@orb44/cli 0.1.10 → 0.1.12

package/README.md

@@ -13,11 +13,11 @@ npx @orb44/cli login --url https://orb44.com
 Open the printed link in a browser where you are already signed in, confirm the domain, then optionally install the systemd daemon (default no). After a global install the command is `orb44`.
 
 ```bash
-npx @orb44/cli@0.1.10 status
-npx @orb44/cli@0.1.10 pulse
-npx @orb44/cli@0.1.10 install     # later: background pulse, starts after reboot
+npx @orb44/cli@0.1.12 status
+npx @orb44/cli@0.1.12 pulse
+npx @orb44/cli@0.1.12 install     # asks daemon (default yes) and logs (default no)
 orb44 update                     # after install: replace /usr/lib/orb44-sat from npm
-npx @orb44/cli@0.1.10 logout
+npx @orb44/cli@0.1.12 logout
 ```
 
 Do not run bare `npx @orb44/cli` — it can reuse an old cache. Pin the version or use `orb44` after install.

package/bin/orb44.mjs

@@ -27,6 +27,7 @@ function args() {
     else if (a === "--logs") out.logs = true;
     else if (a === "--force") out.force = true;
     else if (a === "--purge") out.purge = true;
+    else if (a === "--version" || a === "-V" || a === "-v") out.version = true;
     else if (a === "--url" || a === "--code" || a === "--name" || a === "--interval" || a === "--lang") {
       out[a.slice(2)] = argv[++i];
     } else if (!a.startsWith("-")) out._.push(a);
@@ -105,8 +106,43 @@ function quote(p) {
   return /[\s"$]/.test(s) ? `"${s.replace(/"/g, '\\"')}"` : s;
 }
 
+function localCliVersion() {
+  const ver = readCliVersion(SCRIPT);
+  return ver && ver !== "0.0.0" ? ver : "—";
+}
+
+async function latestCliVersion() {
+  try {
+    const ac = new AbortController();
+    const timer = setTimeout(() => ac.abort(), 4000);
+    const meta = await fetchLatestMeta((url, init) => fetch(url, { ...init, signal: ac.signal }));
+    clearTimeout(timer);
+    return meta.version;
+  } catch {
+    return null;
+  }
+}
+
+function printVersions(current, latest) {
+  const here = current && current !== "0.0.0" ? current : localCliVersion();
+  console.log(dim(`${t(lang, "ver_here")}: ${here}`));
+  if (!latest) {
+    console.log(dim(`${t(lang, "ver_latest")}: ${t(lang, "ver_unknown")}`));
+    return false;
+  }
+  const behind = here !== "—" && cmpVer(here, latest) < 0;
+  const same = here !== "—" && cmpVer(here, latest) === 0;
+  console.log(dim(`${t(lang, "ver_latest")}: ${latest}${same ? "  " + t(lang, "ver_ok") : ""}`));
+  if (behind) console.log(dim(t(lang, "ver_behind", { ver: latest })));
+  return behind;
+}
+
+async function printVersionPair() {
+  return printVersions(localCliVersion(), await latestCliVersion());
+}
+
 function banner() {
-  console.log(`\n🛰️  ${bold(t(lang, "banner_title"))}`);
+  console.log(`\n🛰️  ${bold(t(lang, "banner_title"))}  ${dim(localCliVersion())}`);
   console.log(dim(`${t(lang, "banner_sub")}\n`));
 }
 
@@ -142,14 +178,14 @@ async function ensureLang(opts) {
   return lang;
 }
 
-async function wantDaemon(opts) {
+async function wantDaemon(opts, { ifYes = false, index = 0 } = {}) {
   if (opts.daemon) return true;
-  if (opts.yes) return false;
-  if (!input.isTTY || !output.isTTY) return false;
+  if (opts.yes) return ifYes;
+  if (!input.isTTY || !output.isTTY) return ifYes;
   const idx = await pickFromList({
     title: t(lang, "ask_daemon"),
     items: [t(lang, "daemon_no"), t(lang, "daemon_yes")],
-    index: 0,
+    index,
     hint: "↑↓  Enter",
     stdin: input,
     stdout: output,
@@ -346,8 +382,9 @@ async function cmdLogin(opts) {
 
   const daemon = await wantDaemon(opts);
   const logs = await wantLogs(opts);
-  applyGrants(device, { daemon, logs });
-  saveDevice(device);
+  const grants = applyGrants(device, { daemon, logs });
+  persistDevice(device, [SYSTEM_DEVICE]);
+  printGrants(grants);
   if (logs) console.log(dim(t(lang, "logs_on")));
   else console.log(dim(t(lang, "logs_skip")));
 
