@whyshu/argent 0.1.8 → 0.1.9

package/README.md

@@ -22,6 +22,37 @@ npx -y @whyshu/argent service install   # 生成 launchd（macOS）/ systemd（L
 本地仓库联调：`ARGENT_REPO=/path/to/argent-dsh node launcher/bin/argent.mjs setup --dsh-home /tmp/x`
 （从仓库 `plugins/` 用 `file:` 装配；正式发布时改用 npm 依赖解析）。
 
+> 客户机更新的唯一口径（禁止 SSH/EasyTier、runtime 与插件的边界、自动更新设计）见
+> [`docs/客户机更新通道-唯一口径.md`](../docs/客户机更新通道-唯一口径.md)。
+
+## 客户机更新（outbound npm 通道，2026-10-22）
+
+不再使用 SSH / EasyTier / `/dl`。客户机只访问 npm registry：
+
+```bash
+# 只检查（不写任何东西）
+npx -y @whyshu/argent@latest update check --json
+
+# 真正更新 runtime + profile 插件（必须 --yes）
+npx -y @whyshu/argent@latest update run --yes
+
+# 看计划 / 指定版本 / 国内镜像
+npx -y @whyshu/argent@latest update run --dry-run
+npx -y @whyshu/argent@latest update run --yes --to 0.1.9
+npx -y @whyshu/argent@latest update check --registry https://registry.npmmirror.com
+```
+
+`update run` 会：
+
+1. 读取 npm `@whyshu/argent` 的 `latest` 版本；
+2. 备份 profile 的 `package.json` / patch / lock；
+3. 用目标版本启动器执行 `runtime install`；
+4. 执行 `setup --force-install` 更新 profile 插件；
+5. 执行 `health --json` 验收；
+6. 返回 `restartRequired: true`，由空闲窗口重启宿主。
+
+失败不会静默：保留更新前 profile 清单备份，并打印分步重试命令。当前不做自动重启。
+
 ## 运行资产更新（npm 通道，2026-10-19）
 
 客户机脚本/技能随 `@whyshu/argent` 的 runtime 依赖一起更新，不需要 `/dl/`：

package/bin/argent.mjs

@@ -6,17 +6,18 @@
  *   argent health                    版本/宿主/profile/runner 自检（--json）
  *   argent setup                     只生成/更新 profile
  *   argent service install|uninstall runner 常驻（macOS launchd；--print-only/--plist-dir）
+ *   argent update check|run      客户机 outbound npm 更新（不依赖 SSH/EasyTier /dl）
  *
  * 公共参数：--dsh-home <dir>  --profile <name>  --repo <dir>  --json  --dry-run
  */
 import { spawn, spawnSync } from 'node:child_process';
-import { mkdirSync, writeFileSync, rmSync, existsSync, copyFileSync, chmodSync, readFileSync } from 'node:fs';
+import { mkdirSync, writeFileSync, rmSync, existsSync, copyFileSync, chmodSync, readFileSync, cpSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { homedir } from 'node:os';
 import {
   DSH_EXACT_VERSION, PROFILE_NAME, PROD_BUNDLES, buildLaunchdPlist, buildProfile, dshHomeOf, runnerScriptPath,
   depsInstalled, health, installDeps, loginWithPhone, pairRunner, probeDshVersion, readAuthToken, repoRoot, runnerConfigPath, sendLoginCode, versionMatches,
-  engineRoot, materializeRuntime,
+  engineRoot, materializeRuntime, checkForUpdate, compareVersions, launcherVersion,
 } from '../lib/index.mjs';
 
 const argv = process.argv.slice(2);
@@ -27,9 +28,9 @@ const DRY_RUN = has('--dry-run');
 
 const command = (() => {
   const positional = argv.filter((a) => !a.startsWith('--') && !['-h'].includes(a));
-  const i = argv.findIndex((a) => a === 'web' || a === 'health' || a === 'setup' || a === 'pair' || a === 'login' || a === 'service' || a === 'runtime');
+  const i = argv.findIndex((a) => a === 'web' || a === 'health' || a === 'setup' || a === 'pair' || a === 'login' || a === 'service' || a === 'runtime' || a === 'update');
   if (i < 0) return '';
-  if (argv[i] === 'service' || argv[i] === 'runtime') return `${argv[i]} ${argv[i + 1] || ''}`.trim();
+  if (argv[i] === 'service' || argv[i] === 'runtime' || argv[i] === 'update') return `${argv[i]} ${argv[i + 1] || ''}`.trim();
   return argv[i];
 })();
 
