@orb44/cli 0.1.11 → 0.1.12

package/README.md

@@ -13,11 +13,11 @@ npx @orb44/cli login --url https://orb44.com
 Open the printed link in a browser where you are already signed in, confirm the domain, then optionally install the systemd daemon (default no). After a global install the command is `orb44`.
 
 ```bash
-npx @orb44/cli@0.1.11 status
-npx @orb44/cli@0.1.11 pulse
-npx @orb44/cli@0.1.11 install     # later: background pulse, starts after reboot
+npx @orb44/cli@0.1.12 status
+npx @orb44/cli@0.1.12 pulse
+npx @orb44/cli@0.1.12 install     # asks daemon (default yes) and logs (default no)
 orb44 update                     # after install: replace /usr/lib/orb44-sat from npm
-npx @orb44/cli@0.1.11 logout
+npx @orb44/cli@0.1.12 logout
 ```
 
 Do not run bare `npx @orb44/cli` — it can reuse an old cache. Pin the version or use `orb44` after install.

package/bin/orb44.mjs

@@ -27,6 +27,7 @@ function args() {
     else if (a === "--logs") out.logs = true;
     else if (a === "--force") out.force = true;
     else if (a === "--purge") out.purge = true;
+    else if (a === "--version" || a === "-V" || a === "-v") out.version = true;
     else if (a === "--url" || a === "--code" || a === "--name" || a === "--interval" || a === "--lang") {
       out[a.slice(2)] = argv[++i];
     } else if (!a.startsWith("-")) out._.push(a);
@@ -105,8 +106,43 @@ function quote(p) {
   return /[\s"$]/.test(s) ? `"${s.replace(/"/g, '\\"')}"` : s;
 }
 
+function localCliVersion() {
+  const ver = readCliVersion(SCRIPT);
+  return ver && ver !== "0.0.0" ? ver : "—";
+}
+
+async function latestCliVersion() {
+  try {
+    const ac = new AbortController();
+    const timer = setTimeout(() => ac.abort(), 4000);
+    const meta = await fetchLatestMeta((url, init) => fetch(url, { ...init, signal: ac.signal }));
+    clearTimeout(timer);
+    return meta.version;
+  } catch {
+    return null;
+  }
+}
+
+function printVersions(current, latest) {
+  const here = current && current !== "0.0.0" ? current : localCliVersion();
+  console.log(dim(`${t(lang, "ver_here")}: ${here}`));
+  if (!latest) {
+    console.log(dim(`${t(lang, "ver_latest")}: ${t(lang, "ver_unknown")}`));
+    return false;
+  }
+  const behind = here !== "—" && cmpVer(here, latest) < 0;
+  const same = here !== "—" && cmpVer(here, latest) === 0;
+  console.log(dim(`${t(lang, "ver_latest")}: ${latest}${same ? "  " + t(lang, "ver_ok") : ""}`));
+  if (behind) console.log(dim(t(lang, "ver_behind", { ver: latest })));
+  return behind;
+}
+
+async function printVersionPair() {
+  return printVersions(localCliVersion(), await latestCliVersion());
+}
+
 function banner() {
-  console.log(`\n🛰️  ${bold(t(lang, "banner_title"))}`);
+  console.log(`\n🛰️  ${bold(t(lang, "banner_title"))}  ${dim(localCliVersion())}`);
   console.log(dim(`${t(lang, "banner_sub")}\n`));
 }
 
@@ -142,14 +178,14 @@ async function ensureLang(opts) {
   return lang;
 }
 
-async function wantDaemon(opts) {
+async function wantDaemon(opts, { ifYes = false, index = 0 } = {}) {
   if (opts.daemon) return true;
-  if (opts.yes) return false;
-  if (!input.isTTY || !output.isTTY) return false;
+  if (opts.yes) return ifYes;
+  if (!input.isTTY || !output.isTTY) return ifYes;
   const idx = await pickFromList({
     title: t(lang, "ask_daemon"),
     items: [t(lang, "daemon_no"), t(lang, "daemon_yes")],
-    index: 0,
+    index,
     hint: "↑↓  Enter",
     stdin: input,
     stdout: output,
@@ -346,8 +382,9 @@ async function cmdLogin(opts) {
 
   const daemon = await wantDaemon(opts);
   const logs = await wantLogs(opts);
-  applyGrants(device, { daemon, logs });
-  saveDevice(device);
+  const grants = applyGrants(device, { daemon, logs });
+  persistDevice(device, [SYSTEM_DEVICE]);
+  printGrants(grants);
   if (logs) console.log(dim(t(lang, "logs_on")));
   else console.log(dim(t(lang, "logs_skip")));
 
