@orb44/cli 0.1.4 → 0.1.6

package/README.md

@@ -13,10 +13,13 @@ npx @orb44/cli login --url https://orb44.com
 Open the printed link in a browser where you are already signed in, confirm the domain, then optionally install the systemd daemon (default no). After a global install the command is `orb44`.
 
 ```bash
-npx @orb44/cli status
-npx @orb44/cli pulse
-npx @orb44/cli install     # later: background pulse, starts after reboot
-npx @orb44/cli logout
+npx @orb44/cli@0.1.6 status
+npx @orb44/cli@0.1.6 pulse
+npx @orb44/cli@0.1.6 install     # later: background pulse, starts after reboot
+orb44 update                     # after install: replace /usr/lib/orb44-sat from npm
+npx @orb44/cli@0.1.6 logout
 ```
 
+Do not run bare `npx @orb44/cli` — it can reuse an old cache. Pin the version or use `orb44` after install.
+
 Device key: `~/.config/orb44/device.json` (mode 0600). Not a shell token.

package/bin/orb44.mjs

@@ -9,6 +9,8 @@ import { collectPulse, formatPulsePreview } from "../server/pulse.mjs";
 import { LANGS, LANG_LABEL, detectLang, normalizeLang, t } from "../server/sat-i18n.mjs";
 import { pickFromList } from "../server/cli-menu.mjs";
 import { SYSTEM_DEVICE, parseDeviceJson, hasExistingInstall, pickLiveDevice, deviceSearchPaths, loadFirstDevice, stripDevicePath } from "../server/sat-local.mjs";
+import { CLI_PACKAGE, cmpVer, readCliVersion, pickSatRoots, staleSatRoots, applyUpdateTree, fetchLatestMeta, unpackTarball } from "../server/sat-update.mjs";
+import { cabinetRequest, apiFailText } from "../server/sat-http.mjs";
 
 const DEVICE_FILE = process.env.ORB44_DEVICE_FILE || path.join(os.homedir(), ".config", "orb44", "device.json");
 const CLI_FILE = process.env.ORB44_CLI_FILE || path.join(path.dirname(DEVICE_FILE), "cli.json");
@@ -81,16 +83,12 @@ function clearDevice() {
   }
 }
 
-async function api(url, pathname, { method = "GET", json, secret } = {}) {
-  const headers = { "Content-Type": "application/json", Accept: "application/json" };
-  if (secret) headers.Authorization = `Bearer ${secret}`;
-  const r = await fetch(`${url.replace(/\/$/, "")}${pathname}`, {
-    method,
-    headers,
-    body: json ? JSON.stringify(json) : undefined,
-  });
-  const body = await r.json().catch(() => ({}));
-  return { ok: r.ok, status: r.status, body };
+function api(url, pathname, opts) {
+  return cabinetRequest(url, pathname, opts);
+}
+
+function failLine(out, fallbackKey = "pulse_fail") {
+  return "⚠️  " + apiFailText(lang, out, t, fallbackKey);
 }
 
 function dim(s) {
@@ -258,7 +256,7 @@ async function cmdLogin(opts) {
       }
       const { out } = await sendPulse(live);
       if (!out.ok) {
-        console.error(`⚠️  ${out.body.error || t(lang, "pulse_fail")}`);
+        console.error(failLine(out));
         process.exit(1);
       }
       console.log("\n📡  " + t(lang, "pulse_ok"));
@@ -275,7 +273,7 @@ async function cmdLogin(opts) {
     json: { hostname, name },
   });
   if (!begin.ok || !begin.body.pollToken) {
-    console.error(`⚠️  ${begin.body.error || t(lang, "pair_fail")}`);
+    console.error(failLine(begin, "pair_fail"));
     process.exit(1);
   }
   console.log(`🔗  API ${url}`);
@@ -319,7 +317,7 @@ async function cmdLogin(opts) {
 
