@orb44/cli 0.1.4 → 0.1.5

package/README.md

@@ -13,10 +13,13 @@ npx @orb44/cli login --url https://orb44.com
 Open the printed link in a browser where you are already signed in, confirm the domain, then optionally install the systemd daemon (default no). After a global install the command is `orb44`.
 
 ```bash
-npx @orb44/cli status
-npx @orb44/cli pulse
-npx @orb44/cli install     # later: background pulse, starts after reboot
-npx @orb44/cli logout
+npx @orb44/cli@0.1.5 status
+npx @orb44/cli@0.1.5 pulse
+npx @orb44/cli@0.1.5 install     # later: background pulse, starts after reboot
+orb44 update                     # after install: replace /usr/lib/orb44-sat from npm
+npx @orb44/cli@0.1.5 logout
 ```
 
+Do not run bare `npx @orb44/cli` — it can reuse an old cache. Pin the version or use `orb44` after install.
+
 Device key: `~/.config/orb44/device.json` (mode 0600). Not a shell token.

package/bin/orb44.mjs

@@ -9,6 +9,7 @@ import { collectPulse, formatPulsePreview } from "../server/pulse.mjs";
 import { LANGS, LANG_LABEL, detectLang, normalizeLang, t } from "../server/sat-i18n.mjs";
 import { pickFromList } from "../server/cli-menu.mjs";
 import { SYSTEM_DEVICE, parseDeviceJson, hasExistingInstall, pickLiveDevice, deviceSearchPaths, loadFirstDevice, stripDevicePath } from "../server/sat-local.mjs";
+import { CLI_PACKAGE, cmpVer, readCliVersion, pickSatRoots, applyUpdateTree, fetchLatestMeta, unpackTarball } from "../server/sat-update.mjs";
 
 const DEVICE_FILE = process.env.ORB44_DEVICE_FILE || path.join(os.homedir(), ".config", "orb44", "device.json");
 const CLI_FILE = process.env.ORB44_CLI_FILE || path.join(path.dirname(DEVICE_FILE), "cli.json");
@@ -422,25 +423,19 @@ function linkSystemCli(node, script) {
   fs.writeFileSync(CLI_LINK, body, { mode: 0o755 });
 }
 
-function satServerDir() {
-  return path.join(path.dirname(SCRIPT), "..", "server");
-}
-
 function installSystemTree() {
   const lib = "/usr/lib/orb44-sat";
-  const serverSrc = satServerDir();
+  const srcRoot = path.join(path.dirname(SCRIPT), "..");
   fs.mkdirSync(path.join(lib, "bin"), { recursive: true, mode: 0o755 });
   fs.mkdirSync(path.join(lib, "server"), { recursive: true, mode: 0o755 });
-  const copies = [
-    [SCRIPT, path.join(lib, "bin", "orb44.mjs")],
-    [path.join(serverSrc, "pulse.mjs"), path.join(lib, "server", "pulse.mjs")],
-    [path.join(serverSrc, "sat-i18n.mjs"), path.join(lib, "server", "sat-i18n.mjs")],
-    [path.join(serverSrc, "cli-menu.mjs"), path.join(lib, "server", "cli-menu.mjs")],
-    [path.join(serverSrc, "sat-local.mjs"), path.join(lib, "server", "sat-local.mjs")],
-  ];
-  for (const [from, to] of copies) {
-    fs.copyFileSync(from, to);
-    fs.chmodSync(to, 0o644);
+  applyUpdateTree(srcRoot, lib);
+  const ver = readCliVersion(SCRIPT);
+  if (ver && ver !== "0.0.0") {
+    fs.writeFileSync(
+      path.join(lib, "package.json"),
+      JSON.stringify({ name: CLI_PACKAGE, version: ver, type: "module", private: true }, null, 2) + "\n",
+      { mode: 0o644 }
+    );
   }
   return path.join(lib, "bin", "orb44.mjs");
 }
@@ -640,6 +635,62 @@ async function cmdUninstall(opts) {
   console.log(dim(t(lang, "uninstall_key_kept", { file: SYSTEM_DEVICE })));
 }
 