@@ -359,9 +396,8 @@ async function cmdLogin(opts) {
   console.log("\n📡  " + t(lang, "pulse_ok"));
   printAdvice(out.body?.notes);
   if (daemon) {
-    if (cmdInstall(opts, { enable: true })) {
-      console.log("\n" + t(lang, "login_done"));
-    }
+    const installed = await cmdInstall({ ...opts, daemon: true, logs }, { enable: true, skipAsk: true });
+    if (installed) console.log("\n" + t(lang, "login_done"));
   } else {
     console.log(dim("\n" + t(lang, "daemon_skip")));
   }
@@ -402,6 +438,8 @@ async function cmdDaemon(opts) {
   const tick = async () => {
     const hh = new Date().toISOString().slice(11, 19);
     try {
+      const fresh = loadDevice();
+      if (fresh?.secret) Object.assign(device, fresh);
       const { out, pulse } = await sendPulse(device, { preview: false });
       if (!out.ok) {
         console.error(`⚠️  ${hh} ${apiFailText(lang, out, t)}`);
@@ -544,8 +582,30 @@ function tryEnable(asSystem) {
   return { ok: false, err: (st.stdout || st.stderr || "not active").trim().slice(0, 240) };
 }
 
-function cmdInstall(opts, { enable = false } = {}) {
+function persistDevice(device, extraPaths = []) {
+  saveDevice(device);
+  const body = JSON.stringify(device, null, 2);
+  for (const p of extraPaths) {
+    if (!p || path.resolve(p) === path.resolve(DEVICE_FILE)) continue;
+    try {
+      fs.writeFileSync(p, body, { mode: 0o600 });
+    } catch {
+      /* other key unreadable */
+    }
+  }
+}
+
+function printGrants(grants) {
+  const on = t(lang, "grant_on");
+  const off = t(lang, "grant_off");
+  console.log(dim(t(lang, "grant_process") + ": " + on));
+  console.log(dim(t(lang, "grant_daemon") + ": " + (grants.daemon ? on : off)));
+  console.log(dim(t(lang, "grant_logs") + ": " + (grants.logs ? on : off)));
+}
+
+async function cmdInstall(opts, { enable = false, skipAsk = false } = {}) {
   applyLang(opts);
+  if (!skipAsk) await printVersionPair();
   const rec = loadDeviceRecord();
   if (!rec?.secret) {
     console.error("⚠️  " + t(lang, "need_login"));
@@ -554,15 +614,20 @@ function cmdInstall(opts, { enable = false } = {}) {
   const srcPath = rec.path || DEVICE_FILE;
   const device = stripDevicePath(rec);
   if (opts.url) device.api = String(opts.url).replace(/\/$/, "");
-  applyGrants(device, { daemon: true, logs: opts.logs ? true : device.grants?.logs });
-  saveDevice(device);
-  if (srcPath !== DEVICE_FILE) {
-    try {
-      fs.writeFileSync(srcPath, JSON.stringify(device, null, 2), { mode: 0o600 });
-    } catch {
-      /* unreadable system key stays as-is */
-    }
+  let daemon;
+  let logs;
+  if (skipAsk) {
+    daemon = opts.daemon != null ? Boolean(opts.daemon) : Boolean(device.grants?.daemon);
+    logs = opts.logs != null ? Boolean(opts.logs) : Boolean(device.grants?.logs);
+  } else {
+    daemon = await wantDaemon(opts, { ifYes: true, index: 1 });
+    logs = await wantLogs(opts);
   }
+  const grants = applyGrants(device, { daemon, logs });
+  persistDevice(device, [srcPath, SYSTEM_DEVICE]);
+  printGrants(grants);
+  if (logs) console.log(dim(t(lang, "logs_on")));
+  else console.log(dim(t(lang, "logs_skip")));
   const asSystem = Boolean(opts.system) || process.getuid?.() === 0;
   const interval = intervalSec(opts.interval);
   let deviceFile = DEVICE_FILE;
@@ -574,6 +639,12 @@ function cmdInstall(opts, { enable = false } = {}) {
       deviceFile = acct.deviceFile;
       user = acct.user;
       script = acct.script;
+      persistDevice(device, [SYSTEM_DEVICE]);
+      try {
+        spawnSync("chown", ["orb44:orb44", SYSTEM_DEVICE], { encoding: "utf8" });
+      } catch {
+        /* key stays root-owned until next chown -R */
+      }
       console.log(dim(t(lang, "daemon_user", { user, file: deviceFile })));
     } else {
       console.log(dim(t(lang, "daemon_user_fail", { err: acct.err ? `: ${acct.err}` : "" })));
@@ -600,13 +671,24 @@ function cmdInstall(opts, { enable = false } = {}) {
       /* /usr/local/bin missing */
     }
   }
-  if (enable) {
+  if (enable && daemon) {
     const on = tryEnable(asSystem);
     if (on.ok) {
+      spawnSync("systemctl", asSystem ? ["try-restart", "orb44-satellite"] : ["--user", "try-restart", "orb44-satellite"], {
+        encoding: "utf8",
+      });
       console.log("✅  " + t(lang, "daemon_on"));
+      try {
+        await sendPulse(device, { preview: false });
+      } catch {
+        /* next daemon tick */
+      }
       return true;
     }
     console.log("⚠️  " + t(lang, "unit_enable_fail", { err: on.err ? `: ${on.err}` : "" }));
+  } else if (!daemon) {
+    console.log(dim(t(lang, "daemon_skip")));
+    return false;
   }
   if (asSystem) {
     console.log(dim("   " + t(lang, "install_root")));
@@ -683,9 +765,11 @@ async function cmdUpdate() {
   try {
     meta = await fetchLatestMeta();
   } catch (e) {
+    printVersions(current, null);
     console.error("⚠️  " + t(lang, "update_fail", { err: `: ${String(e.message || e).slice(0, 160)}` }));
     process.exit(1);
   }
+  printVersions(current, meta.version);
   const pin = t(lang, "update_npx", { version: meta.version });
   const roots = pickSatRoots(SCRIPT);
   const stale = staleSatRoots(roots, meta.version, { force: Boolean(opts.force) });
@@ -733,10 +817,16 @@ async function cmdUpdate() {
   console.log(dim(pin));
 }
 
