herdr-remote 0.2.20 → 0.2.22

package/dist/keepalive/windows-service-setup.js

@@ -0,0 +1,129 @@
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import { classifyStartResult, currentServiceAccount, encodePowerShellCommand, escapePowerShellSingleQuoted, startService, waitForState, windowsServicePaths, serviceState, windowsService, } from './windows-service.js';
+const MAX_PASSWORD_ATTEMPTS = 3;
+export function renderSetServiceAccountScript({ id, account }) {
+    const safeId = escapePowerShellSingleQuoted(id);
+    const safeAccount = escapePowerShellSingleQuoted(account);
+    return `$ErrorActionPreference = 'Stop'
+$password = [Console]::In.ReadLine()
+$service = Get-CimInstance -ClassName Win32_Service -Filter "Name='${safeId}'"
+$result = Invoke-CimMethod -InputObject $service -MethodName Change -Arguments @{ StartName = '${safeAccount}'; StartPassword = $password }
+exit [int]$result.ReturnValue`;
+}
+function setServiceAccount(id, account, password) {
+    const script = renderSetServiceAccountScript({ id, account });
+    // The password travels through stdin only; it is not part of PowerShell arguments or a file.
+    return spawnSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-EncodedCommand', encodePowerShellCommand(script)], { input: `${password}\n`, encoding: 'utf8', windowsHide: true });
+}
+/** Read a password with `*` feedback and remove ESC sequences such as arrow keys. */
+function promptSecret(prompt) {
+    const input = process.stdin;
+    process.stdout.write(prompt);
+    input.setRawMode(true);
+    input.resume();
+    return new Promise((resolve) => {
+        let password = '';
+        const finish = (value) => {
+            input.removeListener('data', onData);
+            input.setRawMode(false);
+            input.pause();
+            process.stdout.write('\n');
+            resolve(value);
+        };
+        const onData = (chunk) => {
+            const clean = String(chunk).replace(/\x1b(?:\[[0-9;?]*[ -/]*[@-~]|\][^\x07\x1b]*(?:\x07|\x1b\\)|O.|.)/g, '');
+            for (const character of clean) {
+                if (character === '\r' || character === '\n')
+                    return finish(password);
+                if (character === '\u0003')
+                    return finish(null);
+                if (character === '\u007f' || character === '\b') {
+                    if (password.length > 0) {
+                        password = Array.from(password).slice(0, -1).join('');
+                        process.stdout.write('\b \b');
+                    }
+                    continue;
+                }
+                const code = character.codePointAt(0) || 0;
+                if (code < 0x20 || (code >= 0x7f && code <= 0x9f))
+                    continue;
+                password += character;
+                process.stdout.write('*');
+            }
+        };
+        input.on('data', onData);
+    });
+}
+function failure(label, result) {
+    const output = String(result.stdout || result.stderr || '').trim();
+    return new Error(`${label} failed (${String(result.status)}): ${output}`);
+}
+/** Complete service installation inside the elevated console. */
+export async function completeServiceInstall(t) {
+    try {
+        const paths = windowsServicePaths();
+        // A different elevated account resolves a different state directory
+        // and cannot see the XML written before elevation.
+        if (!fs.existsSync(paths.unitPath)) {
+            process.stdout.write(`${t('keepalive.wrongAccount')}\n`);
+            return 1;
+        }
+        if (serviceState() !== 'NonExistent') {
+            windowsService.stop();
+            waitForState('Stopped');
+            const removed = spawnSync(paths.exePath, ['uninstall'], {
+                encoding: 'utf8',
+                windowsHide: true,
+            });
+            if (removed.error || removed.status !== 0)
+                throw failure('WinSW uninstall', removed);
+        }
+        const installed = spawnSync(paths.exePath, ['install'], {
+            stdio: 'inherit',
+            windowsHide: true,
+        });
+        if (installed.error || installed.status !== 0)
+            throw failure('WinSW install', installed);
+        const { domain, user } = currentServiceAccount();
+        const account = `${domain}\\${user}`;
+        for (let attempt = 0; attempt < MAX_PASSWORD_ATTEMPTS; attempt += 1) {
+            const password = await promptSecret(t('keepalive.passwordPrompt', { account }));
+            if (password === null)
+                return 1;
+            const changed = setServiceAccount(paths.id, account, password);
+            if (changed.error || changed.status !== 0)
+                throw failure('Setting the Windows service account', changed);
+            const started = classifyStartResult(startService());
+            if (started === 'ok') {
+                process.stdout.write(`${t('keepalive.serviceInstalled', { id: paths.id })}\n`);
+                return 0;
+            }
+            if (started === 'logon-failed') {
+                process.stdout.write(`${t('keepalive.passwordRejected')}\n`);
+                continue;
+            }
+            process.stdout.write(`${started.message}\n`);
+            return 1;
+        }
+        return 1;
+    }
+    catch (error) {
+        process.stdout.write(`${error.message}\n`);
+        return 1;
+    }
+    finally {
+        process.stdout.write(`${t('keepalive.pressEnter')}\n`);
+        process.stdin.resume();
+        await new Promise((resolve) => {
+            const onData = (chunk) => {
+                if (!/[\r\n]/.test(String(chunk)))
+                    return;
+                process.stdin.removeListener('data', onData);
+                process.stdin.pause();
+                resolve();
+            };
+            process.stdin.on('data', onData);
+        });
+    }
+}