@@ -359,9 +396,8 @@ async function cmdLogin(opts) {
   console.log("\n📡  " + t(lang, "pulse_ok"));
   printAdvice(out.body?.notes);
   if (daemon) {
-    if (cmdInstall(opts, { enable: true })) {
-      console.log("\n" + t(lang, "login_done"));
-    }
+    const installed = await cmdInstall({ ...opts, daemon: true, logs }, { enable: true, skipAsk: true });
+    if (installed) console.log("\n" + t(lang, "login_done"));
   } else {
     console.log(dim("\n" + t(lang, "daemon_skip")));
   }
@@ -402,6 +438,8 @@ async function cmdDaemon(opts) {
   const tick = async () => {
     const hh = new Date().toISOString().slice(11, 19);
     try {
+      const fresh = loadDevice();
+      if (fresh?.secret) Object.assign(device, fresh);
       const { out, pulse } = await sendPulse(device, { preview: false });
       if (!out.ok) {
         console.error(`⚠️  ${hh} ${apiFailText(lang, out, t)}`);
@@ -544,8 +582,30 @@ function tryEnable(asSystem) {
   return { ok: false, err: (st.stdout || st.stderr || "not active").trim().slice(0, 240) };
 }
 
-function cmdInstall(opts, { enable = false } = {}) {
+function persistDevice(device, extraPaths = []) {
+  saveDevice(device);
+  const body = JSON.stringify(device, null, 2);
+  for (const p of extraPaths) {
+    if (!p || path.resolve(p) === path.resolve(DEVICE_FILE)) continue;
+    try {
+      fs.writeFileSync(p, body, { mode: 0o600 });
+    } catch {
+      /* other key unreadable */
+    }
+  }
+}
+
+function printGrants(grants) {
+  const on = t(lang, "grant_on");
+  const off = t(lang, "grant_off");
+  console.log(dim(t(lang, "grant_process") + ": " + on));
+  console.log(dim(t(lang, "grant_daemon") + ": " + (grants.daemon ? on : off)));
+  console.log(dim(t(lang, "grant_logs") + ": " + (grants.logs ? on : off)));
+}
+
+async function cmdInstall(opts, { enable = false, skipAsk = false } = {}) {
   applyLang(opts);
+  if (!skipAsk) await printVersionPair();
   const rec = loadDeviceRecord();
   if (!rec?.secret) {
     console.error("⚠️  " + t(lang, "need_login"));
@@ -554,15 +614,20 @@ function cmdInstall(opts, { enable = false } = {}) {
   const srcPath = rec.path || DEVICE_FILE;
   const device = stripDevicePath(rec);
   if (opts.url) device.api = String(opts.url).replace(/\/$/, "");
-  if (opts.logs) applyGrants(device, { logs: true });
-  saveDevice(device);
-  if (srcPath !== DEVICE_FILE) {
-    try {
-      fs.writeFileSync(srcPath, JSON.stringify(device, null, 2), { mode: 0o600 });
-    } catch {
-      /* unreadable system key stays as-is */
-    }
+  let daemon;
+  let logs;
+  if (skipAsk) {
+    daemon = opts.daemon != null ? Boolean(opts.daemon) : Boolean(device.grants?.daemon);
+    logs = opts.logs != null ? Boolean(opts.logs) : Boolean(device.grants?.logs);
+  } else {
+    daemon = await wantDaemon(opts, { ifYes: true, index: 1 });
+    logs = await wantLogs(opts);
   }
+  const grants = applyGrants(device, { daemon, logs });
+  persistDevice(device, [srcPath, SYSTEM_DEVICE]);
+  printGrants(grants);
+  if (logs) console.log(dim(t(lang, "logs_on")));
+  else console.log(dim(t(lang, "logs_skip")));
   const asSystem = Boolean(opts.system) || process.getuid?.() === 0;
   const interval = intervalSec(opts.interval);
   let deviceFile = DEVICE_FILE;
@@ -574,6 +639,12 @@ function cmdInstall(opts, { enable = false } = {}) {
       deviceFile = acct.deviceFile;
       user = acct.user;
       script = acct.script;
+      persistDevice(device, [SYSTEM_DEVICE]);
+      try {
+        spawnSync("chown", ["orb44:orb44", SYSTEM_DEVICE], { encoding: "utf8" });
+      } catch {
+        /* key stays root-owned until next chown -R */
+      }
       console.log(dim(t(lang, "daemon_user", { user, file: deviceFile })));
     } else {
       console.log(dim(t(lang, "daemon_user_fail", { err: acct.err ? `: ${acct.err}` : "" })));
@@ -600,13 +671,24 @@ function cmdInstall(opts, { enable = false } = {}) {
       /* /usr/local/bin missing */
     }
   }
-  if (enable) {
+  if (enable && daemon) {
     const on = tryEnable(asSystem);
     if (on.ok) {
+      spawnSync("systemctl", asSystem ? ["try-restart", "orb44-satellite"] : ["--user", "try-restart", "orb44-satellite"], {
+        encoding: "utf8",
+      });
       console.log("✅  " + t(lang, "daemon_on"));
+      try {
+        await sendPulse(device, { preview: false });
+      } catch {
+        /* next daemon tick */
+      }
       return true;
     }
     console.log("⚠️  " + t(lang, "unit_enable_fail", { err: on.err ? `: ${on.err}` : "" }));
+  } else if (!daemon) {
+    console.log(dim(t(lang, "daemon_skip")));
+    return false;
   }
   if (asSystem) {
     console.log(dim("   " + t(lang, "install_root")));
@@ -683,9 +765,11 @@ async function cmdUpdate() {
   try {
     meta = await fetchLatestMeta();
   } catch (e) {
+    printVersions(current, null);
     console.error("⚠️  " + t(lang, "update_fail", { err: `: ${String(e.message || e).slice(0, 160)}` }));
     process.exit(1);
   }
+  printVersions(current, meta.version);
   const pin = t(lang, "update_npx", { version: meta.version });
   const roots = pickSatRoots(SCRIPT);
   const stale = staleSatRoots(roots, meta.version, { force: Boolean(opts.force) });
@@ -733,10 +817,16 @@ async function cmdUpdate() {
   console.log(dim(pin));
 }
 