-function cmdStatus() {
+async function cmdVersion() {
+  applyLang(opts);
+  await printVersionPair();
+}
+
+async function cmdStatus() {
   applyLang(opts);
   const device = loadDevice();
   banner();
+  await printVersionPair();
   if (!device) {
     console.log("⚠️  " + t(lang, "not_paired"));
     return;
@@ -789,11 +879,11 @@ async function cmdLang(flags) {
 
 function help() {
   applyLang(opts);
-  console.log(t(lang, "help", { file: DEVICE_FILE }));
+  console.log(t(lang, "help", { file: DEVICE_FILE, version: localCliVersion() }));
 }
 
 const opts = args();
-const cmd = opts._[0] || "help";
+const cmd = opts.version ? "version" : opts._[0] || "help";
 const run = {
   login: () => cmdLogin(opts),
   pulse: cmdPulse,
@@ -802,6 +892,7 @@ const run = {
   uninstall: () => cmdUninstall(opts),
   status: cmdStatus,
   update: cmdUpdate,
+  version: cmdVersion,
   logout: cmdLogout,
   lang: () => cmdLang(opts),
   help,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orb44/cli",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "description": "Orb44: street snapshot of your site. This CLI is the Watch satellite — pulse from the host (load, listeners, hardening). The cabinet does not run commands on the machine.",
   "type": "module",
   "bin": {

package/server/sat-i18n.mjs

@@ -49,6 +49,11 @@ const STR = {
     logs_yes: "Yes — last errors if readable",
     logs_skip: "Log monitoring off. Later: orb44 login --logs   or orb44 install --logs",
     logs_on: "Log monitoring on. Docker/kube/nginx only if this user can read them.",
+    grant_process: "System processes",
+    grant_daemon: "Restart after reboot",
+    grant_logs: "Log monitoring",
+    grant_on: "on",
+    grant_off: "off",
     need_login: "First: orb44 login",
     key_revoked: "Key revoked. Again: orb44 login",
     daemon_run: "daemon every {sec}s · {host}",
@@ -64,6 +69,11 @@ const STR = {
     copy_key: "and copy the key into ORB44_DEVICE_FILE that user orb44 can read.",
     not_paired: "Not paired. orb44 login",
     now_on_box: "On the machine now",
+    ver_here: "On this machine",
+    ver_latest: "Latest",
+    ver_ok: "up to date",
+    ver_unknown: "npm unreachable",
+    ver_behind: "update: npx @orb44/cli@{ver} update --force",
     logged_out: "Disconnected. Cabinet dropped the device.",
     uninstall_ok: "Daemon stopped and unit removed. Pairing key kept.",
     uninstall_purged: "Daemon, key, and service user orb44 removed. Cabinet dropped the device.",
@@ -116,19 +126,21 @@ const STR = {
     preview_ssh_pass: "password",
     preview_ssh_key: "keys",
     preview_limited: "limited: cannot see which process owns the ports",
-    help: `Orb44 satellite — admin device.
+    help: `Orb44 satellite {version} — admin device.
 