@@ -40,6 +41,7 @@ const opts = {
   port: Number(val('--port', '3080')) || 3080,
   target: val('--target', join(homedir(), '.argent-dsh')),
   skillsTarget: has('--no-skills') ? '' : val('--skills-target', join(dshHomeOf(val('--dsh-home')), 'skills')),
+  registry: val('--registry', process.env.ARGENT_NPM_REGISTRY || 'https://registry.npmjs.org'),
   extraBundles: (() => { const raw = val('--bundles', '').split(',').map((x) => x.trim()).filter(Boolean); return raw.flatMap((x) => (x === 'prod' ? PROD_BUNDLES : [x])); })(),
 };
 
@@ -72,7 +74,7 @@ function ensureProfile({ install = true } = {}) {
     console.error(`❌ ${built.message}`);
     process.exit(2);
   }
-  if (install && !depsInstalled(opts.dshHome, opts.profile) && !has('--no-install')) {
+  if (install && (has('--force-install') || !depsInstalled(opts.dshHome, opts.profile)) && !has('--no-install')) {
     console.error('→ 装配 profile 依赖（dsh plugin --profile ' + opts.profile + ' install）…');
     const r = installDeps({ dshHome: opts.dshHome, profile: opts.profile });
     if (!r.ok) {
@@ -199,6 +201,86 @@ function runtimeCommand(sub) {
   print({ ok: true, package: '@whyshu/argent-engine', version: r.version, files: r.files, skillsFiles: r.skillsFiles, target: r.target, skillsTarget: r.skillsTarget, backupDir: r.backupDir });
 }
 
