@orb44/cli 0.1.5 → 0.1.6

package/README.md

@@ -13,11 +13,11 @@ npx @orb44/cli login --url https://orb44.com
 Open the printed link in a browser where you are already signed in, confirm the domain, then optionally install the systemd daemon (default no). After a global install the command is `orb44`.
 
 ```bash
-npx @orb44/cli@0.1.5 status
-npx @orb44/cli@0.1.5 pulse
-npx @orb44/cli@0.1.5 install     # later: background pulse, starts after reboot
+npx @orb44/cli@0.1.6 status
+npx @orb44/cli@0.1.6 pulse
+npx @orb44/cli@0.1.6 install     # later: background pulse, starts after reboot
 orb44 update                     # after install: replace /usr/lib/orb44-sat from npm
-npx @orb44/cli@0.1.5 logout
+npx @orb44/cli@0.1.6 logout
 ```
 
 Do not run bare `npx @orb44/cli` — it can reuse an old cache. Pin the version or use `orb44` after install.

package/bin/orb44.mjs

@@ -9,7 +9,8 @@ import { collectPulse, formatPulsePreview } from "../server/pulse.mjs";
 import { LANGS, LANG_LABEL, detectLang, normalizeLang, t } from "../server/sat-i18n.mjs";
 import { pickFromList } from "../server/cli-menu.mjs";
 import { SYSTEM_DEVICE, parseDeviceJson, hasExistingInstall, pickLiveDevice, deviceSearchPaths, loadFirstDevice, stripDevicePath } from "../server/sat-local.mjs";
-import { CLI_PACKAGE, cmpVer, readCliVersion, pickSatRoots, applyUpdateTree, fetchLatestMeta, unpackTarball } from "../server/sat-update.mjs";
+import { CLI_PACKAGE, cmpVer, readCliVersion, pickSatRoots, staleSatRoots, applyUpdateTree, fetchLatestMeta, unpackTarball } from "../server/sat-update.mjs";
+import { cabinetRequest, apiFailText } from "../server/sat-http.mjs";
 
 const DEVICE_FILE = process.env.ORB44_DEVICE_FILE || path.join(os.homedir(), ".config", "orb44", "device.json");
 const CLI_FILE = process.env.ORB44_CLI_FILE || path.join(path.dirname(DEVICE_FILE), "cli.json");
@@ -82,16 +83,12 @@ function clearDevice() {
   }
 }
 
-async function api(url, pathname, { method = "GET", json, secret } = {}) {
-  const headers = { "Content-Type": "application/json", Accept: "application/json" };
-  if (secret) headers.Authorization = `Bearer ${secret}`;
-  const r = await fetch(`${url.replace(/\/$/, "")}${pathname}`, {
-    method,
-    headers,
-    body: json ? JSON.stringify(json) : undefined,
-  });
-  const body = await r.json().catch(() => ({}));
-  return { ok: r.ok, status: r.status, body };
+function api(url, pathname, opts) {
+  return cabinetRequest(url, pathname, opts);
+}
+
+function failLine(out, fallbackKey = "pulse_fail") {
+  return "⚠️  " + apiFailText(lang, out, t, fallbackKey);
 }
 
 function dim(s) {
@@ -259,7 +256,7 @@ async function cmdLogin(opts) {
       }
       const { out } = await sendPulse(live);
       if (!out.ok) {
-        console.error(`⚠️  ${out.body.error || t(lang, "pulse_fail")}`);
+        console.error(failLine(out));
         process.exit(1);
       }
       console.log("\n📡  " + t(lang, "pulse_ok"));
@@ -276,7 +273,7 @@ async function cmdLogin(opts) {
     json: { hostname, name },
   });
   if (!begin.ok || !begin.body.pollToken) {
-    console.error(`⚠️  ${begin.body.error || t(lang, "pair_fail")}`);
+    console.error(failLine(begin, "pair_fail"));
     process.exit(1);
   }
   console.log(`🔗  API ${url}`);
@@ -320,7 +317,7 @@ async function cmdLogin(opts) {
 