   orb44 login [--url http://127.0.0.1:8787] [--daemon] [--logs] [--force] [--lang en|ru|ko|es]
   orb44 pulse
   orb44 daemon [--interval 300]
-  orb44 install [--system] [--logs] [--interval 300]
+  orb44 install [--system] [--daemon] [--logs] [--interval 300]
   orb44 uninstall [--purge]
   orb44 lang [en|ru|ko|es]
   orb44 status
+  orb44 version
   orb44 update
   orb44 logout
 
 Login asks language (saved), then daemon and logs (default no).
+Install asks the same two (daemon default yes, logs default no). --daemon / --logs skip the questions.
 Key: {file}
 Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
   },
@@ -162,6 +174,11 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     logs_yes: "Да — последние ошибки, если читаются",
     logs_skip: "Логи не снимаем. Позже: orb44 login --logs   или orb44 install --logs",
     logs_on: "Логи включены. Docker/kube/nginx — только если этот пользователь их видит.",
+    grant_process: "Системные процессы",
+    grant_daemon: "Рестарт после загрузки",
+    grant_logs: "Мониторинг логов",
+    grant_on: "да",
+    grant_off: "нет",
     need_login: "Сначала: orb44 login",
     key_revoked: "Ключ отозван. Снова: orb44 login",
     daemon_run: "демон каждые {sec}с · {host}",
@@ -177,6 +194,11 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     copy_key: "и скопируйте ключ в ORB44_DEVICE_FILE, который читает orb44.",
     not_paired: "Не связано. orb44 login",
     now_on_box: "Сейчас на машине",
+    ver_here: "На машине",
+    ver_latest: "Актуальная",
+    ver_ok: "совпадает",
+    ver_unknown: "npm не ответил",
+    ver_behind: "обновить: npx @orb44/cli@{ver} update --force",
     logged_out: "Отключено. В кабинете устройство снято.",
     uninstall_ok: "Демон остановлен, unit снят. Ключ пары оставлен.",
     uninstall_purged: "Демон, ключ и пользователь orb44 сняты. В кабинете устройство отозвано.",
@@ -229,19 +251,21 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     preview_ssh_pass: "пароль",
     preview_ssh_key: "ключи",
     preview_limited: "ограничено: не видно, какой процесс слушает порты",
-    help: `Orb44 сателлит — устройство админа.
+    help: `Orb44 сателлит {version} — устройство админа.
 
   orb44 login [--url http://127.0.0.1:8787] [--daemon] [--logs] [--force] [--lang en|ru|ko|es]
   orb44 pulse
   orb44 daemon [--interval 300]
-  orb44 install [--system] [--logs] [--interval 300]
+  orb44 install [--system] [--daemon] [--logs] [--interval 300]
   orb44 uninstall [--purge]
   orb44 lang [en|ru|ko|es]
   orb44 status
+  orb44 version
   orb44 update
   orb44 logout
 
 После login спрашивает язык (запоминает), затем демон и логи — по умолчанию нет.
+install спрашивает то же (демон — да, логи — нет). --daemon / --logs пропускают вопросы.
 Ключ: {file}
 Пульс исходящий. Кабинет не выполняет команды: отвечает текстом «что сделать».`,
   },
@@ -275,6 +299,11 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     logs_yes: "예 — 읽을 수 있으면 마지막 오류",
     logs_skip: "로그 수집 안 함. 나중에: orb44 login --logs  또는 orb44 install --logs",
     logs_on: "로그 수집 켜짐. Docker/kube/nginx는 이 사용자가 읽을 수 있을 때만.",
+    grant_process: "시스템 프로세스",
+    grant_daemon: "부팅 후 재시작",
+    grant_logs: "로그 모니터링",
+    grant_on: "켜짐",
+    grant_off: "꺼짐",
     need_login: "먼저: orb44 login",
     key_revoked: "키가 취소되었습니다. 다시: orb44 login",
     daemon_run: "데몬 {sec}초마다 · {host}",
@@ -290,6 +319,11 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     copy_key: "그리고 orb44가 읽을 ORB44_DEVICE_FILE로 키를 복사하세요.",
     not_paired: "연결되지 않음. orb44 login",
     now_on_box: "지금 이 기기",
+    ver_here: "이 기기",
+    ver_latest: "최신",
+    ver_ok: "최신",
+    ver_unknown: "npm 응답 없음",
+    ver_behind: "업데이트: npx @orb44/cli@{ver} update --force",
     logged_out: "해제됨. 콘솔에서 장치가 제거되었습니다.",
     uninstall_ok: "데몬을 멈추고 unit을 제거했습니다. 페어링 키는 남겼습니다.",
     uninstall_purged: "데몬, 키, 사용자 orb44를 제거했습니다. 콘솔에서 장치를 취소했습니다.",
@@ -342,19 +376,21 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     preview_ssh_pass: "비밀번호",
     preview_ssh_key: "키",
     preview_limited: "제한: 포트를 연 프로세스를 볼 수 없음",
-    help: `Orb44 위성 — 관리자 장치.
+    help: `Orb44 위성 {version} — 관리자 장치.
 