   const { out } = await sendPulse(device);
   if (!out.ok) {
-    console.error(`⚠️  ${out.body.error || t(lang, "pulse_fail")}`);
+    console.error(failLine(out));
     process.exit(1);
   }
   console.log("\n📡  " + t(lang, "pulse_ok"));
@@ -349,10 +347,7 @@ async function cmdPulse() {
   banner();
   const { out } = await sendPulse(device);
   if (!out.ok) {
-    console.error(
-      "⚠️  " +
-        (out.body.error === "bad_secret" || out.body.error === "not_found" ? t(lang, "key_revoked") : out.body.error || t(lang, "pulse_fail"))
-    );
+    console.error(failLine(out));
     process.exit(1);
   }
   console.log("\n📡  " + t(lang, "pulse_ok"));
@@ -369,14 +364,17 @@ async function cmdDaemon(opts) {
   const sec = intervalSec(opts.interval);
   console.log(`🛰️  ${t(lang, "daemon_run", { sec, host: device.host })}`);
   const tick = async () => {
-    const { out, pulse } = await sendPulse(device, { preview: false });
     const hh = new Date().toISOString().slice(11, 19);
-    if (!out.ok) {
-      const gone = out.body.error === "bad_secret" || out.body.error === "not_found";
-      console.error(`⚠️  ${hh} ${gone ? t(lang, "daemon_revoked") : out.body.error || t(lang, "pulse_fail")}`);
-      return;
+    try {
+      const { out, pulse } = await sendPulse(device, { preview: false });
+      if (!out.ok) {
+        console.error(`⚠️  ${hh} ${apiFailText(lang, out, t)}`);
+        return;
+      }
+      console.log(`📡  ${hh} ok  load ${pulse.load1}  ${pulse.gradeInside || "—"}`);
+    } catch (e) {
+      console.error(`⚠️  ${hh} ${String(e?.message || e).split("\n")[0].slice(0, 200)}`);
     }
-    console.log(`📡  ${hh} ok  load ${pulse.load1}  ${pulse.gradeInside || "—"}`);
   };
   await tick();
   const id = setInterval(tick, sec * 1000);
@@ -422,25 +420,19 @@ function linkSystemCli(node, script) {
   fs.writeFileSync(CLI_LINK, body, { mode: 0o755 });
 }
 
-function satServerDir() {
-  return path.join(path.dirname(SCRIPT), "..", "server");
-}
-
 function installSystemTree() {
   const lib = "/usr/lib/orb44-sat";
-  const serverSrc = satServerDir();
+  const srcRoot = path.join(path.dirname(SCRIPT), "..");
   fs.mkdirSync(path.join(lib, "bin"), { recursive: true, mode: 0o755 });
   fs.mkdirSync(path.join(lib, "server"), { recursive: true, mode: 0o755 });
-  const copies = [
-    [SCRIPT, path.join(lib, "bin", "orb44.mjs")],
-    [path.join(serverSrc, "pulse.mjs"), path.join(lib, "server", "pulse.mjs")],
-    [path.join(serverSrc, "sat-i18n.mjs"), path.join(lib, "server", "sat-i18n.mjs")],
-    [path.join(serverSrc, "cli-menu.mjs"), path.join(lib, "server", "cli-menu.mjs")],
-    [path.join(serverSrc, "sat-local.mjs"), path.join(lib, "server", "sat-local.mjs")],
-  ];
-  for (const [from, to] of copies) {
-    fs.copyFileSync(from, to);
-    fs.chmodSync(to, 0o644);
+  applyUpdateTree(srcRoot, lib);
+  const ver = readCliVersion(SCRIPT);
+  if (ver && ver !== "0.0.0") {
+    fs.writeFileSync(
+      path.join(lib, "package.json"),
+      JSON.stringify({ name: CLI_PACKAGE, version: ver, type: "module", private: true }, null, 2) + "\n",
+      { mode: 0o644 }
+    );
   }
   return path.join(lib, "bin", "orb44.mjs");
 }
@@ -640,6 +632,63 @@ async function cmdUninstall(opts) {
   console.log(dim(t(lang, "uninstall_key_kept", { file: SYSTEM_DEVICE })));
 }
 