   const { out } = await sendPulse(device);
   if (!out.ok) {
-    console.error(`⚠️  ${out.body.error || t(lang, "pulse_fail")}`);
+    console.error(failLine(out));
     process.exit(1);
   }
   console.log("\n📡  " + t(lang, "pulse_ok"));
@@ -350,10 +347,7 @@ async function cmdPulse() {
   banner();
   const { out } = await sendPulse(device);
   if (!out.ok) {
-    console.error(
-      "⚠️  " +
-        (out.body.error === "bad_secret" || out.body.error === "not_found" ? t(lang, "key_revoked") : out.body.error || t(lang, "pulse_fail"))
-    );
+    console.error(failLine(out));
     process.exit(1);
   }
   console.log("\n📡  " + t(lang, "pulse_ok"));
@@ -370,14 +364,17 @@ async function cmdDaemon(opts) {
   const sec = intervalSec(opts.interval);
   console.log(`🛰️  ${t(lang, "daemon_run", { sec, host: device.host })}`);
   const tick = async () => {
-    const { out, pulse } = await sendPulse(device, { preview: false });
     const hh = new Date().toISOString().slice(11, 19);
-    if (!out.ok) {
-      const gone = out.body.error === "bad_secret" || out.body.error === "not_found";
-      console.error(`⚠️  ${hh} ${gone ? t(lang, "daemon_revoked") : out.body.error || t(lang, "pulse_fail")}`);
-      return;
+    try {
+      const { out, pulse } = await sendPulse(device, { preview: false });
+      if (!out.ok) {
+        console.error(`⚠️  ${hh} ${apiFailText(lang, out, t)}`);
+        return;
+      }
+      console.log(`📡  ${hh} ok  load ${pulse.load1}  ${pulse.gradeInside || "—"}`);
+    } catch (e) {
+      console.error(`⚠️  ${hh} ${String(e?.message || e).split("\n")[0].slice(0, 200)}`);
     }
-    console.log(`📡  ${hh} ok  load ${pulse.load1}  ${pulse.gradeInside || "—"}`);
   };
   await tick();
   const id = setInterval(tick, sec * 1000);
@@ -646,23 +643,24 @@ async function cmdUpdate() {
     process.exit(1);
   }
   const pin = t(lang, "update_npx", { version: meta.version });
-  if (cmpVer(current, meta.version) >= 0 && !opts.force) {
-    console.log("✅  " + t(lang, "update_same", { version: current }));
-    console.log(dim(pin));
-    return;
-  }
   const roots = pickSatRoots(SCRIPT);
+  const stale = staleSatRoots(roots, meta.version, { force: Boolean(opts.force) });
   if (!roots.length) {
     console.error("⚠️  " + t(lang, "update_no_tree"));
     console.log(dim(pin));
     process.exit(1);
   }
+  if (!stale.length) {
+    console.log("✅  " + t(lang, "update_same", { version: current || meta.version }));
+    console.log(dim(pin));
+    return;
+  }
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "orb44-upd-"));
   let wrote = [];
   try {
     const pkg = await unpackTarball(meta.tarball, tmp);
     const blocked = [];
-    for (const root of roots) {
+    for (const root of stale) {
       try {
         applyUpdateTree(pkg, root);
         wrote.push(root);
@@ -713,7 +711,7 @@ async function cmdLogout() {
   applyLang(opts);
   const device = loadDevice();
   if (device?.secret) {
-    await api(device.api, "/api/satellites/logout", { method: "POST", json: { secret: device.secret } });
+    await api(device.api, "/api/satellites/logout", { method: "POST", json: { secret: device.secret } }).catch(() => {});
   }
   clearDevice();
   console.log("✅  " + t(lang, "logged_out"));
@@ -769,4 +767,9 @@ if (!fn) {
   help();
   process.exit(1);
 }
-await fn();
+try {
+  await fn();
+} catch (e) {
+  console.error("⚠️  " + String(e?.message || e).split("\n")[0].slice(0, 200));
+  process.exit(1);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orb44/cli",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Orb44: street snapshot of your site. This CLI is the Watch satellite — pulse from the host (load, listeners, hardening). The cabinet does not run commands on the machine.",
   "type": "module",
   "bin": {
@@ -12,6 +12,7 @@
     "server/sat-i18n.mjs",
     "server/cli-menu.mjs",
     "server/sat-local.mjs",
+    "server/sat-http.mjs",
     "server/sat-update.mjs"
   ],
   "engines": {