   orb44 login [--url http://127.0.0.1:8787] [--daemon] [--logs] [--force] [--lang en|ru|ko|es]
   orb44 pulse
   orb44 daemon [--interval 300]
-  orb44 install [--system] [--logs] [--interval 300]
+  orb44 install [--system] [--daemon] [--logs] [--interval 300]
   orb44 uninstall [--purge]
   orb44 lang [en|ru|ko|es]
   orb44 status
+  orb44 version
   orb44 update
   orb44 logout
 
 login에서 언어를 묻고 저장한 뒤, 데몬과 로그는 기본값 아니오입니다.
+install도 같은 두 질문(데몬 기본 예, 로그 기본 아니오). --daemon / --logs는 질문을 건너뜁니다.
 키: {file}
 나가는 펄스. 콘솔은 명령을 실행하지 않고 조언만 돌려줍니다.`,
   },
@@ -388,6 +424,11 @@ login에서 언어를 묻고 저장한 뒤, 데몬과 로그는 기본값 아니
     logs_yes: "Sí — últimos errores si se pueden leer",
     logs_skip: "Sin logs. Luego: orb44 login --logs   o orb44 install --logs",
     logs_on: "Logs activos. Docker/kube/nginx solo si este usuario los ve.",
+    grant_process: "Procesos del sistema",
+    grant_daemon: "Reinicio tras el arranque",
+    grant_logs: "Monitor de logs",
+    grant_on: "sí",
+    grant_off: "no",
     need_login: "Primero: orb44 login",
     key_revoked: "Clave revocada. Otra vez: orb44 login",
     daemon_run: "demonio cada {sec}s · {host}",
@@ -403,6 +444,11 @@ login에서 언어를 묻고 저장한 뒤, 데몬과 로그는 기본값 아니
     copy_key: "y copie la clave a ORB44_DEVICE_FILE que pueda leer orb44.",
     not_paired: "Sin vincular. orb44 login",
     now_on_box: "Ahora en la máquina",
+    ver_here: "En esta máquina",
+    ver_latest: "Actual",
+    ver_ok: "al día",
+    ver_unknown: "npm no respondió",
+    ver_behind: "actualizar: npx @orb44/cli@{ver} update --force",
     logged_out: "Desconectado. El gabinete quitó el dispositivo.",
     uninstall_ok: "Demonio parado y unit quitado. Se guarda la clave de emparejamiento.",
     uninstall_purged: "Demonio, clave y usuario orb44 eliminados. El gabinete revocó el dispositivo.",
@@ -455,19 +501,21 @@ login에서 언어를 묻고 저장한 뒤, 데몬과 로그는 기본값 아니
     preview_ssh_pass: "contraseña",
     preview_ssh_key: "claves",
     preview_limited: "limitado: no se ve qué proceso tiene los puertos",
-    help: `Satélite Orb44 — dispositivo de admin.
+    help: `Satélite Orb44 {version} — dispositivo de admin.
 
   orb44 login [--url http://127.0.0.1:8787] [--daemon] [--logs] [--force] [--lang en|ru|ko|es]
   orb44 pulse
   orb44 daemon [--interval 300]
-  orb44 install [--system] [--logs] [--interval 300]
+  orb44 install [--system] [--daemon] [--logs] [--interval 300]
   orb44 uninstall [--purge]
   orb44 lang [en|ru|ko|es]
   orb44 status
+  orb44 version
   orb44 update
   orb44 logout
 
 Login pregunta idioma (lo guarda), luego demonio y logs (por defecto no).
+install pregunta lo mismo (demonio sí, logs no). --daemon / --logs saltan las preguntas.
 Clave: {file}
 Pulso saliente. El gabinete no ejecuta órdenes; responde con consejos.`,
   },