+async function cmdUpdate() {
+  applyLang(opts);
+  const current = readCliVersion(SCRIPT);
+  let meta;
+  try {
+    meta = await fetchLatestMeta();
+  } catch (e) {
+    console.error("⚠️  " + t(lang, "update_fail", { err: `: ${String(e.message || e).slice(0, 160)}` }));
+    process.exit(1);
+  }
+  const pin = t(lang, "update_npx", { version: meta.version });
+  const roots = pickSatRoots(SCRIPT);
+  const stale = staleSatRoots(roots, meta.version, { force: Boolean(opts.force) });
+  if (!roots.length) {
+    console.error("⚠️  " + t(lang, "update_no_tree"));
+    console.log(dim(pin));
+    process.exit(1);
+  }
+  if (!stale.length) {
+    console.log("✅  " + t(lang, "update_same", { version: current || meta.version }));
+    console.log(dim(pin));
+    return;
+  }
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "orb44-upd-"));
+  let wrote = [];
+  try {
+    const pkg = await unpackTarball(meta.tarball, tmp);
+    const blocked = [];
+    for (const root of stale) {
+      try {
+        applyUpdateTree(pkg, root);
+        wrote.push(root);
+      } catch (e) {
+        blocked.push({ root, err: String(e.message || e).slice(0, 160) });
+      }
+    }
+    if (!wrote.length) {
+      console.error("⚠️  " + t(lang, blocked.some((b) => /EACCES|permission/i.test(b.err)) ? "update_need_root" : "update_fail", { err: blocked[0]?.err ? `: ${blocked[0].err}` : "" }));
+      process.exit(1);
+    }
+  } finally {
+    try {
+      fs.rmSync(tmp, { recursive: true, force: true });
+    } catch {
+      /* tmp */
+    }
+  }
+  for (const root of wrote) {
+    console.log("✅  " + t(lang, "update_wrote", { version: meta.version, path: root }));
+  }
+  if (wrote.includes("/usr/lib/orb44-sat") && serviceIsActive(true)) {
+    spawnSync("systemctl", ["try-restart", "orb44-satellite"], { encoding: "utf8" });
+    console.log(dim(t(lang, "update_restarted")));
+  }
+  console.log(dim(pin));
+}
+
 function cmdStatus() {
   applyLang(opts);
   const device = loadDevice();
@@ -662,7 +711,7 @@ async function cmdLogout() {
   applyLang(opts);
   const device = loadDevice();
   if (device?.secret) {
-    await api(device.api, "/api/satellites/logout", { method: "POST", json: { secret: device.secret } });
+    await api(device.api, "/api/satellites/logout", { method: "POST", json: { secret: device.secret } }).catch(() => {});
   }
   clearDevice();
   console.log("✅  " + t(lang, "logged_out"));
@@ -708,6 +757,7 @@ const run = {
   install: () => cmdInstall(opts, { enable: true }),
   uninstall: () => cmdUninstall(opts),
   status: cmdStatus,
+  update: cmdUpdate,
   logout: cmdLogout,
   lang: () => cmdLang(opts),
   help,
@@ -717,4 +767,9 @@ if (!fn) {
   help();
   process.exit(1);
 }
-await fn();
+try {
+  await fn();
+} catch (e) {
+  console.error("⚠️  " + String(e?.message || e).split("\n")[0].slice(0, 200));
+  process.exit(1);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orb44/cli",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "Orb44: street snapshot of your site. This CLI is the Watch satellite — pulse from the host (load, listeners, hardening). The cabinet does not run commands on the machine.",
   "type": "module",
   "bin": {
@@ -11,7 +11,9 @@
     "server/pulse.mjs",
     "server/sat-i18n.mjs",
     "server/cli-menu.mjs",
-    "server/sat-local.mjs"
+    "server/sat-local.mjs",
+    "server/sat-http.mjs",
+    "server/sat-update.mjs"
   ],
   "engines": {
     "node": ">=18"

package/server/pulse.mjs

@@ -174,11 +174,38 @@ function topTable() {
 
 function okListenAddr(a) {
   const s = String(a || "");
-  if (s === "0.0.0.0" || s === "::" || s === "::1") return true;
+  if (s === "0.0.0.0" || s === "::" || s === "::1" || s === "*") return true;
   if (/^\d{1,3}(\.\d{1,3}){3}$/.test(s)) return true;
   return /^[0-9a-fA-F:]+$/.test(s) && s.includes(":");
 }
 