-function cmdStatus() {
+async function cmdVersion() {
+  applyLang(opts);
+  await printVersionPair();
+}
+
+async function cmdStatus() {
   applyLang(opts);
   const device = loadDevice();
   banner();
+  await printVersionPair();
   if (!device) {
     console.log("⚠️  " + t(lang, "not_paired"));
     return;
@@ -789,11 +879,11 @@ async function cmdLang(flags) {
 
 function help() {
   applyLang(opts);
-  console.log(t(lang, "help", { file: DEVICE_FILE }));
+  console.log(t(lang, "help", { file: DEVICE_FILE, version: localCliVersion() }));
 }
 
 const opts = args();
-const cmd = opts._[0] || "help";
+const cmd = opts.version ? "version" : opts._[0] || "help";
 const run = {
   login: () => cmdLogin(opts),
   pulse: cmdPulse,
@@ -802,6 +892,7 @@ const run = {
   uninstall: () => cmdUninstall(opts),
   status: cmdStatus,
   update: cmdUpdate,
+  version: cmdVersion,
   logout: cmdLogout,
   lang: () => cmdLang(opts),
   help,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orb44/cli",
-  "version": "0.1.10",
+  "version": "0.1.12",
   "description": "Orb44: street snapshot of your site. This CLI is the Watch satellite — pulse from the host (load, listeners, hardening). The cabinet does not run commands on the machine.",
   "type": "module",
   "bin": {