+async function cmdUpdate() {
+  applyLang(opts);
+  const current = readCliVersion(SCRIPT);
+  let meta;
+  try {
+    meta = await fetchLatestMeta();
+  } catch (e) {
+    console.error("⚠️  " + t(lang, "update_fail", { err: `: ${String(e.message || e).slice(0, 160)}` }));
+    process.exit(1);
+  }
+  const pin = t(lang, "update_npx", { version: meta.version });
+  if (cmpVer(current, meta.version) >= 0 && !opts.force) {
+    console.log("✅  " + t(lang, "update_same", { version: current }));
+    console.log(dim(pin));
+    return;
+  }
+  const roots = pickSatRoots(SCRIPT);
+  if (!roots.length) {
+    console.error("⚠️  " + t(lang, "update_no_tree"));
+    console.log(dim(pin));
+    process.exit(1);
+  }
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "orb44-upd-"));
+  let wrote = [];
+  try {
+    const pkg = await unpackTarball(meta.tarball, tmp);
+    const blocked = [];
+    for (const root of roots) {
+      try {
+        applyUpdateTree(pkg, root);
+        wrote.push(root);
+      } catch (e) {
+        blocked.push({ root, err: String(e.message || e).slice(0, 160) });
+      }
+    }
+    if (!wrote.length) {
+      console.error("⚠️  " + t(lang, blocked.some((b) => /EACCES|permission/i.test(b.err)) ? "update_need_root" : "update_fail", { err: blocked[0]?.err ? `: ${blocked[0].err}` : "" }));
+      process.exit(1);
+    }
+  } finally {
+    try {
+      fs.rmSync(tmp, { recursive: true, force: true });
+    } catch {
+      /* tmp */
+    }
+  }
+  for (const root of wrote) {
+    console.log("✅  " + t(lang, "update_wrote", { version: meta.version, path: root }));
+  }
+  if (wrote.includes("/usr/lib/orb44-sat") && serviceIsActive(true)) {
+    spawnSync("systemctl", ["try-restart", "orb44-satellite"], { encoding: "utf8" });
+    console.log(dim(t(lang, "update_restarted")));
+  }
+  console.log(dim(pin));
+}
+
 function cmdStatus() {
   applyLang(opts);
   const device = loadDevice();
@@ -708,6 +759,7 @@ const run = {
   install: () => cmdInstall(opts, { enable: true }),
   uninstall: () => cmdUninstall(opts),
   status: cmdStatus,
+  update: cmdUpdate,
   logout: cmdLogout,
   lang: () => cmdLang(opts),
   help,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orb44/cli",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Orb44: street snapshot of your site. This CLI is the Watch satellite — pulse from the host (load, listeners, hardening). The cabinet does not run commands on the machine.",
   "type": "module",
   "bin": {
@@ -11,7 +11,8 @@
     "server/pulse.mjs",
     "server/sat-i18n.mjs",
     "server/cli-menu.mjs",
-    "server/sat-local.mjs"
+    "server/sat-local.mjs",
+    "server/sat-update.mjs"
   ],
   "engines": {
     "node": ">=18"

package/server/pulse.mjs

@@ -174,11 +174,32 @@ function topTable() {
 
 function okListenAddr(a) {
   const s = String(a || "");
-  if (s === "0.0.0.0" || s === "::" || s === "::1") return true;
+  if (s === "0.0.0.0" || s === "::" || s === "::1" || s === "*") return true;
   if (/^\d{1,3}(\.\d{1,3}){3}$/.test(s)) return true;
   return /^[0-9a-fA-F:]+$/.test(s) && s.includes(":");
 }
 
