herdr-remote 0.2.27 → 0.2.28

package/README.md

@@ -29,10 +29,11 @@ through Windows Defender Firewall on private networks.
 
 ```bash
 herdr-remote start | stop | restart
+herdr-remote update [--json]  # Install the latest release and restart services
 herdr-remote status [--json]
 herdr-remote pair [--json]
 herdr-remote url
-herdr-remote admin-broker install | uninstall | status # Windows
+herdr-remote admin-broker install | uninstall | restart | status # Windows
 herdr-remote keepalive install | uninstall | restart | status
 herdr-remote plugin link | unlink | status
 herdr-remote --lang zh|en
@@ -43,7 +44,8 @@ privileges and start it for the signed-in account. Choose **Set up admin termina
 approve the one-time Windows prompt under the same account as Herdr Remote; the WebUI's Admin
 button then opens an elevated PowerShell as a new Herdr tab without another UAC prompt. The CLI
 `admin-broker install` and `admin-broker uninstall` commands are also available for administrators.
-Use `admin-broker status` to check the broker.
+Use `admin-broker status` to check the broker. `herdr-remote update` restarts the broker on the new
+release unless an admin terminal is open; `admin-broker restart` does it later, without elevation.
 
 ## Herdr Plugin
 

package/README.zh-CN.md

@@ -29,16 +29,17 @@ Defender 防火墙提示中允许 `node.exe` 通过专用网络通信。
 
 ```bash
 herdr-remote start | stop | restart
+herdr-remote update [--json]  # 安装最新版本并重启服务
 herdr-remote status [--json]
 herdr-remote pair [--json]
 herdr-remote url
-herdr-remote admin-broker install | uninstall | status # Windows
+herdr-remote admin-broker install | uninstall | restart | status # Windows
 herdr-remote keepalive install | uninstall | restart | status
 herdr-remote plugin link | unlink | status
 herdr-remote --lang zh|en
 ```
 
-在 Windows 上，可在 TUI 的「保活」页面注册以当前账户最高权限运行的计划任务并启动 broker。选择「设置管理员终端」，使用运行 Herdr Remote 的同一账户批准一次 Windows 提权提示；之后，WebUI 的“管理员”按钮会在 Herdr 中新建一个管理员 PowerShell 标签页，不再重复弹出 UAC。也可以使用 `admin-broker install` 和 `admin-broker uninstall` 命令管理任务，使用 `admin-broker status` 检查 broker。
+在 Windows 上，可在 TUI 的「保活」页面注册以当前账户最高权限运行的计划任务并启动 broker。选择「设置管理员终端」，使用运行 Herdr Remote 的同一账户批准一次 Windows 提权提示；之后，WebUI 的“管理员”按钮会在 Herdr 中新建一个管理员 PowerShell 标签页，不再重复弹出 UAC。也可以使用 `admin-broker install` 和 `admin-broker uninstall` 命令管理任务，使用 `admin-broker status` 检查 broker。`herdr-remote update` 会让 broker 以新版本重启（有管理员终端开着时除外），之后也可以用 `admin-broker restart` 重启，无需提权。
 
 ## Herdr 插件
 

package/dist/cli.js

@@ -26,7 +26,8 @@ Commands:
   pair [--json]        Create pairing code
   url                  Print browser access URL
   run [--daemon]       Run services in foreground (keep-alive)
-  admin-broker install | uninstall | status (Windows)
+  update [--json]      Install the latest release and restart services
+  admin-broker install | uninstall | restart | status (Windows)
   admin-shell          Elevated PowerShell in this terminal (Windows)
   keepalive <action>   install | uninstall | restart | status
   plugin <action>      link | unlink | status  (Herdr plugin)
@@ -219,6 +220,18 @@ async function main(argv = process.argv.slice(2)) {
             process.stdout.write(`${resolvePublicUrl(config, preferredLanAddress())}\n`);
             return;
         }
+        case 'update': {
+            const { runUpdate } = await import('./update-command.js');
+            const outcome = await runUpdate(t, {
+                config,
+                ...(flags.json ? { report: () => { } } : {}),
+            });
+            if (flags.json)
+                printJson(outcome);
+            if (!outcome.ok)
+                process.exitCode = 1;
+            return;
+        }
         case 'run': {
             const { runForeground } = await import('./supervisor.js');
             await runForeground({ logToFiles: Boolean(flags.daemon) });
@@ -235,6 +248,12 @@ async function main(argv = process.argv.slice(2)) {
                 broker.uninstallAdminBroker(t);