package/server/pulse.mjs

@@ -336,7 +336,7 @@ export function sanitizePulse(raw = {}) {
     top,
     listen,
     originA,
-    failedUnit: raw.failedUnit ? String(raw.failedUnit).slice(0, 80) : null,
+    failedUnit: cleanFailedUnits(raw.failedUnit).join(", ") || null,
     oom,
     limited,
     hardening,
@@ -993,29 +993,23 @@ export function compareInside(pulse, rec = {}, prev = null) {
     });
   }
   if (prev?.listen && pulse?.listen) {
-    const face = (p) =>
-      (p.listen || [])
-        .filter((r) => Number(r.port) === 80 || Number(r.port) === 443)
-        .map((r) => `${r.port}:${r.comm || "?"}`)
-        .sort()
-        .join(",");
-    const a = face(prev);
-    const b = face(pulse);
-    if (a && b && a !== b) {
+    const swap = httpListenSwapped(prev, pulse);
+    if (swap) {
       notes.push({
         kind: "listen-swap",
         title: "На 80/443 сменился процесс",
-        text: `Было ${a}, стало ${b}. Бинарь витрины подменили или рядом встал другой сервер.`,
+        text: `Было ${swap.from}, стало ${swap.to}. Бинарь витрины подменили или рядом встал другой сервер.`,
         do: "Сверьте, кто должен слушать HTTPS. Orb44 процесс сам не откатывает.",
       });
     }
   }
-  if (pulse?.failedUnit) {
+  const failed = cleanFailedUnits(pulse?.failedUnit);
+  if (failed.length) {
     notes.push({
       kind: "failed-unit",
       title: "Упал systemd-юнит",
-      text: `${pulse.failedUnit}. Имя из systemctl --failed — не стек.`,
-      do: "Откройте этот юнит на машине (systemctl status). Orb44 контейнеры не перезапускает.",
+      text: `${failed.join(", ")} не запустился.`,
+      do: "На машине: systemctl status этого юнита. Orb44 его сам не поднимает.",
     });
   }
   const errs = pulse?.errors || [];
@@ -1040,6 +1034,46 @@ function streetIncidentCode(rec = {}) {
   return rec.incident?.code || rec.watch?.current?.incident || rec.watch?.last?.incident || "";
 }
 
+function httpListenFace(p) {
+  return (p?.listen || [])
+    .filter((r) => Number(r.port) === 80 || Number(r.port) === 443)
+    .map((r) => ({ port: Number(r.port), comm: String(r.comm || "").replace(/^\?$/, "").trim() }))
+    .sort((a, b) => a.port - b.port);
+}
+
+/** True process swap on 80/443. `?` → `docker-proxy` is just ss starting to see names. */
+export function httpListenSwapped(prev, pulse) {
+  const a = httpListenFace(prev);
+  const b = httpListenFace(pulse);
+  if (!a.length || !b.length) return null;
+  const label = (rows) => rows.map((r) => `${r.port}:${r.comm || "?"}`).join(",");
+  const from = label(a);
+  const to = label(b);
+  if (from === to) return null;
+  const pa = new Map(a.map((r) => [r.port, r.comm]));
+  const pb = new Map(b.map((r) => [r.port, r.comm]));
+  let real = false;
+  for (const port of new Set([...pa.keys(), ...pb.keys()])) {
+    const ca = pa.get(port) || "";
+    const cb = pb.get(port) || "";
+    if (ca && cb && ca !== cb) real = true;
+  }
+  return real ? { from, to } : null;
+}
+
+function fail2banActive(h) {
+  return Boolean(h?.fail2ban);
+}
+
+/** Need fail2ban on both pulses. A default 0 on the first reading is not a brute-force spike. */
+export function fail2banBanJump(pulse, prev, minJump = 10) {
+  if (!fail2banActive(prev?.hardening) || !fail2banActive(pulse?.hardening)) return null;
+  const banned = Number(pulse.hardening.fail2banBanned) || 0;
+  const prevBanned = Number(prev.hardening.fail2banBanned) || 0;
+  if (banned < prevBanned + minJump) return null;
+  return { from: prevBanned, to: banned };
+}
+
 export function insideWatchReasons(pulse, prev, rec = {}) {
   const notes = [];
   const incident = String(streetIncidentCode(rec) || "");
@@ -1063,13 +1097,12 @@ export function insideWatchReasons(pulse, prev, rec = {}) {
       });
     }
   }
-  const banned = Number(pulse?.hardening?.fail2banBanned) || 0;
-  const prevBanned = Number(prev?.hardening?.fail2banBanned) || 0;
-  if (prev && banned > prevBanned) {
+  const banJump = fail2banBanJump(pulse, prev);
+  if (banJump) {
     notes.push({
       kind: "stuffing-ssh",
-      title: "fail2ban копит баны",
-      text: `Было ${prevBanned}, стало ${banned}. Это чужой перебор SSH. Пароли не подбираем.`,
+      title: "fail2ban копит баны SSH",
+      text: `Было ${banJump.from}, стало ${banJump.to}. Чужой перебор SSH, не вход на витрину. Пароли не подбираем.`,
     });
   }
   if (prev) {
@@ -1083,27 +1116,21 @@ export function insideWatchReasons(pulse, prev, rec = {}) {
         text: `Появились ${added.join(", ")}. С прошлого пульса их не было.`,
       });
     }
-    const face = (p) =>
-      (p?.listen || [])
-        .filter((r) => Number(r.port) === 80 || Number(r.port) === 443)
-        .map((r) => `${r.port}:${r.comm || "?"}`)
-        .sort()
-        .join(",");
-    const a = face(prev);
-    const b = face(pulse);
-    if (a && b && a !== b) {
+    const swap = httpListenSwapped(prev, pulse);
+    if (swap) {
       notes.push({
         kind: "listen-swap",
         title: "На 80/443 сменился процесс",
-        text: `Было ${a}, стало ${b}.`,
+        text: `Было ${swap.from}, стало ${swap.to}.`,
       });
     }
   }
-  if (pulse?.failedUnit) {
+  const freshFailed = freshFailedUnits(pulse, prev);
+  if (freshFailed.length) {
     notes.push({
       kind: "failed-unit",
       title: "Упал systemd-юнит",
-      text: `${pulse.failedUnit}. Это имя из systemctl --failed, не стек.`,
+      text: `${freshFailed.join(", ")} не запустился.`,
     });
   }
   const errNow = (pulse?.errors || []).map((e) => `${e.source}:${e.name}`);
@@ -1172,14 +1199,48 @@ export function insideAlertDecision(row, reasons, now = Date.now(), debounceMs =
   return { emit: true, key };
 }
 