+export function collapseListen(rows = []) {
+  const groups = new Map();
+  for (const r of rows) {
+    const key = `${Number(r.port)}|${r.comm || ""}`;
+    if (!groups.has(key)) groups.set(key, []);
+    groups.get(key).push(r);
+  }
+  const out = [];
+  for (const list of groups.values()) {
+    const addrs = new Set(list.map((x) => x.addr));
+    const rest = list.filter((x) => x.addr !== "0.0.0.0" && x.addr !== "::" && x.addr !== "*");
+    if (addrs.has("*") || (addrs.has("0.0.0.0") && addrs.has("::"))) {
+      out.push({ addr: "*", port: list[0].port, comm: list[0].comm });
+      out.push(...rest);
+    } else {
+      out.push(...list);
+    }
+  }
+  return out;
+}
+
 export function sanitizePulse(raw = {}) {
   const top = Array.isArray(raw.top)
     ? raw.top
@@ -190,16 +211,18 @@ export function sanitizePulse(raw = {}) {
         }))
         .filter((r) => r.comm)
     : [];
-  const listen = Array.isArray(raw.listen)
-    ? raw.listen
-        .slice(0, 40)
-        .map((r) => ({
-          addr: String(r.addr || "").slice(0, 45),
-          port: Number(r.port) || 0,
-          comm: sanitizeComm(r.comm),
-        }))
-        .filter((r) => r.port > 0 && r.port < 65536 && okListenAddr(r.addr))
-    : [];
+  const listen = collapseListen(
+    Array.isArray(raw.listen)
+      ? raw.listen
+          .slice(0, 40)
+          .map((r) => ({
+            addr: String(r.addr || "").slice(0, 45),
+            port: Number(r.port) || 0,
+            comm: sanitizeComm(r.comm),
+          }))
+          .filter((r) => r.port > 0 && r.port < 65536 && okListenAddr(r.addr))
+      : []
+  );
   const originA = Array.isArray(raw.originA)
     ? raw.originA.map((x) => String(x || "")).filter((x) => /^\d{1,3}(\.\d{1,3}){3}$/.test(x)).slice(0, 8)
     : [];
@@ -710,9 +733,10 @@ export function formatPulsePreview(pulse, lang = "en") {
       [t(lang, "preview_row_grade"), grade],
     ]
   );
-  const listenRows = [...(pulse.listen || [])]
+  const listenRows = collapseListen([...(pulse.listen || [])])
     .sort((a, b) => {
-      const rank = (addr) => (addr === "0.0.0.0" || addr === "::" ? 0 : String(addr).startsWith("127.") || addr === "::1" ? 2 : 1);
+      const rank = (addr) =>
+        addr === "0.0.0.0" || addr === "::" || addr === "*" ? 0 : String(addr).startsWith("127.") || addr === "::1" ? 2 : 1;
       return rank(a.addr) - rank(b.addr) || Number(a.port) - Number(b.port);
     })
     .slice(0, 16)

package/server/sat-i18n.mjs

@@ -68,6 +68,13 @@ const STR = {
     already_replace: "Replace — new login, old device is revoked",
     already_kept: "Left as is. Pulse sent. Same device in the cabinet.",
     already_no_key: "Daemon is on, but this user cannot read the key. Try: sudo orb44 status",
+    update_same: "Already {version}.",
+    update_wrote: "Updated to {version} → {path}",
+    update_need_root: "Cannot write the install tree. Run: sudo orb44 update",
+    update_no_tree: "No satellite install to overwrite. After install: sudo orb44 update. Until then pin npx.",
+    update_fail: "Update failed{err}",
+    update_npx: "Do not run bare npx @orb44/cli — pin: npx @orb44/cli@{version}",
+    update_restarted: "Restarted orb44-satellite.",
     advice_title: "What to do on this machine",
     advice_sub: "The cabinet will not run this — a leaked key must not become a remote shell.",
     preview_host: "host {h}",
@@ -109,6 +116,7 @@ const STR = {
   orb44 uninstall [--purge]
   orb44 lang [en|ru|ko|es]
   orb44 status
+  orb44 update
   orb44 logout
 
