs.existsSync(path.join(r, "bin", "orb44.mjs"))) return false;
+  if (!fs.existsSync(path.join(r, "server", "pulse.mjs"))) return false;
+  if (fs.existsSync(path.join(r, "server", "index.mjs"))) return false;
+  return true;
+}
+
+export function readCliVersion(scriptFile) {
+  const binDir = path.dirname(path.resolve(scriptFile));
+  const root = path.join(binDir, "..");
+  const candidates = [
+    path.join(root, "package.json"),
+    path.join(root, "packages", "orb44", "package.json"),
+  ];
+  for (const p of candidates) {
+    try {
+      const j = JSON.parse(fs.readFileSync(p, "utf8"));
+      if (j.name === CLI_PACKAGE && j.version) return String(j.version);
+    } catch {
+      /* next */
+    }
+  }
+  return "0.0.0";
+}
+
+export function pickSatRoots(scriptFile, { systemLib = "/usr/lib/orb44-sat" } = {}) {
+  const here = path.resolve(path.dirname(scriptFile), "..");
+  const out = [];
+  if (looksLikeSat(here)) out.push(here);
+  const lib = systemLib ? path.resolve(systemLib) : "";
+  if (lib && looksLikeSat(lib) && !out.includes(lib)) out.push(lib);
+  return out;
+}
+
+export function applyUpdateTree(srcPackageDir, destRoot) {
+  const src = path.resolve(srcPackageDir);
+  const dest = path.resolve(destRoot);
+  for (const rel of SAT_TREE_FILES) {
+    const from = path.join(src, rel);
+    if (!fs.existsSync(from)) {
+      if (rel === "package.json") continue;
+      throw new Error(`missing ${rel}`);
+    }
+    const to = path.join(dest, rel);
+    fs.mkdirSync(path.dirname(to), { recursive: true });
+    fs.copyFileSync(from, to);
+    fs.chmodSync(to, rel.endsWith("orb44.mjs") ? 0o755 : 0o644);
+  }
+  return dest;
+}
+
+export async function fetchLatestMeta(fetchFn = fetch) {
+  const r = await fetchFn(REGISTRY_LATEST, { headers: { Accept: "application/json" } });
+  if (!r?.ok) throw new Error(`registry ${r?.status || "fail"}`);
+  const j = await r.json();
+  const version = j?.version;
+  const tarball = j?.dist?.tarball;
+  if (!version || !tarball) throw new Error("registry meta");
+  return { version: String(version), tarball: String(tarball) };
+}
+
+export async function unpackTarball(url, tmp, fetchFn = fetch) {
+  const r = await fetchFn(url);
+  if (!r?.ok) throw new Error(`tarball ${r?.status || "fail"}`);
+  const buf = Buffer.from(await r.arrayBuffer());
+  const tgz = path.join(tmp, "pkg.tgz");
+  fs.writeFileSync(tgz, buf);
+  const unpack = path.join(tmp, "unpack");
+  fs.mkdirSync(unpack, { recursive: true });
+  const tar = spawnSync("tar", ["-xzf", tgz, "-C", unpack], { encoding: "utf8" });
+  if (tar.status !== 0) throw new Error((tar.stderr || tar.stdout || "tar").trim().slice(0, 200));
+  const pkg = path.join(unpack, "package");
+  if (!fs.existsSync(path.join(pkg, "bin", "orb44.mjs"))) throw new Error("bad tarball");
+  return pkg;
+}