+/** First-boot / image leftovers that stay in `systemctl --failed` forever. Not a live outage. */
+export function isNoisyFailedUnit(name) {
+  const n = String(name || "").toLowerCase();
+  if (/^cloud-(init|config|final)/.test(n)) return true;
+  if (/^snapd\.(seeded|autoimport)/.test(n)) return true;
+  if (/^systemd-networkd-wait-online/.test(n)) return true;
+  if (/^(plymouth|kmod-static-nodes|finalrd|open-iscsi|iscsid)\./.test(n)) return true;
+  return false;
+}
+
+export function failedUnitList(raw) {
+  return String(raw || "")
+    .split(",")
+    .map((s) => s.trim())
+    .filter(Boolean);
+}
+
+export function cleanFailedUnits(raw) {
+  const out = [];
+  for (const name of failedUnitList(raw)) {
+    const one = name.slice(0, 60);
+    if (!one || isNoisyFailedUnit(one) || out.includes(one)) continue;
+    out.push(one);
+    if (out.length >= 6) break;
+  }
+  return out;
+}
+
+function freshFailedUnits(pulse, prev) {
+  const now = cleanFailedUnits(pulse?.failedUnit);
+  const old = new Set(cleanFailedUnits(prev?.failedUnit));
+  return now.filter((u) => !old.has(u));
+}
+
 export function parseFailedUnits(text) {
   const out = [];
   for (const line of String(text || "").split("\n")) {
     const hit = line.match(/\b([a-zA-Z0-9@._-]+\.(service|socket|mount|timer))\b/);
     if (hit && !out.includes(hit[1])) out.push(hit[1].slice(0, 60));
-    if (out.length >= 6) break;
+    if (out.length >= 8) break;
   }
-  return out;
+  return cleanFailedUnits(out.join(", "));
 }
 
 function collectFailedUnits() {

package/server/sat-i18n.mjs

@@ -49,6 +49,11 @@ const STR = {
     logs_yes: "Yes — last errors if readable",
     logs_skip: "Log monitoring off. Later: orb44 login --logs   or orb44 install --logs",
     logs_on: "Log monitoring on. Docker/kube/nginx only if this user can read them.",
+    grant_process: "System processes",
+    grant_daemon: "Restart after reboot",
+    grant_logs: "Log monitoring",
+    grant_on: "on",
+    grant_off: "off",
     need_login: "First: orb44 login",
     key_revoked: "Key revoked. Again: orb44 login",
     daemon_run: "daemon every {sec}s · {host}",
@@ -64,6 +69,11 @@ const STR = {
     copy_key: "and copy the key into ORB44_DEVICE_FILE that user orb44 can read.",
     not_paired: "Not paired. orb44 login",
     now_on_box: "On the machine now",
+    ver_here: "On this machine",
+    ver_latest: "Latest",
+    ver_ok: "up to date",
+    ver_unknown: "npm unreachable",
+    ver_behind: "update: npx @orb44/cli@{ver} update --force",
     logged_out: "Disconnected. Cabinet dropped the device.",
     uninstall_ok: "Daemon stopped and unit removed. Pairing key kept.",
     uninstall_purged: "Daemon, key, and service user orb44 removed. Cabinet dropped the device.",
@@ -116,19 +126,21 @@ const STR = {
     preview_ssh_pass: "password",
     preview_ssh_key: "keys",
     preview_limited: "limited: cannot see which process owns the ports",
-    help: `Orb44 satellite — admin device.
+    help: `Orb44 satellite {version} — admin device.
 