+export function collapseListen(rows = []) {
+  const world = [];
+  const rest = [];
+  for (const r of rows) {
+    if (r.addr === "0.0.0.0" || r.addr === "::" || r.addr === "*") world.push(r);
+    else rest.push(r);
+  }
+  const byPort = new Map();
+  for (const r of world) {
+    const port = Number(r.port);
+    if (!byPort.has(port)) byPort.set(port, []);
+    byPort.get(port).push(r);
+  }
+  const out = [];
+  for (const list of byPort.values()) {
+    const addrs = new Set(list.map((x) => x.addr));
+    const comm = list.find((x) => x.comm)?.comm || list[0].comm;
+    if (addrs.has("*") || (addrs.has("0.0.0.0") && addrs.has("::"))) {
+      out.push({ addr: "*", port: list[0].port, comm });
+    } else {
+      out.push(...list);
+    }
+  }
+  out.push(...rest);
+  return out;
+}
+
 export function sanitizePulse(raw = {}) {
   const top = Array.isArray(raw.top)
     ? raw.top
@@ -190,16 +217,18 @@ export function sanitizePulse(raw = {}) {
         }))
         .filter((r) => r.comm)
     : [];
-  const listen = Array.isArray(raw.listen)
-    ? raw.listen
-        .slice(0, 40)
-        .map((r) => ({
-          addr: String(r.addr || "").slice(0, 45),
-          port: Number(r.port) || 0,
-          comm: sanitizeComm(r.comm),
-        }))
-        .filter((r) => r.port > 0 && r.port < 65536 && okListenAddr(r.addr))
-    : [];
+  const listen = collapseListen(
+    Array.isArray(raw.listen)
+      ? raw.listen
+          .slice(0, 40)
+          .map((r) => ({
+            addr: String(r.addr || "").slice(0, 45),
+            port: Number(r.port) || 0,
+            comm: sanitizeComm(r.comm),
+          }))
+          .filter((r) => r.port > 0 && r.port < 65536 && okListenAddr(r.addr))
+      : []
+  );
   const originA = Array.isArray(raw.originA)
     ? raw.originA.map((x) => String(x || "")).filter((x) => /^\d{1,3}(\.\d{1,3}){3}$/.test(x)).slice(0, 8)
     : [];
@@ -710,9 +739,10 @@ export function formatPulsePreview(pulse, lang = "en") {
       [t(lang, "preview_row_grade"), grade],
     ]
   );
-  const listenRows = [...(pulse.listen || [])]
+  const listenRows = collapseListen([...(pulse.listen || [])])
     .sort((a, b) => {
-      const rank = (addr) => (addr === "0.0.0.0" || addr === "::" ? 0 : String(addr).startsWith("127.") || addr === "::1" ? 2 : 1);
+      const rank = (addr) =>
+        addr === "0.0.0.0" || addr === "::" || addr === "*" ? 0 : String(addr).startsWith("127.") || addr === "::1" ? 2 : 1;
       return rank(a.addr) - rank(b.addr) || Number(a.port) - Number(b.port);
     })
     .slice(0, 16)