                 printJson({ installed: false });
             }
+            else if (action === 'restart') {
+                if ((await broker.stopAdminBroker()) === 'busy')
+                    throw new Error(t('adminBroker.busy'));
+                broker.startAdminBrokerTask(t);
+                printJson({ available: await broker.waitForAdminBroker() });
+            }
             else if (action === 'status') {
                 printJson({ available: await broker.adminBrokerStatus() });
             }

package/dist/connector/admin-broker.js

@@ -1,13 +1,17 @@
 import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
 import net from 'node:net';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { PtySession } from '../pty-session.js';
-import { PACKAGE_ROOT, stateDir } from '../paths.js';
+import { stateDir } from '../paths.js';
 import { ADMIN_BROKER_MAX_MESSAGE_BYTES, adminBrokerTaskName, adminBrokerTokenMatches, connectAdminBroker, listenAdminBroker, publishAdminBrokerEndpoint, sendAdminBrokerMessage, } from './adminBrokerEndpoint.js';
 const BROKER_PING_TIMEOUT_MS = 1_000;
 const BROKER_START_TIMEOUT_MS = 5_000;
 const BROKER_START_POLL_MS = 250;
+const BROKER_TASK_END_TIMEOUT_MS = 10_000;
+/** Time for a stopping broker's goodbye to reach the caller before the process ends. */
+const BROKER_EXIT_GRACE_MS = 1_000;
 function powershellQuote(value) {
     return `'${value.replaceAll("'", "''")}'`;
 }
@@ -28,19 +32,20 @@ function runPowerShell(script, t) {
         throw new Error(t('adminBroker.needsElevation'));
     }
 }
-export function installAdminBroker(t) {
-    if (process.platform !== 'win32')
-        throw new Error(t('adminBroker.windowsOnly'));
+/** Registers and starts the broker's logon task; run elevated. */
+export function adminBrokerTaskScript() {
     const brokerPath = fileURLToPath(import.meta.url);
     // Pinned so the broker publishes its endpoint where this install's callers look.
     const brokerCommand = `$env:HERDR_REMOTE_STATE_DIR = ${powershellQuote(stateDir())}; & ${powershellQuote(process.execPath)} ${powershellQuote(brokerPath)}`;
     const encodedBrokerCommand = Buffer.from(brokerCommand, 'utf16le').toString('base64');
     const powershell = path.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
-    const script = `
+    // Not PACKAGE_ROOT: npm updates the package by renaming its directory, and
+    // Windows refuses while it is the working directory of this long-lived task.
+    return `
 $ErrorActionPreference = 'Stop'
 $taskName = ${powershellQuote(adminBrokerTaskName())}
 $user = [Security.Principal.WindowsIdentity]::GetCurrent().Name
-$action = New-ScheduledTaskAction -Execute ${powershellQuote(powershell)} -Argument ${powershellQuote(`-NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand ${encodedBrokerCommand}`)} -WorkingDirectory ${powershellQuote(PACKAGE_ROOT)}
+$action = New-ScheduledTaskAction -Execute ${powershellQuote(powershell)} -Argument ${powershellQuote(`-NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand ${encodedBrokerCommand}`)} -WorkingDirectory ${powershellQuote(stateDir())}
 $trigger = New-ScheduledTaskTrigger -AtLogOn -User $user
 $principal = New-ScheduledTaskPrincipal -UserId $user -LogonType Interactive -RunLevel Highest
 $settings = New-ScheduledTaskSettingsSet -MultipleInstances IgnoreNew -StartWhenAvailable -ExecutionTimeLimit (New-TimeSpan -Seconds 0)
@@ -48,7 +53,13 @@ Stop-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue
 Register-ScheduledTask -TaskName $taskName -Action $action -Trigger $trigger -Principal $principal -Settings $settings -Force | Out-Null
 Start-ScheduledTask -TaskName $taskName
 `;
-    runPowerShell(script, t);
+}
+export function installAdminBroker(t) {
+    if (process.platform !== 'win32')
+        throw new Error(t('adminBroker.windowsOnly'));
+    // The task cannot start in a working directory that does not exist yet.