   orb44 login [--url http://127.0.0.1:8787] [--daemon] [--logs] [--force] [--lang en|ru|ko|es]
   orb44 pulse
   orb44 daemon [--interval 300]
-  orb44 install [--system] [--logs] [--interval 300]
+  orb44 install [--system] [--daemon] [--logs] [--interval 300]
   orb44 uninstall [--purge]
   orb44 lang [en|ru|ko|es]
   orb44 status
+  orb44 version
   orb44 update
   orb44 logout
 
 Login asks language (saved), then daemon and logs (default no).
+Install asks the same two (daemon default yes, logs default no). --daemon / --logs skip the questions.
 Key: {file}
 Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
   },
@@ -162,6 +174,11 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     logs_yes: "Да — последние ошибки, если читаются",
     logs_skip: "Логи не снимаем. Позже: orb44 login --logs   или orb44 install --logs",
     logs_on: "Логи включены. Docker/kube/nginx — только если этот пользователь их видит.",
+    grant_process: "Системные процессы",
+    grant_daemon: "Рестарт после загрузки",
+    grant_logs: "Мониторинг логов",
+    grant_on: "да",
+    grant_off: "нет",
     need_login: "Сначала: orb44 login",
     key_revoked: "Ключ отозван. Снова: orb44 login",
     daemon_run: "демон каждые {sec}с · {host}",
@@ -177,6 +194,11 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     copy_key: "и скопируйте ключ в ORB44_DEVICE_FILE, который читает orb44.",
     not_paired: "Не связано. orb44 login",
     now_on_box: "Сейчас на машине",
+    ver_here: "На машине",
+    ver_latest: "Актуальная",
+    ver_ok: "совпадает",
+    ver_unknown: "npm не ответил",
+    ver_behind: "обновить: npx @orb44/cli@{ver} update --force",
     logged_out: "Отключено. В кабинете устройство снято.",
     uninstall_ok: "Демон остановлен, unit снят. Ключ пары оставлен.",
     uninstall_purged: "Демон, ключ и пользователь orb44 сняты. В кабинете устройство отозвано.",
@@ -229,19 +251,21 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     preview_ssh_pass: "пароль",
     preview_ssh_key: "ключи",
     preview_limited: "ограничено: не видно, какой процесс слушает порты",
-    help: `Orb44 сателлит — устройство админа.
+    help: `Orb44 сателлит {version} — устройство админа.
 
   orb44 login [--url http://127.0.0.1:8787] [--daemon] [--logs] [--force] [--lang en|ru|ko|es]
   orb44 pulse
   orb44 daemon [--interval 300]
-  orb44 install [--system] [--logs] [--interval 300]
+  orb44 install [--system] [--daemon] [--logs] [--interval 300]
   orb44 uninstall [--purge]
   orb44 lang [en|ru|ko|es]
   orb44 status
+  orb44 version
   orb44 update
   orb44 logout
 