package/dist/keepalive/windows-service.js

@@ -0,0 +1,272 @@
+import { spawn, spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { configDir, PACKAGE_ROOT, stateDir } from '../paths.js';
+import { cliEntryPoint, serviceEnvironment } from './environment.js';
+import { escapeXml } from './launchd.js';
+const DEFAULT_STATE_TIMEOUT_MS = 20_000;
+const STATE_POLL_INTERVAL_MS = 250;
+/** The service name is machine-wide, so include the account to isolate each user's service. */
+export function serviceId(username) {
+    return `herdr-remote-${username.replace(/[^A-Za-z0-9._-]/g, '_')}`;
+}
+export function currentServiceAccount() {
+    return {
+        domain: process.env.USERDOMAIN || '',
+        user: process.env.USERNAME || os.userInfo().username,
+    };
+}
+/** Keep WinSW outside the npm package so updates do not touch a running executable. */
+export function windowsServicePaths() {
+    const id = serviceId(currentServiceAccount().user);
+    const directory = path.join(stateDir(), 'service');
+    return {
+        id,
+        directory,
+        exePath: path.join(directory, `${id}.exe`),
+        unitPath: path.join(directory, `${id}.xml`),
+    };
+}
+function lastNonemptyLine(output) {
+    return output.trim().split(/\r?\n/).pop()?.trim();
+}
+export function parseWhoamiSid(output) {
+    const sid = lastNonemptyLine(output)?.match(/"([^"]+)"\s*$/)?.[1];
+    return sid && /^S-\d(?:-\d+)+$/.test(sid) ? sid : null;
+}
+export function parseWinswState(output) {
+    const state = lastNonemptyLine(output);
+    return state === 'Started' || state === 'Stopped' || state === 'NonExistent'
+        ? state
+        : 'NonExistent';
+}
+export function windowsServiceSddl(userSid) {
+    // SYSTEM, Administrators, interactive users and service users keep the default service DACL.
+    // The last ACE lets ordinary plugin hooks and the TUI start or stop this user's service.
+    const accessEntries = [
+        '(A;;CCLCSWRPWPDTLOCRRC;;;SY)',
+        '(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)',
+        '(A;;CCLCSWLOCRRC;;;IU)',
+        '(A;;CCLCSWLOCRRC;;;SU)',
+        `(A;;CCLCSWRPWPDTLOCRRC;;;${userSid})`,
+    ];
+    return 'D:' + accessEntries.join('');
+}
+export function renderWinswConfig(options) {
+    const { id, user, domain, userSid, nodePath, entryPoint, workingDirectory, environment } = options;
+    const environmentLines = Object.entries(environment).map(([key, value]) => `  <env name="${escapeXml(key)}" value="${escapeXml(value)}"/>`);
+    // Children write their own logs; WinSW captures the supervisor in supervisor.out.log.
+    return `<service>
+  <id>${escapeXml(id)}</id>
+  <name>${escapeXml(`Herdr Remote (${user})`)}</name>
+  <description>${escapeXml(`Browser access to Herdr workspaces, running as ${domain}\\${user}.`)}</description>
+  <executable>${escapeXml(nodePath)}</executable>
+  <arguments>${escapeXml(`"${entryPoint}" run --daemon`)}</arguments>
+  <workingdirectory>${escapeXml(workingDirectory)}</workingdirectory>
+  <startmode>Automatic</startmode>
+  <delayedAutoStart/>
+  <onfailure action="restart" delay="3 sec"/>
+  <resetfailure>1 hour</resetfailure>
+  <stoptimeout>15 sec</stoptimeout>
+  <logpath>${escapeXml(workingDirectory)}</logpath>
+  <logname>supervisor</logname>
+  <log mode="append"/>
+${environmentLines.join('\n')}
+  <serviceaccount>
+    <domain>${escapeXml(domain)}</domain>
+    <user>${escapeXml(user)}</user>
+    <allowservicelogon>true</allowservicelogon>
+  </serviceaccount>
+  <securityDescriptor>${escapeXml(windowsServiceSddl(userSid))}</securityDescriptor>
+</service>
+`;
+}
+export function escapePowerShellSingleQuoted(value) {