 Login asks language (saved) then daemon (default no).
@@ -164,6 +172,13 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     already_replace: "Заменить — новый login, старое устройство отзовётся",
     already_kept: "Оставили как есть. Пульс ушёл. В кабинете то же устройство.",
     already_no_key: "Демон работает, но этот пользователь не читает ключ. Попробуйте: sudo orb44 status",
+    update_same: "Уже {version}.",
+    update_wrote: "Обновлено до {version} → {path}",
+    update_need_root: "Нельзя записать дерево установки. Запустите: sudo orb44 update",
+    update_no_tree: "Нет дерева сателлита для перезаписи. После install: sudo orb44 update. До этого — pin в npx.",
+    update_fail: "Обновление не вышло{err}",
+    update_npx: "Не вызывайте голый npx @orb44/cli — pin: npx @orb44/cli@{version}",
+    update_restarted: "Демон orb44-satellite перезапущен.",
     advice_title: "Что сделать на этой машине",
     advice_sub: "Кабинет это не выполнит — иначе утечка ключа была бы удалённым шеллом.",
     preview_host: "хост {h}",
@@ -205,6 +220,7 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
   orb44 uninstall [--purge]
   orb44 lang [en|ru|ko|es]
   orb44 status
+  orb44 update
   orb44 logout
 
 После login спрашивает язык (запоминает), затем демон — по умолчанию нет.
@@ -260,6 +276,13 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     already_replace: "교체 — 새 login, 이전 장치는 취소됨",
     already_kept: "그대로 두었습니다. 펄스를 보냈습니다. 콘솔의 장치는 같습니다.",
     already_no_key: "데몬은 켜져 있지만 이 사용자는 키를 읽지 못합니다. sudo orb44 status",
+    update_same: "이미 {version}.",
+    update_wrote: "{version}(으)로 갱신 → {path}",
+    update_need_root: "설치 트리를 쓸 수 없습니다. sudo orb44 update",
+    update_no_tree: "덮어쓸 위성 설치가 없습니다. install 후 sudo orb44 update. 그 전에는 npx를 pin 하세요.",
+    update_fail: "업데이트 실패{err}",
+    update_npx: "버전 없는 npx @orb44/cli 는 쓰지 마세요 — pin: npx @orb44/cli@{version}",
+    update_restarted: "orb44-satellite 를 재시작했습니다.",
     advice_title: "이 기기에서 할 일",
     advice_sub: "콘솔은 실행하지 않습니다. 키 유출이 원격 셸이 되면 안 됩니다.",
     preview_host: "호스트 {h}",
@@ -301,6 +324,7 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
   orb44 uninstall [--purge]
   orb44 lang [en|ru|ko|es]
   orb44 status
+  orb44 update
   orb44 logout
 
 login에서 언어를 묻고 저장한 뒤, 데몬은 기본값 아니오입니다.
@@ -356,6 +380,13 @@ login에서 언어를 묻고 저장한 뒤, 데몬은 기본값 아니오입니
     already_replace: "Sustituir — login nuevo, se revoca el dispositivo anterior",
     already_kept: "Se dejó igual. Pulso enviado. El mismo dispositivo en el gabinete.",
     already_no_key: "El demonio está activo, pero este usuario no lee la clave. Pruebe: sudo orb44 status",
+    update_same: "Ya está {version}.",
+    update_wrote: "Actualizado a {version} → {path}",
+    update_need_root: "No se puede escribir el árbol. Ejecute: sudo orb44 update",
+    update_no_tree: "No hay instalación del satélite que sobrescribir. Tras install: sudo orb44 update. Mientras tanto, fije npx.",
+    update_fail: "La actualización falló{err}",
+    update_npx: "No use npx @orb44/cli sin versión — fije: npx @orb44/cli@{version}",
+    update_restarted: "orb44-satellite reiniciado.",
     advice_title: "Qué hacer en esta máquina",
     advice_sub: "El gabinete no lo ejecutará: una clave filtrada no debe ser un shell remoto.",
     preview_host: "host {h}",
@@ -397,6 +428,7 @@ login에서 언어를 묻고 저장한 뒤, 데몬은 기본값 아니오입니
   orb44 uninstall [--purge]
   orb44 lang [en|ru|ko|es]
   orb44 status
+  orb44 update
   orb44 logout
 
 Login pregunta idioma (lo guarda) y luego demonio (por defecto no).