package/server/sat-http.mjs

@@ -0,0 +1,65 @@
+export const FETCH_MS = 15_000;
+
+const NET_CODES = new Set([
+  "ECONNREFUSED",
+  "ECONNRESET",
+  "ECONNABORTED",
+  "EHOSTUNREACH",
+  "ENETUNREACH",
+  "EPIPE",
+  "EAI_AGAIN",
+  "ENOTFOUND",
+]);
+
+export function classifyNetError(err) {
+  const cause = err?.cause && typeof err.cause === "object" ? err.cause : err;
+  const code = String(cause?.code || err?.code || "");
+  const name = String(err?.name || cause?.name || "");
+  const msg = `${cause?.message || ""} ${err?.message || ""}`;
+  if (name === "TimeoutError" || name === "AbortError" || code === "ABORT_ERR" || /timeout|aborted/i.test(msg)) {
+    return "timeout";
+  }
+  if (/CERT|UNABLE_TO_VERIFY|ERR_TLS|ERR_SSL/i.test(`${code} ${msg}`)) return "tls";
+  if (code === "ENOTFOUND" || code === "EAI_AGAIN" || /getaddrinfo/i.test(msg)) return "dns";
+  if (NET_CODES.has(code) || /fetch failed|socket hang up/i.test(msg)) return "unreachable";
+  return "unreachable";
+}
+
+export function cabinetFail(url, err) {
+  return {
+    ok: false,
+    status: 0,
+    body: { error: classifyNetError(err), url: String(url || "").replace(/\/$/, "") },
+  };
+}
+
+export async function cabinetRequest(url, pathname, { method = "GET", json, secret, fetchImpl = fetch, timeoutMs = FETCH_MS } = {}) {
+  const base = String(url || "").replace(/\/$/, "");
+  const headers = { "Content-Type": "application/json", Accept: "application/json" };
+  if (secret) headers.Authorization = `Bearer ${secret}`;
+  const signal = timeoutMs > 0 && typeof AbortSignal !== "undefined" && AbortSignal.timeout ? AbortSignal.timeout(timeoutMs) : undefined;
+  try {
+    const r = await fetchImpl(`${base}${pathname}`, {
+      method,
+      headers,
+      body: json ? JSON.stringify(json) : undefined,
+      signal,
+    });
+    const body = await r.json().catch(() => ({}));
+    return { ok: Boolean(r.ok), status: r.status, body };
+  } catch (err) {
+    return cabinetFail(base, err);
+  }
+}
+
+export function apiFailText(lang, out, t, fallbackKey = "pulse_fail") {
+  const err = out?.body?.error;
+  const url = out?.body?.url || "";
+  if (err === "unreachable") return t(lang, "cabinet_down", { url });
+  if (err === "timeout") return t(lang, "cabinet_timeout", { url });
+  if (err === "tls") return t(lang, "cabinet_tls", { url });
+  if (err === "dns") return t(lang, "cabinet_dns", { url });
+  if (err === "bad_secret" || err === "not_found") return t(lang, "key_revoked");
+  if (typeof err === "string" && /^[a-z][a-z0-9_]{0,40}$/.test(err)) return err;
+  return t(lang, fallbackKey);
+}

package/server/sat-i18n.mjs

@@ -35,6 +35,10 @@ const STR = {
     payload: "What goes to the cabinet",
     pulse_ok: "Pulse is in the cabinet.",
     pulse_fail: "pulse not accepted",
+    cabinet_down: "Cabinet is not reachable ({url}). Start the cabinet or the tunnel to it.",
+    cabinet_timeout: "Cabinet did not answer ({url}). Try again later.",
+    cabinet_tls: "TLS to the cabinet failed ({url}).",
+    cabinet_dns: "Cannot resolve the cabinet host ({url}).",
     pair_fail: "could not start pairing",
     ask_daemon: "Install as a Watch daemon?\nRuns in the background and starts again after reboot. Pulse every 5 min.",
     daemon_no: "No",
@@ -68,6 +72,13 @@ const STR = {
     already_replace: "Replace — new login, old device is revoked",
     already_kept: "Left as is. Pulse sent. Same device in the cabinet.",
     already_no_key: "Daemon is on, but this user cannot read the key. Try: sudo orb44 status",
+    update_same: "Already {version}.",
+    update_wrote: "Updated to {version} → {path}",
+    update_need_root: "Cannot write the install tree. Run: sudo orb44 update",
+    update_no_tree: "No satellite install to overwrite. After install: sudo orb44 update. Until then pin npx.",
+    update_fail: "Update failed{err}",
+    update_npx: "Do not run bare npx @orb44/cli — pin: npx @orb44/cli@{version}",
+    update_restarted: "Restarted orb44-satellite.",
     advice_title: "What to do on this machine",
     advice_sub: "The cabinet will not run this — a leaked key must not become a remote shell.",
     preview_host: "host {h}",
@@ -109,6 +120,7 @@ const STR = {
   orb44 uninstall [--purge]
   orb44 lang [en|ru|ko|es]
   orb44 status
+  orb44 update
   orb44 logout
 