+    fs.mkdirSync(stateDir(), { recursive: true });
+    runPowerShell(adminBrokerTaskScript(), t);
 }
 export function uninstallAdminBroker(t) {
     if (process.platform !== 'win32')
@@ -60,36 +71,69 @@ Stop-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue
 Unregister-ScheduledTask -TaskName $taskName -Confirm:$false -ErrorAction SilentlyContinue
 `, t);
 }
-export function adminBrokerStatus() {
+/** Send the broker one request and read the type of its one reply, or null without one. */
+function requestAdminBroker(type) {
     let broker;
     try {
         broker = connectAdminBroker();
     }
     catch {
-        return Promise.resolve(false);
+        return Promise.resolve(null);
     }
     const { socket, token } = broker;
     return new Promise((resolve) => {
         let settled = false;
         let response = '';
-        const finish = (available) => {
+        const finish = (reply) => {
             if (settled)
                 return;
             settled = true;
             socket.destroy();
-            resolve(available);
+            resolve(reply);
         };
-        socket.setTimeout(BROKER_PING_TIMEOUT_MS, () => finish(false));
+        socket.setTimeout(BROKER_PING_TIMEOUT_MS, () => finish(null));
         socket.setEncoding('utf8');
-        socket.on('connect', () => sendAdminBrokerMessage(socket, { type: 'ping', token }));
+        socket.on('connect', () => sendAdminBrokerMessage(socket, { type, token }));
         socket.on('data', (chunk) => {
             response += chunk;
-            if (response.includes('\n'))
-                finish(response.includes('"type":"pong"'));
+            const newline = response.indexOf('\n');
+            if (newline < 0)
+                return;
+            try {
+                finish(String(JSON.parse(response.slice(0, newline)).type));
+            }
+            catch {
+                finish(null);
+            }
         });
-        socket.on('error', () => finish(false));
+        socket.on('error', () => finish(null));
     });
 }
+export async function adminBrokerStatus() {
+    return (await requestAdminBroker('ping')) === 'pong';
+}
+/**
+ * Ask the broker to exit so its task can start it on a new release. It stays
+ * while an administrator terminal is open: that terminal may be the one asking.
+ * A broker from before this request answers neither way.
+ */
+export async function stopAdminBroker() {
+    const reply = await requestAdminBroker('shutdown');
+    return reply === 'bye' ? 'stopped' : reply === 'busy' ? 'busy' : 'unavailable';
+}
+/** Start the broker's task now, which the account that registered it may do unelevated. */
+export function startAdminBrokerTask(t) {
+    if (process.platform !== 'win32')
+        throw new Error(t('adminBroker.windowsOnly'));
+    runPowerShell(`
+$ErrorActionPreference = 'Stop'
+$taskName = ${powershellQuote(adminBrokerTaskName())}
+# A broker that was just stopped may still be ending, and IgnoreNew drops a start until it has.
+$deadline = [DateTime]::UtcNow.AddMilliseconds(${BROKER_TASK_END_TIMEOUT_MS})
+while ((Get-ScheduledTask -TaskName $taskName).State -eq 'Running' -and [DateTime]::UtcNow -lt $deadline) { Start-Sleep -Milliseconds ${BROKER_START_POLL_MS} }
+Start-ScheduledTask -TaskName $taskName
+`, t);
+}
 /** The task starts the broker a moment after it is registered; wait for it to answer. */
 export async function waitForAdminBroker() {
     const deadline = Date.now() + BROKER_START_TIMEOUT_MS;
@@ -105,7 +149,7 @@ function writeError(socket, error) {
     sendAdminBrokerMessage(socket, { type: 'error', message });
     socket.end();
 }
-function startBrokerPty(socket, message) {
+function startBrokerPty(socket, message, spawn) {
     if (typeof message.command !== 'string' || !message.command || message.command.length > 4096)
         throw new Error('Invalid administrator terminal command.');
     if (path.basename(message.command).toLowerCase() !== 'powershell.exe')
@@ -130,6 +174,7 @@ function startBrokerPty(socket, message) {
         platform: 'win32',
         // A plain PowerShell prompt does not need the Herdr UI's Kitty or mouse modes.