package/server/pulse.mjs

@@ -180,23 +180,29 @@ function okListenAddr(a) {
 }
 
 export function collapseListen(rows = []) {
-  const groups = new Map();
+  const world = [];
+  const rest = [];
   for (const r of rows) {
-    const key = `${Number(r.port)}|${r.comm || ""}`;
-    if (!groups.has(key)) groups.set(key, []);
-    groups.get(key).push(r);
+    if (r.addr === "0.0.0.0" || r.addr === "::" || r.addr === "*") world.push(r);
+    else rest.push(r);
+  }
+  const byPort = new Map();
+  for (const r of world) {
+    const port = Number(r.port);
+    if (!byPort.has(port)) byPort.set(port, []);
+    byPort.get(port).push(r);
   }
   const out = [];
-  for (const list of groups.values()) {
+  for (const list of byPort.values()) {
     const addrs = new Set(list.map((x) => x.addr));
-    const rest = list.filter((x) => x.addr !== "0.0.0.0" && x.addr !== "::" && x.addr !== "*");
+    const comm = list.find((x) => x.comm)?.comm || list[0].comm;
     if (addrs.has("*") || (addrs.has("0.0.0.0") && addrs.has("::"))) {
-      out.push({ addr: "*", port: list[0].port, comm: list[0].comm });
-      out.push(...rest);
+      out.push({ addr: "*", port: list[0].port, comm });
     } else {
       out.push(...list);
     }
   }
+  out.push(...rest);
   return out;
 }
 

package/server/sat-http.mjs

@@ -0,0 +1,65 @@
+export const FETCH_MS = 15_000;
+
+const NET_CODES = new Set([
+  "ECONNREFUSED",
+  "ECONNRESET",
+  "ECONNABORTED",
+  "EHOSTUNREACH",
+  "ENETUNREACH",
+  "EPIPE",
+  "EAI_AGAIN",
+  "ENOTFOUND",
+]);
+
+export function classifyNetError(err) {
+  const cause = err?.cause && typeof err.cause === "object" ? err.cause : err;
+  const code = String(cause?.code || err?.code || "");
+  const name = String(err?.name || cause?.name || "");
+  const msg = `${cause?.message || ""} ${err?.message || ""}`;
+  if (name === "TimeoutError" || name === "AbortError" || code === "ABORT_ERR" || /timeout|aborted/i.test(msg)) {
+    return "timeout";
+  }
+  if (/CERT|UNABLE_TO_VERIFY|ERR_TLS|ERR_SSL/i.test(`${code} ${msg}`)) return "tls";
+  if (code === "ENOTFOUND" || code === "EAI_AGAIN" || /getaddrinfo/i.test(msg)) return "dns";
+  if (NET_CODES.has(code) || /fetch failed|socket hang up/i.test(msg)) return "unreachable";
+  return "unreachable";
+}
+
+export function cabinetFail(url, err) {
+  return {
+    ok: false,
+    status: 0,
+    body: { error: classifyNetError(err), url: String(url || "").replace(/\/$/, "") },
+  };
+}
+
+export async function cabinetRequest(url, pathname, { method = "GET", json, secret, fetchImpl = fetch, timeoutMs = FETCH_MS } = {}) {
+  const base = String(url || "").replace(/\/$/, "");
+  const headers = { "Content-Type": "application/json", Accept: "application/json" };
+  if (secret) headers.Authorization = `Bearer ${secret}`;
+  const signal = timeoutMs > 0 && typeof AbortSignal !== "undefined" && AbortSignal.timeout ? AbortSignal.timeout(timeoutMs) : undefined;
+  try {
+    const r = await fetchImpl(`${base}${pathname}`, {
+      method,
+      headers,
+      body: json ? JSON.stringify(json) : undefined,
+      signal,
+    });
+    const body = await r.json().catch(() => ({}));
+    return { ok: Boolean(r.ok), status: r.status, body };
+  } catch (err) {
+    return cabinetFail(base, err);
+  }
+}
+
+export function apiFailText(lang, out, t, fallbackKey = "pulse_fail") {
+  const err = out?.body?.error;
+  const url = out?.body?.url || "";
+  if (err === "unreachable") return t(lang, "cabinet_down", { url });
+  if (err === "timeout") return t(lang, "cabinet_timeout", { url });
+  if (err === "tls") return t(lang, "cabinet_tls", { url });
+  if (err === "dns") return t(lang, "cabinet_dns", { url });
+  if (err === "bad_secret" || err === "not_found") return t(lang, "key_revoked");
+  if (typeof err === "string" && /^[a-z][a-z0-9_]{0,40}$/.test(err)) return err;
+  return t(lang, fallbackKey);
+}