 Login asks language (saved) then daemon (default no).
@@ -131,6 +143,10 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     payload: "Что уходит в кабинет",
     pulse_ok: "Пульс в кабинете.",
     pulse_fail: "пульс не принят",
+    cabinet_down: "Кабинет недоступен ({url}). Поднимите кабинет или туннель к нему.",
+    cabinet_timeout: "Кабинет не ответил ({url}). Повторите позже.",
+    cabinet_tls: "TLS к кабинету не сошёлся ({url}).",
+    cabinet_dns: "Не резолвится хост кабинета ({url}).",
     pair_fail: "не удалось начать пару",
     ask_daemon: "Поставить Watch-демоном?\nБудет работать в фоне и подниматься после перезагрузки. Пульс каждые 5 мин.",
     daemon_no: "Нет",
@@ -164,6 +180,13 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     already_replace: "Заменить — новый login, старое устройство отзовётся",
     already_kept: "Оставили как есть. Пульс ушёл. В кабинете то же устройство.",
     already_no_key: "Демон работает, но этот пользователь не читает ключ. Попробуйте: sudo orb44 status",
+    update_same: "Уже {version}.",
+    update_wrote: "Обновлено до {version} → {path}",
+    update_need_root: "Нельзя записать дерево установки. Запустите: sudo orb44 update",
+    update_no_tree: "Нет дерева сателлита для перезаписи. После install: sudo orb44 update. До этого — pin в npx.",
+    update_fail: "Обновление не вышло{err}",
+    update_npx: "Не вызывайте голый npx @orb44/cli — pin: npx @orb44/cli@{version}",
+    update_restarted: "Демон orb44-satellite перезапущен.",
     advice_title: "Что сделать на этой машине",
     advice_sub: "Кабинет это не выполнит — иначе утечка ключа была бы удалённым шеллом.",
     preview_host: "хост {h}",
@@ -205,6 +228,7 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
   orb44 uninstall [--purge]
   orb44 lang [en|ru|ko|es]
   orb44 status
+  orb44 update
   orb44 logout
 
 После login спрашивает язык (запоминает), затем демон — по умолчанию нет.
@@ -227,6 +251,10 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     payload: "콘솔로 보내는 내용",
     pulse_ok: "펄스가 콘솔에 있습니다.",
     pulse_fail: "펄스 거부",
+    cabinet_down: "콘솔에 연결할 수 없습니다 ({url}). 콘솔 또는 터널을 올리세요.",
+    cabinet_timeout: "콘솔이 응답하지 않습니다 ({url}). 나중에 다시 시도하세요.",
+    cabinet_tls: "콘솔 TLS 실패 ({url}).",
+    cabinet_dns: "콘솔 호스트를 찾지 못했습니다 ({url}).",
     pair_fail: "페어링을 시작하지 못했습니다",
     ask_daemon: "Watch 데몬으로 설치할까요?\n백그라운드에서 돌고 재부팅 후에도 올라옵니다. 5분마다 펄스.",
     daemon_no: "아니요",
@@ -260,6 +288,13 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     already_replace: "교체 — 새 login, 이전 장치는 취소됨",
     already_kept: "그대로 두었습니다. 펄스를 보냈습니다. 콘솔의 장치는 같습니다.",
     already_no_key: "데몬은 켜져 있지만 이 사용자는 키를 읽지 못합니다. sudo orb44 status",
+    update_same: "이미 {version}.",
+    update_wrote: "{version}(으)로 갱신 → {path}",
+    update_need_root: "설치 트리를 쓸 수 없습니다. sudo orb44 update",
+    update_no_tree: "덮어쓸 위성 설치가 없습니다. install 후 sudo orb44 update. 그 전에는 npx를 pin 하세요.",
+    update_fail: "업데이트 실패{err}",
+    update_npx: "버전 없는 npx @orb44/cli 는 쓰지 마세요 — pin: npx @orb44/cli@{version}",
+    update_restarted: "orb44-satellite 를 재시작했습니다.",
     advice_title: "이 기기에서 할 일",
     advice_sub: "콘솔은 실행하지 않습니다. 키 유출이 원격 셸이 되면 안 됩니다.",
     preview_host: "호스트 {h}",
@@ -301,6 +336,7 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
   orb44 uninstall [--purge]
   orb44 lang [en|ru|ko|es]
   orb44 status
+  orb44 update
   orb44 logout
 