         fastWindowsPty: true,
+        spawn,
     });
     pty.start({
         cols: PtySession.clampDimension(message.cols, PtySession.DEFAULT_COLS),
@@ -151,8 +196,9 @@ function startBrokerPty(socket, message) {
     return pty;
 }
 /** Listen on loopback and publish the endpoint; every request must carry its token. */
-export function serveAdminBroker() {
+export function serveAdminBroker({ spawn, onShutdown = () => { }, } = {}) {
     let token = '';
+    const sessions = new Set();
     const server = net.createServer((socket) => {
         socket.setEncoding('utf8');
         let pending = '';
@@ -189,12 +235,23 @@ export function serveAdminBroker() {
                         socket.end();
                         return;
                     }
+                    if (message.type === 'shutdown') {
+                        const busy = sessions.size > 0;
+                        sendAdminBrokerMessage(socket, { type: busy ? 'busy' : 'bye' });
+                        socket.end();
+                        if (!busy) {
+                            server.close();
+                            onShutdown();
+                        }
+                        return;
+                    }
                     if (message.type !== 'start') {
                         writeError(socket, new Error('Expected an administrator terminal start request.'));
                         return;
                     }
                     try {
-                        pty = startBrokerPty(socket, message);
+                        pty = startBrokerPty(socket, message, spawn);
+                        sessions.add(pty);
                     }
                     catch (error) {
                         writeError(socket, error);
@@ -218,8 +275,14 @@ export function serveAdminBroker() {
                 }
             }
         });
-        socket.on('close', () => pty?.kill());
-        socket.on('error', () => pty?.kill());
+        const release = () => {
+            if (!pty)
+                return;
+            pty.kill();
+            sessions.delete(pty);
+        };
+        socket.on('close', release);
+        socket.on('error', release);
     });
     listenAdminBroker(server, (port) => {
         token = publishAdminBrokerEndpoint(port);
@@ -229,7 +292,9 @@ export function serveAdminBroker() {
 function runAdminBroker() {
     if (process.platform !== 'win32')
         throw new Error('Administrator PTYs are only supported on Windows.');
-    serveAdminBroker().on('error', (error) => {
+    serveAdminBroker({
+        onShutdown: () => setTimeout(() => process.exit(0), BROKER_EXIT_GRACE_MS).unref(),
+    }).on('error', (error) => {
         process.stderr.write(`herdr-remote administrator broker: ${error.message}\n`);
     });
 }

package/dist/connector/update-report.js

@@ -54,6 +54,8 @@ export class UpdateReport {
                 updateAvailable: compareVersions(result.latest, running) > 0,
                 // Updated on disk, still running the old code: a restart finishes it.
                 restartPending: compareVersions(installed, running) > 0,
+                // Older connectors leave this out, and their windows keep the npm steps.