+    return value.replace(/'/g, "''");
+}
+export function renderElevationScript({ nodePath, entryPoint }) {
+    const executable = escapePowerShellSingleQuoted(nodePath);
+    const scriptPath = escapePowerShellSingleQuoted(entryPoint);
+    return `$ErrorActionPreference = 'Stop'
+try {
+  $process = Start-Process -FilePath '${executable}' -ArgumentList '"${scriptPath}" keepalive install --elevated' -Verb RunAs -Wait -PassThru
+} catch {
+  exit 1223
+}
+exit $process.ExitCode`;
+}
+export function encodePowerShellCommand(script) {
+    return Buffer.from(script, 'utf16le').toString('base64');
+}
+function text(value) {
+    return value ? String(value).trim() : '';
+}
+function runSc(command) {
+    const result = spawnSync('sc.exe', [command, windowsServicePaths().id], {
+        encoding: 'utf8',
+        windowsHide: true,
+    });
+    return { code: result.status, stdout: text(result.stdout), stderr: text(result.stderr) };
+}
+function scFailure(command, result) {
+    const output = result.stdout || result.stderr;
+    return new Error(`sc.exe ${command} failed (${result.code}): ${output}`);
+}
+/** sc.exe returns Win32 codes: 1056 means already running and 1069 means service logon failed. */
+export function classifyStartResult(result) {
+    if (result.code === 0 || result.code === 1056)
+        return 'ok';
+    if (result.code === 1069)
+        return 'logon-failed';
+    return scFailure('start', result);
+}
+export function startService() {
+    return runSc('start');
+}
+export function stopService() {
+    return runSc('stop');
+}
+export function serviceState() {
+    const { exePath } = windowsServicePaths();
+    if (!fs.existsSync(exePath))
+        return 'NonExistent';
+    const result = spawnSync(exePath, ['status'], { encoding: 'utf8', windowsHide: true });
+    return result.error || result.status !== 0 ? 'NonExistent' : parseWinswState(text(result.stdout));
+}
+export function waitForState(target, timeoutMs = DEFAULT_STATE_TIMEOUT_MS) {
+    const deadlineMs = Date.now() + timeoutMs;
+    while (serviceState() !== target) {
+        if (Date.now() >= deadlineMs)
+            throw new Error(`Windows service did not reach ${target} within ${timeoutMs} ms`);
+        // Lifecycle start/restart is synchronous, so this wait must not yield to an event loop.
+        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, STATE_POLL_INTERVAL_MS);
+    }
+}
+function stop() {
+    const result = stopService();
+    if (result.code !== 0 && result.code !== 1062 && result.code !== 1060)
+        throw scFailure('stop', result);
+}
+function start() {
+    const commandResult = startService();
+    const result = classifyStartResult(commandResult);
+    if (result === 'logon-failed') {
+        const output = commandResult.stdout || commandResult.stderr;
+        throw new Error(`Windows service logon failed (1069): ${output}`);
+    }
+    if (result instanceof Error)
+        throw result;
+    return { ok: true };
+}
+function sha256(filePath) {
+    return createHash('sha256').update(fs.readFileSync(filePath)).digest('hex');
+}
+async function prepare() {
+    const paths = windowsServicePaths();
+    await fs.promises.mkdir(paths.directory, { recursive: true });
+    const source = path.join(PACKAGE_ROOT, 'vendor', 'winsw', 'WinSW.NET461.exe');
+    if (!fs.existsSync(paths.exePath) || sha256(paths.exePath) !== sha256(source)) {
+        try {
+            await fs.promises.copyFile(source, paths.exePath);
+        }
+        catch (error) {
+            if (!['EBUSY', 'EPERM', 'EACCES'].includes(error.code || ''))
+                throw error;