 login에서 언어를 묻고 저장한 뒤, 데몬은 기본값 아니오입니다.
@@ -323,6 +359,10 @@ login에서 언어를 묻고 저장한 뒤, 데몬은 기본값 아니오입니
     payload: "Qué se envía al gabinete",
     pulse_ok: "Pulso en el gabinete.",
     pulse_fail: "pulso rechazado",
+    cabinet_down: "El gabinete no responde ({url}). Levante el gabinete o el túnel.",
+    cabinet_timeout: "El gabinete no contestó ({url}). Pruebe más tarde.",
+    cabinet_tls: "Falló TLS al gabinete ({url}).",
+    cabinet_dns: "No se resuelve el host del gabinete ({url}).",
     pair_fail: "no se pudo iniciar el emparejamiento",
     ask_daemon: "¿Instalar como demonio Watch?\nCorre en segundo plano y arranca de nuevo tras el reinicio. Pulso cada 5 min.",
     daemon_no: "No",
@@ -356,6 +396,13 @@ login에서 언어를 묻고 저장한 뒤, 데몬은 기본값 아니오입니
     already_replace: "Sustituir — login nuevo, se revoca el dispositivo anterior",
     already_kept: "Se dejó igual. Pulso enviado. El mismo dispositivo en el gabinete.",
     already_no_key: "El demonio está activo, pero este usuario no lee la clave. Pruebe: sudo orb44 status",
+    update_same: "Ya está {version}.",
+    update_wrote: "Actualizado a {version} → {path}",
+    update_need_root: "No se puede escribir el árbol. Ejecute: sudo orb44 update",
+    update_no_tree: "No hay instalación del satélite que sobrescribir. Tras install: sudo orb44 update. Mientras tanto, fije npx.",
+    update_fail: "La actualización falló{err}",
+    update_npx: "No use npx @orb44/cli sin versión — fije: npx @orb44/cli@{version}",
+    update_restarted: "orb44-satellite reiniciado.",
     advice_title: "Qué hacer en esta máquina",
     advice_sub: "El gabinete no lo ejecutará: una clave filtrada no debe ser un shell remoto.",
     preview_host: "host {h}",
@@ -397,6 +444,7 @@ login에서 언어를 묻고 저장한 뒤, 데몬은 기본값 아니오입니
   orb44 uninstall [--purge]
   orb44 lang [en|ru|ko|es]
   orb44 status
+  orb44 update
   orb44 logout
 
 Login pregunta idioma (lo guarda) y luego demonio (por defecto no).