+                updateCommand: true,
             });
         })
             .catch(() => {

package/dist/i18n/en.js

@@ -86,6 +86,7 @@ const en = {
     'services.logHost': 'Host connector',
     'adminBroker.windowsOnly': 'The administrator terminal broker only runs on Windows.',
     'adminBroker.needsElevation': 'Open the Windows TUI and choose Set up admin terminal access. Approve the one-time Windows prompt under the same account as Herdr Remote.',
+    'adminBroker.busy': 'An admin terminal is open; close it before restarting the broker.',
     'adminBroker.title': 'Admin terminal broker',
     'adminBroker.checking': 'Checking…',
     'adminBroker.ready': 'Ready',
@@ -244,6 +245,14 @@ const en = {
     'update.mirrorBehind': '{registries} still has an older version; installing from {source}',
     'update.cannot.source': 'Source checkout — update with git',
     'update.cannot.linked': 'Linked package — managed by npm link',
+    'update.stoppingServices': 'Stopping services while npm replaces their files…',
+    'update.restarting': 'Restarting services on the new release…',
+    'update.notRunning': 'Services were not running and were left stopped. Start them with: herdr-remote start',
+    'update.restartFailed': 'Installed, but the services did not restart: {message}',
+    'update.brokerRestarted': 'Admin terminal broker restarted.',
+    'update.brokerRestartFailed': 'The admin terminal broker did not start again. Sign out of Windows and back in, or run herdr-remote admin-broker restart.',
+    'update.brokerBusy': 'An admin terminal is open, so the broker keeps running the previous release. Close admin terminals, then run herdr-remote admin-broker restart.',
+    'update.errorBusy': "A process still holds the herdr-remote folder; an admin terminal broker set up by an older release does. In an administrator PowerShell run: Get-ScheduledTask -TaskName 'HerdrRemoteAdminBroker-*' | Stop-ScheduledTask. Then run herdr-remote update again here, and afterwards herdr-remote admin-broker install as administrator.",
     'relayUpdate.check': 'Relay {version}: check for updates',
     'relayUpdate.checking': 'Relay: checking npm…',
     'relayUpdate.upToDate': 'Relay up to date ({version})',
@@ -254,6 +263,7 @@ const en = {
     'relayUpdate.restart': 'Relay {version} installed, {running} still running (press Enter to restart)',
     'relayUpdate.restarting': 'Restarting herdr-remote…',
     'relayUpdate.restarted': 'herdr-remote restarted; the relay now runs {version}.',
+    'relayUpdate.done': 'Relay updated to {version}',
     'relayUpdate.errorNotApplied': 'npm finished, but relay {installed} is still installed',
     'relayUpdate.banner': 'Relay {latest} is out (installed {current}). Press 7 and Enter on the relay row to install.',
 };

package/dist/i18n/zh.js

@@ -85,6 +85,7 @@ const zh = {
     'services.logHost': '主机连接器',
     'adminBroker.windowsOnly': '管理员终端 broker 只支持 Windows。',
     'adminBroker.needsElevation': '请打开 Windows TUI 并选择“设置管理员终端”，使用运行 Herdr Remote 的同一账户批准一次 Windows 提权提示。',
+    'adminBroker.busy': '有管理员终端开着，请先关闭再重启 broker。',
     'adminBroker.title': '管理员终端 broker',
     'adminBroker.checking': '正在检查…',
     'adminBroker.ready': '已就绪',
@@ -243,6 +244,14 @@ const zh = {
     'update.mirrorBehind': '{registries} 仍是旧版本，将从 {source} 安装',
     'update.cannot.source': '源码目录运行，请使用 git 更新',
     'update.cannot.linked': 'npm link 工作副本，由 npm link 管理',
+    'update.stoppingServices': '替换文件期间先停止服务…',
+    'update.restarting': '正在用新版本重启服务…',
+    'update.notRunning': '服务之前没有运行，保持停止。需要时执行：herdr-remote start',
+    'update.restartFailed': '已安装，但服务没能重启：{message}',
+    'update.brokerRestarted': '管理员终端 broker 已重启。',
+    'update.brokerRestartFailed': '管理员终端 broker 没有重新启动。重新登录 Windows，或运行 herdr-remote admin-broker restart。',