+function runCli(bin, args, { cwd = '', env = {} } = {}) {
+  const r = spawnSync(bin, args, {
+    cwd: cwd || undefined,
+    stdio: inherit_stdout() ? 'inherit' : 'pipe',
+    encoding: 'utf8',
+    env: { ...process.env, ...env },
+    timeout: 600000,
+  })
+  if (r.error) throw new Error(`${bin} ${args.join(' ')} 启动失败：${r.error.message}`)
+  if (r.status !== 0) throw new Error(`${bin} ${args.join(' ')} 退出 ${r.status}${r.stderr ? `：${String(r.stderr).slice(-400)}` : ''}`)
+  return r
+}
+
+function inherit_stdout() { return !JSON_OUT }
+
+async function updateCommand(sub) {
+  if (sub !== 'check' && sub !== 'run') {
+    console.error('用法：argent update check|run [--to <version>] [--yes] [--registry <url>] [--dsh-home <dir>] [--target <dir>] [--json] [--dry-run]');
+    process.exit(2)
+  }
+  const current = launcherVersion()
+  let remote
+  try { remote = await checkForUpdate({ target: opts.target, registry: opts.registry }) }
+  catch (e) { console.error(`❌ 检查更新失败：${e.message}`); process.exit(2) }
+  if (!remote.ok) {
+    if (JSON_OUT) console.log(JSON.stringify(remote, null, 2)); else console.error(`❌ ${remote.message}`)
+    process.exit(2)
+  }
+  const targetVersion = val('--to', remote.latest)
+  if (sub === 'check') {
+    const out = { ...remote, targetVersion, launcher: current, restartRequired: Boolean(remote.updateAvailable) }
+    if (JSON_OUT) console.log(JSON.stringify(out, null, 2))
+    else {
+      console.log(`当前启动器: ${current || '(未知)'}`)
+      console.log(`npm latest: ${remote.latest}`)
+      console.log(remote.updateAvailable ? '→ 有可用更新' : '→ 已是最新')
+      console.log(`runtime: ${remote.runtime || '(未物化)'} @ ${remote.runtimeTarget}`)
+      console.log(`来源: ${remote.registry}`)
+    }
+    return
+  }
+  if (compareVersions(targetVersion, current) <= 0 && !has('--force')) {
+    console.log(`已是最新（${current}），无需更新。`)
+    return
+  }
+  const npx = process.platform === 'win32' ? 'npx.cmd' : 'npx'
+  const common = ['--yes', `@whyshu/argent@${targetVersion}`]
+  const installArgs = [...common, 'runtime', 'install', '--target', opts.target, '--skills-target', opts.skillsTarget]
+  const setupArgs = [...common, 'setup', '--dsh-home', opts.dshHome, '--force-install']
+  const healthArgs = [...common, 'health', '--dsh-home', opts.dshHome, '--json']
+  if (DRY_RUN) {
+    print({ ok: true, dryRun: true, current, targetVersion, commands: [installArgs, setupArgs, healthArgs].map((args) => [npx, ...args].join(' ')) })
+    return
+  }
+  if (!has('--yes')) {
+    console.error('⛔ 更新会改 runtime / profile 插件，必须显式加 --yes。先看计划：argent update run --dry-run')
+    process.exit(2)
+  }
+  const stamp = new Date().toISOString().replace(/[:.]/g, '-')
+  const profileDir = join(opts.dshHome, 'profiles', opts.profile)
+  const backupDir = join(opts.dshHome, 'argent', 'backup', `update-${stamp}`)
+  mkdirSync(backupDir, { recursive: true })
+  for (const f of ['package.json', 'cordis.patch.yml', 'pnpm-lock.yaml', 'pnpm-workspace.yaml']) {
+    const src = join(profileDir, f)
+    if (existsSync(src)) { mkdirSync(dirname(join(backupDir, f)), { recursive: true }); cpSync(src, join(backupDir, f)) }
+  }
+  const env = { NPM_CONFIG_REGISTRY: opts.registry }
+  try {
+    runCli(npx, installArgs, { env })
+    runCli(npx, setupArgs, { env })
+    runCli(npx, healthArgs, { env })
+  } catch (e) {
+    console.error(`❌ 更新失败：${e.message}`)
+    console.error(`   已保留更新前 profile 清单备份：${backupDir}`)
+    console.error('   可分步重试：npx -y @whyshu/argent@' + targetVersion + ' runtime install / setup --force-install；必要时用备份恢复 package.json/patch。')
+    process.exit(2)
+  }
+  print({ ok: true, from: current, to: targetVersion, runtimeTarget: opts.target, profile: profileDir, backupDir, restartRequired: true, next: '空闲窗口重启 dsh web（service install/launchd 或现有重启脚本）' })
+}
+
 function serviceCommand(sub) {
   const bundled = runnerScriptPath({ repo: opts.repo });
   // 固定 runner 路径：复制进 DSH_HOME，避免 launchd 指向 npx 临时缓存（缓存清理后失效）
@@ -238,7 +320,7 @@ function serviceCommand(sub) {
 
 const main = async () => {
   if (!command || has('-h') || has('--help')) {
-    console.log('用法：argent <web|health|setup|login|pair|runtime install|runtime status|service install|service uninstall> [--dsh-home <dir>] [--target <dir>] [--skills-target <dir>|--no-skills] [--json] [--dry-run]');
+    console.log('用法：argent <web|health|setup|login|pair|runtime install|runtime status|service install|service uninstall|update check|update run> [--dsh-home <dir>] [--target <dir>] [--skills-target <dir>|--no-skills] [--json] [--dry-run]');
     process.exit(command ? 0 : 2);
   }
   if (command === 'health') return healthCommand();
@@ -247,6 +329,7 @@ const main = async () => {
   if (command === 'login') return loginCommand();
   if (command === 'runtime install' || command === 'runtime status') return runtimeCommand(command.split(' ')[1]);
   if (command === 'service install' || command === 'service uninstall') return serviceCommand(command.split(' ')[1]);
+  if (command === 'update check' || command === 'update run') return updateCommand(command.split(' ')[1]);
   return webCommand();
 };
 