+            throw new Error(`Could not replace ${paths.exePath}; stop the Windows service first.`, {
+                cause: error,
+            });
+        }
+    }
+    // A service may not receive reliable APPDATA, so pin both canonical directories.
+    const environment = {
+        ...serviceEnvironment(),
+        HERDR_REMOTE_CONFIG_DIR: configDir(),
+        HERDR_REMOTE_STATE_DIR: stateDir(),
+        HERDR_REMOTE_SERVICE: '1',
+    };
+    const result = spawnSync('whoami', ['/user', '/fo', 'csv', '/nh'], {
+        encoding: 'utf8',
+        windowsHide: true,
+    });
+    const userSid = !result.error && result.status === 0 ? parseWhoamiSid(text(result.stdout)) : null;
+    if (!userSid)
+        throw new Error(`Could not read the current Windows user SID: ${text(result.stderr)}`);
+    const { user, domain } = currentServiceAccount();
+    await fs.promises.writeFile(paths.unitPath, renderWinswConfig({
+        id: paths.id,
+        user,
+        domain,
+        userSid,
+        nodePath: process.execPath,
+        entryPoint: cliEntryPoint(),
+        workingDirectory: stateDir(),
+        environment,
+    }), 'utf8');
+    return paths;
+}
+function waitForChild(child) {
+    return new Promise((resolve, reject) => {
+        child.once('error', reject);
+        child.once('close', (code) => resolve(code ?? 1));
+    });
+}
+/** The password is entered only in the elevated console, so wait for that window to finish. */
+async function install() {
+    const paths = await prepare();
+    const script = renderElevationScript({ nodePath: process.execPath, entryPoint: cliEntryPoint() });
+    const child = spawn('powershell.exe', ['-NoProfile', '-NonInteractive', '-EncodedCommand', encodePowerShellCommand(script)], { windowsHide: true, stdio: 'ignore' });
+    const exitCode = await waitForChild(child);
+    if (exitCode === 1223) {
+        const error = new Error('Administrator rights were not granted; nothing was installed.');
+        error.code = 'ELEVATION_CANCELLED';
+        throw error;
+    }
+    if (exitCode !== 0)
+        throw new Error(`Windows service installation did not complete (exit code ${exitCode}).`);
+    return { ok: true, unitPath: paths.unitPath, state: serviceState() };
+}
+function status() {
+    const paths = windowsServicePaths();
+    const state = serviceState();
+    const installed = state !== 'NonExistent';
+    return {
+        manager: 'windows-service',
+        installed,
+        active: state === 'Started',
+        enabled: installed,
+        unitPath: paths.unitPath,
+        state,
+    };
+}
+/** WinSW requests elevation itself, so stopping first avoids a second UAC prompt. */
+async function uninstall() {
+    const paths = windowsServicePaths();
+    stop();
+    waitForState('Stopped');
+    const result = spawnSync(paths.exePath, ['uninstall'], { windowsHide: true });
+    if (result.error || result.status !== 0)
+        throw new Error(`WinSW uninstall failed with exit code ${String(result.status)}: ${text(result.stdout)}`);
+    if (serviceState() !== 'NonExistent')
+        throw new Error(`Windows service still exists: ${paths.id}`);
+    fs.rmSync(paths.directory, { recursive: true, force: true });
+    return { ok: true, unitPath: paths.unitPath };
+}
+function restart() {
+    stop();
+    waitForState('Stopped');
+    return start();
+}
+function logsHint() {
+    return `Get-Content -Wait -Tail 40 "${path.join(stateDir(), 'supervisor.out.log')}"`;
+}
+export const windowsService = {
+    name: 'windows-service',
+    status,
+    install,
+    uninstall,
+    restart,
+    stop,
+    logsHint,
+};