+    'update.brokerBusy': '有管理员终端开着，broker 继续运行旧版本。关闭所有管理员终端后运行 herdr-remote admin-broker restart。',
+    'update.errorBusy': "仍有进程占用 herdr-remote 的安装目录，旧版本设置的管理员终端 broker 会这样。先在管理员 PowerShell 中执行：Get-ScheduledTask -TaskName 'HerdrRemoteAdminBroker-*' | Stop-ScheduledTask，再回到这里重新运行 herdr-remote update，最后以管理员身份运行 herdr-remote admin-broker install。",
     'relayUpdate.check': 'Relay {version}：检查更新',
     'relayUpdate.checking': 'Relay：查询 npm 中…',
     'relayUpdate.upToDate': 'Relay 已是最新（{version}）',
@@ -253,6 +262,7 @@ const zh = {
     'relayUpdate.restart': 'Relay {version} 已安装，运行中的仍是 {running}（按 Enter 重启生效）',
     'relayUpdate.restarting': '正在重启 herdr-remote…',
     'relayUpdate.restarted': 'herdr-remote 已重启，relay 现在运行 {version}。',
+    'relayUpdate.done': 'Relay 已更新至 {version}',
     'relayUpdate.errorNotApplied': 'npm 已完成，但安装的仍是 relay {installed}',
     'relayUpdate.banner': 'Relay {latest} 已发布（当前 {current}），按 7 进入「语言与关于」，在 Relay 一行按 Enter 安装。',
 };

package/dist/keepalive/detached.js

@@ -5,7 +5,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { ensureDir, readJson, writeJsonAtomic } from 'herdr-remote-relay/state';
 import { pidAlive } from '../lib/process.js';
-import { logPath, PACKAGE_ROOT, stateDir } from '../paths.js';
+import { logPath, stateDir } from '../paths.js';
 import { cliEntryPoint, serviceEnvironment } from './environment.js';
 function fallbackPidPath() {
     return path.join(stateDir(), 'supervisor.pid');
@@ -22,7 +22,8 @@ function start() {
     const logFd = fs.openSync(logPath('supervisor'), 'a');
     try {
         const child = spawn(process.execPath, [cliEntryPoint(), 'run', '--daemon'], {
-            cwd: PACKAGE_ROOT,
+            // Not PACKAGE_ROOT: npm renames it to update, which Windows refuses for a working directory.
+            cwd: stateDir(),
             env: { ...process.env, HERDR_REMOTE_SERVICE: '1', ...serviceEnvironment() },
             detached: true,
             windowsHide: true,

package/dist/lifecycle.js

@@ -49,8 +49,12 @@ function restartAll(config = loadConfig()) {
     }
     return { ...restartServices(), managed: false };
 }
+/** Whether the host connector is up, under a keep-alive manager or detached. */
+function servicesRunning(config = loadConfig()) {
+    return Boolean(managerInUse(config)?.active || pidAlive(readRuntime().hostPid));
+}
 /** Stop Windows keep-alive processes while npm replaces their package files. */
-async function whileServicesStopped(config, task, { platform = process.platform, isRunning = () => Boolean(managerInUse(config)?.active || pidAlive(readRuntime().hostPid)), stop = stopAll, start = startAll, } = {}) {
+async function whileServicesStopped(config, task, { platform = process.platform, isRunning = () => servicesRunning(config), stop = stopAll, start = startAll, } = {}) {
     if (platform !== 'win32' || !isRunning())
         return task();
     await stop(config);
@@ -70,4 +74,4 @@ async function fullStatus(config = loadConfig()) {
         logsHint: keepalive.logsHint(config),
     };
 }
-export { startAll, stopAll, restartAll, fullStatus, managerInUse, whileServicesStopped };
+export { startAll, stopAll, restartAll, fullStatus, managerInUse, servicesRunning, whileServicesStopped, };

package/dist/node-pty-loader.js

@@ -0,0 +1,80 @@
+// Where node-pty is loaded from.
+//
+// npm updates this package by renaming its directory and deleting the old one,
+// and Windows refuses both while a process has a file in it loaded: node-pty's
+// .node modules, or the OpenConsole.exe that ConPTY starts from beside them.
+// The host connector and the admin broker hold those for as long as they run,
+// so on Windows node-pty is loaded from a copy in the state directory, one per
+// build. Copies are never deleted: a process of an older release may still
+// have one loaded, and a build is a few megabytes.