package/server/sat-i18n.mjs

@@ -35,6 +35,10 @@ const STR = {
     payload: "What goes to the cabinet",
     pulse_ok: "Pulse is in the cabinet.",
     pulse_fail: "pulse not accepted",
+    cabinet_down: "Cabinet is not reachable ({url}). Start the cabinet or the tunnel to it.",
+    cabinet_timeout: "Cabinet did not answer ({url}). Try again later.",
+    cabinet_tls: "TLS to the cabinet failed ({url}).",
+    cabinet_dns: "Cannot resolve the cabinet host ({url}).",
     pair_fail: "could not start pairing",
     ask_daemon: "Install as a Watch daemon?\nRuns in the background and starts again after reboot. Pulse every 5 min.",
     daemon_no: "No",
@@ -139,6 +143,10 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     payload: "Что уходит в кабинет",
     pulse_ok: "Пульс в кабинете.",
     pulse_fail: "пульс не принят",
+    cabinet_down: "Кабинет недоступен ({url}). Поднимите кабинет или туннель к нему.",
+    cabinet_timeout: "Кабинет не ответил ({url}). Повторите позже.",
+    cabinet_tls: "TLS к кабинету не сошёлся ({url}).",
+    cabinet_dns: "Не резолвится хост кабинета ({url}).",
     pair_fail: "не удалось начать пару",
     ask_daemon: "Поставить Watch-демоном?\nБудет работать в фоне и подниматься после перезагрузки. Пульс каждые 5 мин.",
     daemon_no: "Нет",
@@ -243,6 +251,10 @@ Outgoing pulse. Cabinet does not execute commands; it replies with advice.`,
     payload: "콘솔로 보내는 내용",
     pulse_ok: "펄스가 콘솔에 있습니다.",
     pulse_fail: "펄스 거부",
+    cabinet_down: "콘솔에 연결할 수 없습니다 ({url}). 콘솔 또는 터널을 올리세요.",
+    cabinet_timeout: "콘솔이 응답하지 않습니다 ({url}). 나중에 다시 시도하세요.",
+    cabinet_tls: "콘솔 TLS 실패 ({url}).",
+    cabinet_dns: "콘솔 호스트를 찾지 못했습니다 ({url}).",
     pair_fail: "페어링을 시작하지 못했습니다",
     ask_daemon: "Watch 데몬으로 설치할까요?\n백그라운드에서 돌고 재부팅 후에도 올라옵니다. 5분마다 펄스.",
     daemon_no: "아니요",
@@ -347,6 +359,10 @@ login에서 언어를 묻고 저장한 뒤, 데몬은 기본값 아니오입니
     payload: "Qué se envía al gabinete",
     pulse_ok: "Pulso en el gabinete.",
     pulse_fail: "pulso rechazado",
+    cabinet_down: "El gabinete no responde ({url}). Levante el gabinete o el túnel.",
+    cabinet_timeout: "El gabinete no contestó ({url}). Pruebe más tarde.",
+    cabinet_tls: "Falló TLS al gabinete ({url}).",
+    cabinet_dns: "No se resuelve el host del gabinete ({url}).",
     pair_fail: "no se pudo iniciar el emparejamiento",
     ask_daemon: "¿Instalar como demonio Watch?\nCorre en segundo plano y arranca de nuevo tras el reinicio. Pulso cada 5 min.",
     daemon_no: "No",

package/server/sat-update.mjs

@@ -9,6 +9,7 @@ export const SAT_TREE_FILES = [
   "server/sat-i18n.mjs",
   "server/cli-menu.mjs",
   "server/sat-local.mjs",
+  "server/sat-http.mjs",
   "server/sat-update.mjs",
   "package.json",
 ];
@@ -52,6 +53,24 @@ export function readCliVersion(scriptFile) {
   return "0.0.0";
 }
 
+export function treeNeedsRefresh(root, latest, { force = false } = {}) {
+  if (force) return true;
+  const ver = readCliVersion(path.join(root, "bin", "orb44.mjs"));
+  if (cmpVer(ver, latest) < 0) return true;
+  try {
+    const pulse = fs.readFileSync(path.join(root, "server", "pulse.mjs"), "utf8");
+    if (!pulse.includes("function collapseListen")) return true;
+    if (!fs.existsSync(path.join(root, "server", "sat-http.mjs"))) return true;
+  } catch {
+    return true;
+  }
+  return false;
+}
+
+export function staleSatRoots(roots, latest, opts = {}) {
+  return (roots || []).filter((r) => treeNeedsRefresh(r, latest, opts));
+}
+
 export function pickSatRoots(scriptFile, { systemLib = "/usr/lib/orb44-sat" } = {}) {
   const here = path.resolve(path.dirname(scriptFile), "..");
   const out = [];