package/server/sat-update.mjs

@@ -0,0 +1,123 @@
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+
+export const CLI_PACKAGE = "@orb44/cli";
+export const SAT_TREE_FILES = [
+  "bin/orb44.mjs",
+  "server/pulse.mjs",
+  "server/sat-i18n.mjs",
+  "server/cli-menu.mjs",
+  "server/sat-local.mjs",
+  "server/sat-http.mjs",
+  "server/sat-update.mjs",
+  "package.json",
+];
+
+const REGISTRY_LATEST = "https://registry.npmjs.org/@orb44%2fcli/latest";
+
+export function cmpVer(a, b) {
+  const pa = String(a || "0").split(".").map((n) => Number(n) || 0);
+  const pb = String(b || "0").split(".").map((n) => Number(n) || 0);
+  const n = Math.max(pa.length, pb.length);
+  for (let i = 0; i < n; i++) {
+    const d = (pa[i] || 0) - (pb[i] || 0);
+    if (d) return d < 0 ? -1 : 1;
+  }
+  return 0;
+}
+
+export function looksLikeSat(root) {
+  const r = path.resolve(root);
+  if (!fs.existsSync(path.join(r, "bin", "orb44.mjs"))) return false;
+  if (!fs.existsSync(path.join(r, "server", "pulse.mjs"))) return false;
+  if (fs.existsSync(path.join(r, "server", "index.mjs"))) return false;
+  return true;
+}
+
+export function readCliVersion(scriptFile) {
+  const binDir = path.dirname(path.resolve(scriptFile));
+  const root = path.join(binDir, "..");
+  const candidates = [
+    path.join(root, "package.json"),
+    path.join(root, "packages", "orb44", "package.json"),
+  ];
+  for (const p of candidates) {
+    try {
+      const j = JSON.parse(fs.readFileSync(p, "utf8"));
+      if (j.name === CLI_PACKAGE && j.version) return String(j.version);
+    } catch {
+      /* next */
+    }
+  }
+  return "0.0.0";
+}
+
+export function treeNeedsRefresh(root, latest, { force = false } = {}) {
+  if (force) return true;
+  const ver = readCliVersion(path.join(root, "bin", "orb44.mjs"));
+  if (cmpVer(ver, latest) < 0) return true;
+  try {
+    const pulse = fs.readFileSync(path.join(root, "server", "pulse.mjs"), "utf8");
+    if (!pulse.includes("function collapseListen")) return true;
+    if (!fs.existsSync(path.join(root, "server", "sat-http.mjs"))) return true;
+  } catch {
+    return true;
+  }
+  return false;
+}
+
+export function staleSatRoots(roots, latest, opts = {}) {
+  return (roots || []).filter((r) => treeNeedsRefresh(r, latest, opts));
+}
+
+export function pickSatRoots(scriptFile, { systemLib = "/usr/lib/orb44-sat" } = {}) {
+  const here = path.resolve(path.dirname(scriptFile), "..");
+  const out = [];
+  if (looksLikeSat(here)) out.push(here);
+  const lib = systemLib ? path.resolve(systemLib) : "";
+  if (lib && looksLikeSat(lib) && !out.includes(lib)) out.push(lib);
+  return out;
+}
+
+export function applyUpdateTree(srcPackageDir, destRoot) {
+  const src = path.resolve(srcPackageDir);
+  const dest = path.resolve(destRoot);
+  for (const rel of SAT_TREE_FILES) {
+    const from = path.join(src, rel);
+    if (!fs.existsSync(from)) {
+      if (rel === "package.json") continue;
+      throw new Error(`missing ${rel}`);
+    }
+    const to = path.join(dest, rel);
+    fs.mkdirSync(path.dirname(to), { recursive: true });
+    fs.copyFileSync(from, to);
+    fs.chmodSync(to, rel.endsWith("orb44.mjs") ? 0o755 : 0o644);
+  }
+  return dest;
+}
+
+export async function fetchLatestMeta(fetchFn = fetch) {
+  const r = await fetchFn(REGISTRY_LATEST, { headers: { Accept: "application/json" } });
+  if (!r?.ok) throw new Error(`registry ${r?.status || "fail"}`);
+  const j = await r.json();
+  const version = j?.version;
+  const tarball = j?.dist?.tarball;
+  if (!version || !tarball) throw new Error("registry meta");
+  return { version: String(version), tarball: String(tarball) };
+}
+
+export async function unpackTarball(url, tmp, fetchFn = fetch) {
+  const r = await fetchFn(url);
+  if (!r?.ok) throw new Error(`tarball ${r?.status || "fail"}`);
+  const buf = Buffer.from(await r.arrayBuffer());
+  const tgz = path.join(tmp, "pkg.tgz");
+  fs.writeFileSync(tgz, buf);
+  const unpack = path.join(tmp, "unpack");
+  fs.mkdirSync(unpack, { recursive: true });
+  const tar = spawnSync("tar", ["-xzf", tgz, "-C", unpack], { encoding: "utf8" });
+  if (tar.status !== 0) throw new Error((tar.stderr || tar.stdout || "tar").trim().slice(0, 200));
+  const pkg = path.join(unpack, "package");
+  if (!fs.existsSync(path.join(pkg, "bin", "orb44.mjs"))) throw new Error("bad tarball");
+  return pkg;
+}