 После login спрашивает язык (запоминает), затем демон и логи — по умолчанию нет.
+install спрашивает то же (демон — да, логи — нет). --daemon / --logs пропускают вопросы.
 Ключ: {file}
 Пульс исходящий. Кабинет не выполняет команды: отвечает текстом «что сделать».`,
   },
@@ -275,6 +299,11 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     logs_yes: "예 — 읽을 수 있으면 마지막 오류",
     logs_skip: "로그 수집 안 함. 나중에: orb44 login --logs  또는 orb44 install --logs",
     logs_on: "로그 수집 켜짐. Docker/kube/nginx는 이 사용자가 읽을 수 있을 때만.",
+    grant_process: "시스템 프로세스",
+    grant_daemon: "부팅 후 재시작",
+    grant_logs: "로그 모니터링",
+    grant_on: "켜짐",
+    grant_off: "꺼짐",
     need_login: "먼저: orb44 login",
     key_revoked: "키가 취소되었습니다. 다시: orb44 login",
     daemon_run: "데몬 {sec}초마다 · {host}",
@@ -290,6 +319,11 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     copy_key: "그리고 orb44가 읽을 ORB44_DEVICE_FILE로 키를 복사하세요.",
     not_paired: "연결되지 않음. orb44 login",
     now_on_box: "지금 이 기기",
+    ver_here: "이 기기",
+    ver_latest: "최신",
+    ver_ok: "최신",
+    ver_unknown: "npm 응답 없음",
+    ver_behind: "업데이트: npx @orb44/cli@{ver} update --force",
     logged_out: "해제됨. 콘솔에서 장치가 제거되었습니다.",
     uninstall_ok: "데몬을 멈추고 unit을 제거했습니다. 페어링 키는 남겼습니다.",
     uninstall_purged: "데몬, 키, 사용자 orb44를 제거했습니다. 콘솔에서 장치를 취소했습니다.",
@@ -342,19 +376,21 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     preview_ssh_pass: "비밀번호",
     preview_ssh_key: "키",
     preview_limited: "제한: 포트를 연 프로세스를 볼 수 없음",
-    help: `Orb44 위성 — 관리자 장치.
+    help: `Orb44 위성 {version} — 관리자 장치.
 
   orb44 login [--url http://127.0.0.1:8787] [--daemon] [--logs] [--force] [--lang en|ru|ko|es]
   orb44 pulse
   orb44 daemon [--interval 300]
-  orb44 install [--system] [--logs] [--interval 300]
+  orb44 install [--system] [--daemon] [--logs] [--interval 300]
   orb44 uninstall [--purge]
   orb44 lang [en|ru|ko|es]
   orb44 status
+  orb44 version
   orb44 update
   orb44 logout
 
 login에서 언어를 묻고 저장한 뒤, 데몬과 로그는 기본값 아니오입니다.
+install도 같은 두 질문(데몬 기본 예, 로그 기본 아니오). --daemon / --logs는 질문을 건너뜁니다.
 키: {file}
 나가는 펄스. 콘솔은 명령을 실행하지 않고 조언만 돌려줍니다.`,
   },
@@ -388,6 +424,11 @@ login에서 언어를 묻고 저장한 뒤, 데몬과 로그는 기본값 아니
     logs_yes: "Sí — últimos errores si se pueden leer",
     logs_skip: "Sin logs. Luego: orb44 login --logs   o orb44 install --logs",
     logs_on: "Logs activos. Docker/kube/nginx solo si este usuario los ve.",
+    grant_process: "Procesos del sistema",
+    grant_daemon: "Reinicio tras el arranque",
+    grant_logs: "Monitor de logs",
+    grant_on: "sí",
+    grant_off: "no",
     need_login: "Primero: orb44 login",
     key_revoked: "Clave revocada. Otra vez: orb44 login",
     daemon_run: "demonio cada {sec}s · {host}",
@@ -403,6 +444,11 @@ login에서 언어를 묻고 저장한 뒤, 데몬과 로그는 기본값 아니
     copy_key: "y copie la clave a ORB44_DEVICE_FILE que pueda leer orb44.",
     not_paired: "Sin vincular. orb44 login",
     now_on_box: "Ahora en la máquina",
+    ver_here: "En esta máquina",
+    ver_latest: "Actual",
+    ver_ok: "al día",
+    ver_unknown: "npm no respondió",
+    ver_behind: "actualizar: npx @orb44/cli@{ver} update --force",
     logged_out: "Desconectado. El gabinete quitó el dispositivo.",
     uninstall_ok: "Demonio parado y unit quitado. Se guarda la clave de emparejamiento.",
     uninstall_purged: "Demonio, clave y usuario orb44 eliminados. El gabinete revocó el dispositivo.",
@@ -455,19 +501,21 @@ login에서 언어를 묻고 저장한 뒤, 데몬과 로그는 기본값 아니
     preview_ssh_pass: "contraseña",
     preview_ssh_key: "claves",
     preview_limited: "limitado: no se ve qué proceso tiene los puertos",
-    help: `Satélite Orb44 — dispositivo de admin.
+    help: `Satélite Orb44 {version} — dispositivo de admin.
 