package/dist/lifecycle.js

@@ -6,6 +6,8 @@
 // here so the managed and unmanaged paths behave the same from the outside.
 import { loadConfig } from './config.js';
 import * as keepalive from './keepalive/index.js';
+import { pidAlive } from './lib/process.js';
+import { readRuntime } from './runtime.js';
 import { restartServices, startServices, statusServices, stopServices } from './service.js';
 function managerInUse(config) {
     const status = keepalive.status(config);
@@ -47,6 +49,18 @@ function restartAll(config = loadConfig()) {
     }
     return { ...restartServices(), managed: false };
 }
+/** Release Windows service binaries while npm replaces their package files. */
+async function whileServicesStopped(config, task, { platform = process.platform, isRunning = () => Boolean(managerInUse(config)?.active || pidAlive(readRuntime().hostPid)), stop = stopAll, start = startAll, } = {}) {
+    if (platform !== 'win32' || !isRunning())
+        return task();
+    await stop(config);
+    try {
+        return await task();
+    }
+    finally {
+        await start(config);
+    }
+}
 /** Service status plus the keep-alive picture, which is what the TUI shows. */
 async function fullStatus(config = loadConfig()) {
     const [services, keepaliveStatus] = [await statusServices(), keepalive.status(config)];
@@ -56,4 +70,4 @@ async function fullStatus(config = loadConfig()) {
         logsHint: keepalive.logsHint(config),
     };
 }
-export { startAll, stopAll, restartAll, fullStatus, managerInUse };
+export { startAll, stopAll, restartAll, fullStatus, managerInUse, whileServicesStopped };

package/dist/net-interfaces.js

@@ -1,7 +1,7 @@
 import os from 'node:os';
 // Interface names that are almost always virtual bridges rather than something
 // a phone can reach. They are still listed, just ranked last.
-const VIRTUAL_NAME_PATTERN = /^(docker|br-|virbr|veth|vmnet|vboxnet|lxcbr|cni|flannel|kube)/i;
+const VIRTUAL_NAME_PATTERN = /^(docker|br-|virbr|veth|vmnet|vboxnet|lxcbr|cni|flannel|kube|vmware network adapter|virtualbox host-only)/i;
 const TAILSCALE_NAME_PATTERN = /^(tailscale|ts)\d*$/i;
 /**
  * Is this address inside Tailscale's 100.64.0.0/10 CGNAT range? Interface names
@@ -18,12 +18,22 @@ function isTailscaleAddress(address) {
         return false;
     return first === 100 && second >= 64 && second <= 127;
 }
+/**
+ * Windows assigns 169.254 addresses when DHCP fails, and other devices cannot
+ * reach them.
+ */
+function isLinkLocalAddress(address) {
+    const octets = String(address).split('.');
+    if (octets.length !== 4)
+        return false;
+    return Number(octets[0]) === 169 && Number(octets[1]) === 254;
+}
 function classify(name, info) {
     if (info.internal)
         return 'loopback';
     if (TAILSCALE_NAME_PATTERN.test(name) || isTailscaleAddress(info.address))
         return 'tailscale';
-    if (VIRTUAL_NAME_PATTERN.test(name))
+    if (isLinkLocalAddress(info.address) || VIRTUAL_NAME_PATTERN.test(name))
         return 'virtual';
     return 'lan';
 }
@@ -35,8 +45,7 @@ const KIND_ORDER = { tailscale: 0, lan: 1, virtual: 2, loopback: 3 };
  * from anywhere, which is exactly the "works away from home without running a
  * relay" case; plain LAN addresses follow, then virtual bridges, then loopback.
  */
-function listReachableAddresses({ includeLoopback = true, includeIpv6 = false, } = {}) {
-    const interfaces = os.networkInterfaces();
+function listReachableAddresses({ includeLoopback = true, includeIpv6 = false, interfaces = os.networkInterfaces(), } = {}) {
     const results = [];
     for (const [name, entries] of Object.entries(interfaces)) {
         for (const info of entries || []) {
@@ -66,8 +75,8 @@ function listReachableAddresses({ includeLoopback = true, includeIpv6 = false, }
     return results;
 }
 /** Best guess for the address to advertise when binding to every interface. */
-function preferredLanAddress() {
-    const candidates = listReachableAddresses({ includeLoopback: false });
+function preferredLanAddress(interfaces = os.networkInterfaces()) {
+    const candidates = listReachableAddresses({ includeLoopback: false, interfaces });
     return candidates.length > 0 ? candidates[0].address : null;
 }
 export { isTailscaleAddress, listReachableAddresses, preferredLanAddress };