package/server/sat-update.mjs

@@ -0,0 +1,104 @@
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+
+export const CLI_PACKAGE = "@orb44/cli";
+export const SAT_TREE_FILES = [
+  "bin/orb44.mjs",
+  "server/pulse.mjs",
+  "server/sat-i18n.mjs",
+  "server/cli-menu.mjs",
+  "server/sat-local.mjs",
+  "server/sat-update.mjs",
+  "package.json",
+];
+
+const REGISTRY_LATEST = "https://registry.npmjs.org/@orb44%2fcli/latest";
+
+export function cmpVer(a, b) {
+  const pa = String(a || "0").split(".").map((n) => Number(n) || 0);
+  const pb = String(b || "0").split(".").map((n) => Number(n) || 0);
+  const n = Math.max(pa.length, pb.length);
+  for (let i = 0; i < n; i++) {
+    const d = (pa[i] || 0) - (pb[i] || 0);
+    if (d) return d < 0 ? -1 : 1;
+  }
+  return 0;
+}
+
+export function looksLikeSat(root) {
+  const r = path.resolve(root);
+  if (!fs.existsSync(path.join(r, "bin", "orb44.mjs"))) return false;
+  if (!fs.existsSync(path.join(r, "server", "pulse.mjs"))) return false;
+  if (fs.existsSync(path.join(r, "server", "index.mjs"))) return false;
+  return true;
+}
+
+export function readCliVersion(scriptFile) {
+  const binDir = path.dirname(path.resolve(scriptFile));
+  const root = path.join(binDir, "..");
+  const candidates = [
+    path.join(root, "package.json"),
+    path.join(root, "packages", "orb44", "package.json"),
+  ];
+  for (const p of candidates) {
+    try {
+      const j = JSON.parse(fs.readFileSync(p, "utf8"));
+      if (j.name === CLI_PACKAGE && j.version) return String(j.version);
+    } catch {
+      /* next */
+    }
+  }
+  return "0.0.0";
+}
+
+export function pickSatRoots(scriptFile, { systemLib = "/usr/lib/orb44-sat" } = {}) {
+  const here = path.resolve(path.dirname(scriptFile), "..");
+  const out = [];
+  if (looksLikeSat(here)) out.push(here);
+  const lib = systemLib ? path.resolve(systemLib) : "";
+  if (lib && looksLikeSat(lib) && !out.includes(lib)) out.push(lib);
+  return out;
+}
+
+export function applyUpdateTree(srcPackageDir, destRoot) {
+  const src = path.resolve(srcPackageDir);
+  const dest = path.resolve(destRoot);
+  for (const rel of SAT_TREE_FILES) {
+    const from = path.join(src, rel);
+    if (!fs.existsSync(from)) {
+      if (rel === "package.json") continue;
+      throw new Error(`missing ${rel}`);
+    }
+    const to = path.join(dest, rel);
+    fs.mkdirSync(path.dirname(to), { recursive: true });
+    fs.copyFileSync(from, to);
+    fs.chmodSync(to, rel.endsWith("orb44.mjs") ? 0o755 : 0o644);
+  }
+  return dest;
+}
+
+export async function fetchLatestMeta(fetchFn = fetch) {
+  const r = await fetchFn(REGISTRY_LATEST, { headers: { Accept: "application/json" } });
+  if (!r?.ok) throw new Error(`registry ${r?.status || "fail"}`);
+  const j = await r.json();
+  const version = j?.version;
+  const tarball = j?.dist?.tarball;
+  if (!version || !tarball) throw new Error("registry meta");
+  return { version: String(version), tarball: String(tarball) };
+}
+
+export async function unpackTarball(url, tmp, fetchFn = fetch) {
+  const r = await fetchFn(url);
+  if (!r?.ok) throw new Error(`tarball ${r?.status || "fail"}`);
+  const buf = Buffer.from(await r.arrayBuffer());
+  const tgz = path.join(tmp, "pkg.tgz");
+  fs.writeFileSync(tgz, buf);
+  const unpack = path.join(tmp, "unpack");
+  fs.mkdirSync(unpack, { recursive: true });
+  const tar = spawnSync("tar", ["-xzf", tgz, "-C", unpack], { encoding: "utf8" });
+  if (tar.status !== 0) throw new Error((tar.stderr || tar.stdout || "tar").trim().slice(0, 200));
+  const pkg = path.join(unpack, "package");
+  if (!fs.existsSync(path.join(pkg, "bin", "orb44.mjs"))) throw new Error("bad tarball");
+  return pkg;
+}