   orb44 login [--url http://127.0.0.1:8787] [--daemon] [--logs] [--force] [--lang en|ru|ko|es]
   orb44 pulse
   orb44 daemon [--interval 300]
-  orb44 install [--system] [--logs] [--interval 300]
+  orb44 install [--system] [--daemon] [--logs] [--interval 300]
   orb44 uninstall [--purge]
   orb44 lang [en|ru|ko|es]
   orb44 status
+  orb44 version
   orb44 update
   orb44 logout
 
 Login pregunta idioma (lo guarda), luego demonio y logs (por defecto no).
+install pregunta lo mismo (demonio sí, logs no). --daemon / --logs saltan las preguntas.
 Clave: {file}
 Pulso saliente. El gabinete no ejecuta órdenes; responde con consejos.`,
   },

package/server/sat-update.mjs

@@ -54,8 +54,57 @@ export function readCliVersion(scriptFile) {
   return "0.0.0";
 }
 
+/** Files the running CLI expects, plus whatever the unpacked tarball actually ships. */
+export function listSatPackageFiles(srcPackageDir) {
+  const src = path.resolve(srcPackageDir);
+  const out = new Set(SAT_TREE_FILES);
+  try {
+    const j = JSON.parse(fs.readFileSync(path.join(src, "package.json"), "utf8"));
+    for (const f of j.files || []) out.add(String(f));
+    const bin = j.bin;
+    if (typeof bin === "string") out.add(bin);
+    else if (bin && typeof bin === "object") {
+      for (const v of Object.values(bin)) if (v) out.add(String(v));
+    }
+  } catch {
+    /* SAT_TREE_FILES only */
+  }
+  const serverDir = path.join(src, "server");
+  try {
+    for (const name of fs.readdirSync(serverDir)) {
+      if (name.endsWith(".mjs")) out.add(`server/${name}`);
+    }
+  } catch {
+    /* no server dir */
+  }
+  if (fs.existsSync(path.join(src, "bin", "orb44.mjs"))) out.add("bin/orb44.mjs");
+  if (fs.existsSync(path.join(src, "package.json"))) out.add("package.json");
+  return [...out];
+}
+
+export function missingSatFiles(root) {
+  const r = path.resolve(root);
+  const miss = [];
+  for (const rel of SAT_TREE_FILES) {
+    if (rel === "package.json") continue;
+    if (!fs.existsSync(path.join(r, rel))) miss.push(rel);
+  }
+  try {
+    const pulse = fs.readFileSync(path.join(r, "server", "pulse.mjs"), "utf8");
+    for (const m of pulse.matchAll(/from\s+["'](\.[^"']+)["']/g)) {
+      const spec = m[1];
+      const abs = path.join(r, "server", spec);
+      if (!fs.existsSync(abs)) miss.push(path.posix.join("server", path.basename(spec)));
+    }
+  } catch {
+    miss.push("server/pulse.mjs");
+  }
+  return [...new Set(miss)];
+}
+
 export function treeNeedsRefresh(root, latest, { force = false } = {}) {
   if (force) return true;
+  if (missingSatFiles(root).length) return true;
   const ver = readCliVersion(path.join(root, "bin", "orb44.mjs"));
   if (cmpVer(ver, latest) < 0) return true;
   try {
@@ -84,17 +133,16 @@ export function pickSatRoots(scriptFile, { systemLib = "/usr/lib/orb44-sat" } =
 export function applyUpdateTree(srcPackageDir, destRoot) {
   const src = path.resolve(srcPackageDir);
   const dest = path.resolve(destRoot);
-  for (const rel of SAT_TREE_FILES) {
+  for (const rel of listSatPackageFiles(src)) {
     const from = path.join(src, rel);
-    if (!fs.existsSync(from)) {
-      if (rel === "package.json") continue;
-      throw new Error(`missing ${rel}`);
-    }
+    if (!fs.existsSync(from) || !fs.statSync(from).isFile()) continue;
     const to = path.join(dest, rel);
     fs.mkdirSync(path.dirname(to), { recursive: true });
     fs.copyFileSync(from, to);
     fs.chmodSync(to, rel.endsWith("orb44.mjs") ? 0o755 : 0o644);
   }
+  const miss = missingSatFiles(dest);
+  if (miss.length) throw new Error(`incomplete tree: ${miss.join(", ")}`);
   return dest;
 }