package/dist/paths.js

@@ -37,12 +37,24 @@ const PACKAGE_ROOT = findPackageRoot(import.meta.dirname);
  * it launches the plugin itself, so honouring it would give "herdr-remote" run
  * from a shell and the same tool run from a Herdr pane two different config
  * files. One path, one config; `migrateLegacyConfig()` imports the old one.
+ * On Windows, configuration roams under `APPDATA` while state and logs stay
+ * local under `LOCALAPPDATA`, following Windows and Herdr's directory layout.
  */
-function configDir() {
-    return process.env.HERDR_REMOTE_CONFIG_DIR || path.join(os.homedir(), '.config', 'herdr-remote');
+function configDir(env = process.env, platform = process.platform) {
+    if (env.HERDR_REMOTE_CONFIG_DIR)
+        return env.HERDR_REMOTE_CONFIG_DIR;
+    if (platform === 'win32') {
+        return path.join(env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming'), 'herdr-remote');
+    }
+    return path.join(os.homedir(), '.config', 'herdr-remote');
 }
-function stateDir() {
-    return (process.env.HERDR_REMOTE_STATE_DIR || path.join(os.homedir(), '.local', 'state', 'herdr-remote'));
+function stateDir(env = process.env, platform = process.platform) {
+    if (env.HERDR_REMOTE_STATE_DIR)
+        return env.HERDR_REMOTE_STATE_DIR;
+    if (platform === 'win32') {
+        return path.join(env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local'), 'herdr-remote');
+    }
+    return path.join(os.homedir(), '.local', 'state', 'herdr-remote');
 }
 function configPath() {
     return path.join(configDir(), 'config.json');

package/dist/pty-session.js

@@ -9,9 +9,11 @@ class PtySession {
     args;
     cwd;
     socketPath;
+    platform;
+    spawnPty;
     terminal;
     startedAt;
-    constructor({ command, args = [], cwd = os.homedir(), socketPath } = {}) {
+    constructor({ command, args = [], cwd = os.homedir(), socketPath, platform = process.platform, spawn: spawnPty = pty.spawn, } = {}) {
         if (typeof command !== 'string' || command.length === 0)
             throw new TypeError('command must be a non-empty string');
         if (!Array.isArray(args) || !args.every((arg) => typeof arg === 'string'))
@@ -20,6 +22,8 @@ class PtySession {
         this.args = args;
         this.cwd = cwd;
         this.socketPath = socketPath;
+        this.platform = platform;
+        this.spawnPty = spawnPty;
         this.terminal = null;
         this.startedAt = null;
     }
@@ -44,12 +48,16 @@ class PtySession {
     start({ cols, rows, onData, onExit }) {
         if (this.terminal)
             throw new Error('PTY session already started');
-        this.terminal = pty.spawn(this.command, this.args, {
+        // The bundled ConPTY preserves Kitty sequences older system ConPTY drops,
+        // which is why Herdr embeds it too. System ConPTY's kill() forks a
+        // console-list helper without windowsHide, which flashes a window here.
+        this.terminal = this.spawnPty(this.command, this.args, {
             name: 'xterm-256color',
             cols: PtySession.clampDimension(cols, PtySession.DEFAULT_COLS),
             rows: PtySession.clampDimension(rows, PtySession.DEFAULT_ROWS),
             cwd: this.cwd,
             env: PtySession.childEnv(this.socketPath),
+            ...(this.platform === 'win32' ? { useConptyDll: true } : {}),
         });
         this.startedAt = new Date().toISOString();
         const terminal = this.terminal;