package/lib/index.mjs

@@ -346,3 +346,75 @@ export async function pairRunner({
   writeFileSync(cfgPath, JSON.stringify(config, null, 2) + '\n', { mode: 0o600 });
   return { ok: true, configPath: cfgPath, serverUrl: base, tenantAppId: appId, runnerId: config.runnerId, tokenTail: token.slice(-6) };
 }
+
+
+// ── 客户机 outbound 更新（npm 唯一制品源；2026-10-22）────────────────
+/** 启动器包名与默认 registry。客户机只做出站 HTTPS；不依赖 /dl、SSH、组网。 */
+export const LAUNCHER_PACKAGE = '@whyshu/argent'
+export const DEFAULT_NPM_REGISTRY = 'https://registry.npmjs.org'
+
+/** 读取启动器自身版本（发布包 / 本地仓库均适用）。 */
+export function launcherVersion(launcherLib = dirname(fileURLToPath(import.meta.url))) {
+  try {
+    const pkg = JSON.parse(readFileSync(join(launcherLib, '..', 'package.json'), 'utf8'))
+    return String(pkg.version || '')
+  } catch { return '' }
+}
+
+/** 比较 x.y.z（支持 prerelease 简单后缀；返回 -1/0/1）。 */
+export function compareVersions(a, b) {
+  const parse = (v) => String(v || '').trim().replace(/^v/, '').split('-')[0].split('.').map((x) => Number(x) || 0)
+  const pa = parse(a); const pb = parse(b)
+  for (let i = 0; i < Math.max(pa.length, pb.length); i += 1) {
+    const d = (pa[i] || 0) - (pb[i] || 0)
+    if (d) return d > 0 ? 1 : -1
+  }
+  return 0
+}
+
+/** 从 npm registry 读取 @whyshu/argent 的 latest 版本（公开包，无需 token）。 */
+export async function latestLauncherVersion({
+  registry = process.env.ARGENT_NPM_REGISTRY || DEFAULT_NPM_REGISTRY,
+  packageName = LAUNCHER_PACKAGE,
+  fetchImpl = globalThis.fetch,
+} = {}) {
+  const base = String(registry || DEFAULT_NPM_REGISTRY).replace(/\/+$/, '')
+  const encoded = String(packageName).replace('/', '%2F')
+  const url = `${base}/${encoded}/latest`
+  try {
+    const res = await fetchImpl(url, { headers: { accept: 'application/json' }, signal: AbortSignal.timeout(15000) })
+    const text = await res.text()
+    let data = null
+    try { data = JSON.parse(text) } catch { data = null }
+    if (!res.ok) return { ok: false, code: 'registry_http', message: `registry HTTP ${res.status}`, url }
+    const version = String(data?.version || data?.['dist-tags']?.latest || '').trim()
+    if (!version) return { ok: false, code: 'registry_shape', message: 'registry 未返回 version', url }
+    return { ok: true, version, integrity: String(data?.dist?.integrity || ''), tarball: String(data?.dist?.tarball || ''), registry: base, url }
+  } catch (e) {
+    return { ok: false, code: 'registry_fetch', message: e?.message || String(e), url }
+  }
+}
+
+/** 读取已物化 runtime 的版本（没有则空串）。 */
+export function readRuntimeVersion(target = join(homedir(), '.argent-dsh')) {
+  try {
+    const d = JSON.parse(readFileSync(join(target, 'RUNTIME_VERSION.json'), 'utf8'))
+    return String(d?.version || '')
+  } catch { return '' }
+}
+
+/** 检查更新（只读；不下载、不安装）。 */
+export async function checkForUpdate({
+  launcherLib, target = join(homedir(), '.argent-dsh'), registry = process.env.ARGENT_NPM_REGISTRY || DEFAULT_NPM_REGISTRY,
+  fetchImpl = globalThis.fetch,
+} = {}) {
+  const current = launcherVersion(launcherLib)
+  const remote = await latestLauncherVersion({ registry, fetchImpl })
+  const runtime = readRuntimeVersion(target)
+  if (!remote.ok) return { ok: false, code: remote.code, message: remote.message, current, runtime, registry }
+  const updateAvailable = current ? compareVersions(remote.version, current) > 0 : true
+  return {
+    ok: true, current, latest: remote.version, updateAvailable, registry: remote.registry,
+    integrity: remote.integrity, tarball: remote.tarball, runtime, runtimeTarget: target,
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@whyshu/argent",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "Argent 启动器：一条命令启动「打包好的 dsh + Argent 插件/角色预设」，并管理本机 runner 常驻。",
   "type": "module",
   "bin": {
@@ -25,6 +25,6 @@
   ],
   "license": "MIT",
   "scripts": {
-    "test": "node --test test/"
+    "test": "node --test test/*.test.mjs"
   }
 }