package/dist/relay-updater.js

@@ -0,0 +1,81 @@
+// Updating the relay a local or LAN workstation runs, on its own.
+//
+// The relay is a package of its own that herdr-remote installs. A release of
+// the relay alone leaves herdr-remote's version where it was, so the update
+// check for herdr-remote says "up to date" while the relay on disk falls
+// behind. This checks the relay by itself, and installs the newest relay that
+// this herdr-remote's dependency range allows.
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { PACKAGE_ROOT } from './paths.js';
+import { checkForUpdate, compareVersions, currentVersion, performUpdate, } from './updater.js';
+const RELAY_PACKAGE = 'herdr-remote-relay';
+/** The relay installed under this herdr-remote, read from disk: an update moves it. */
+export function installedRelayVersion() {
+    try {
+        const manifest = createRequire(import.meta.url).resolve(`${RELAY_PACKAGE}/package.json`);
+        return JSON.parse(fs.readFileSync(manifest, 'utf8')).version;
+    }
+    catch {
+        return null;
+    }
+}
+/** The relay versions this herdr-remote declares it works with, e.g. `^0.3.9`. */
+function relayRange() {
+    try {
+        const manifest = JSON.parse(fs.readFileSync(path.join(PACKAGE_ROOT, 'package.json'), 'utf8'));
+        return manifest.dependencies?.[RELAY_PACKAGE] ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Whether `version` is inside a caret range, the only kind herdr-remote
+ * declares. Below 1.0 a caret holds the minor version (`^0.3.9` is `0.3.x`
+ * from `0.3.9`), which is exactly the line a relay must not cross alone.
+ */
+export function withinCaretRange(version, range) {
+    const match = /^\^(\d+)\.(\d+)\.(\d+)$/.exec(range.trim());
+    if (!match)
+        return false;
+    const floor = `${match[1]}.${match[2]}.${match[3]}`;
+    const [major, minor] = version.split('.').map((part) => Number.parseInt(part, 10));
+    const [floorMajor, floorMinor] = [Number(match[1]), Number(match[2])];
+    if (compareVersions(version, floor) < 0 || major !== floorMajor)
+        return false;
+    return floorMajor > 0 || minor === floorMinor;
+}
+/** Whether a newer relay than the installed one is out, and whether this herdr-remote can take it. */
+export async function checkForRelayUpdate(options = {}) {
+    const installed = installedRelayVersion();
+    const result = await checkForUpdate({
+        ...options,
+        packageName: RELAY_PACKAGE,
+        current: installed ?? '0.0.0',
+    });
+    if (!result.ok || !result.updateAvailable || !result.latest)
+        return result;
+    const range = relayRange();
+    if (range && !withinCaretRange(result.latest, range)) {
+        return { ...result, updateAvailable: false, needsNewerCli: true };
+    }
+    return result;
+}
+/**
+ * Install the newest relay this herdr-remote allows: the same herdr-remote,
+ * reinstalled, which npm resolves afresh, relay included. The installed
+ * herdr-remote does not change, and neither does anything it was tested with
+ * but the relay. Success is the relay on disk, not npm's exit code.
+ */
+export async function performRelayUpdate({ relayVersion, readRelayVersion = installedRelayVersion, ...options }) {
+    const result = await performUpdate({ ...options, version: currentVersion() });
+    if (!result.ok)
+        return result;
+    const installed = readRelayVersion();
+    if (!installed || compareVersions(installed, relayVersion) < 0) {
+        return { ok: false, errorKey: 'relayUpdate.errorNotApplied', installed, output: result.output };
+    }
+    return { ...result, installed };
+}

package/dist/service.js

@@ -99,6 +99,8 @@ function spawnDetached(spec) {
             cwd: PACKAGE_ROOT,
             env: { ...baseEnvironment(), ...spec.env },
             detached: true,
+            // A detached console program can open a visible window from a console-less Windows parent.
+            windowsHide: true,
             stdio: ['ignore', logFd, logFd],
         });
         child.unref();