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { stateDir } from './paths.js';
+const require = createRequire(import.meta.url);
+/** What node-pty loads or starts; debug symbols are most of the prebuilds' size. */
+const BINARY_EXTENSIONS = ['.node', '.dll', '.exe'];
+/** The files a running node-pty needs, relative to its package directory. */
+function runtimeFiles(source, platform, arch) {
+    const files = ['package.json'];
+    const collect = (directory, keep) => {
+        const absolute = path.join(source, directory);
+        if (!fs.existsSync(absolute))
+            return;
+        for (const entry of fs.readdirSync(absolute, { recursive: true, withFileTypes: true })) {
+            if (entry.isFile() && keep(entry.name))
+                files.push(path.relative(source, path.join(entry.parentPath, entry.name)));
+        }
+    };
+    collect('lib', (name) => name.endsWith('.js') && !name.endsWith('.test.js'));
+    const binary = (name) => BINARY_EXTENSIONS.includes(path.extname(name));
+    // Where node-pty looks for its modules: a local build, then the prebuilds.
+    collect(path.join('build', 'Release'), binary);
+    collect(path.join('prebuilds', `${platform}-${arch}`), binary);
+    return files;
+}
+/** Copy node-pty's run-time files under `directory`, once per build; returns the copy. */
+export function copyNodePty(source, directory, platform, arch) {
+    const files = runtimeFiles(source, platform, arch);
+    const hash = createHash('sha256');
+    for (const file of files)
+        hash.update(`${file}\0`).update(fs.readFileSync(path.join(source, file)));
+    const target = path.join(directory, hash.digest('hex').slice(0, 16));
+    if (fs.existsSync(target))
+        return target;
+    // Renamed into place whole, so a copy that exists is complete.
+    const staging = `${target}.${process.pid}.tmp`;
+    for (const file of files) {
+        fs.mkdirSync(path.dirname(path.join(staging, file)), { recursive: true });
+        fs.copyFileSync(path.join(source, file), path.join(staging, file));
+    }
+    try {
+        fs.renameSync(staging, target);
+    }
+    catch (error) {
+        fs.rmSync(staging, { recursive: true, force: true });
+        // Another process put the same build in place first.
+        if (!fs.existsSync(target))
+            throw error;
+    }
+    return target;
+}
+export function loadNodePty({ platform = process.platform, arch = process.arch, source = path.dirname(require.resolve('node-pty/package.json')), directory = path.join(stateDir(), 'node-pty'), warn = (message) => process.stderr.write(`${message}\n`), } = {}) {
+    if (platform !== 'win32')
+        return require(source);
+    try {
+        return require(copyNodePty(source, directory, platform, arch));
+    }
+    catch (error) {
+        // Terminals still work from the package; only an update has to wait for them to end.
+        warn(`herdr-remote: could not copy node-pty out of the package: ${error.message}`);
+        return require(source);
+    }
+}
+let loaded = null;
+/** node-pty, loaded on first use: only processes that start terminals pay for it. */
+export function nodePty() {
+    loaded ??= loadNodePty();
+    return loaded;
+}

package/dist/pty-session.js

@@ -1,5 +1,5 @@
 import os from 'node:os';
-import pty from 'node-pty';
+import { nodePty } from './node-pty-loader.js';
 class PtySession {
     static DEFAULT_COLS = 100;
     static DEFAULT_ROWS = 30;
@@ -14,7 +14,7 @@ class PtySession {
     spawnPty;
     terminal;
     startedAt;
-    constructor({ command, args = [], cwd = os.homedir(), socketPath, platform = process.platform, spawn: spawnPty = pty.spawn, fastWindowsPty = false, } = {}) {
+    constructor({ command, args = [], cwd = os.homedir(), socketPath, platform = process.platform, spawn: spawnPty = nodePty().spawn, fastWindowsPty = false, } = {}) {
         if (typeof command !== 'string' || command.length === 0)
             throw new TypeError('command must be a non-empty string');
         if (!Array.isArray(args) || !args.every((arg) => typeof arg === 'string'))

package/dist/service.js

@@ -40,6 +40,7 @@ export function serviceSpecs(config = loadConfig(), state = ensureRuntime()) {
             name: 'relay',
             command: process.execPath,
             args: [relayBinPath()],
+            cwd: stateDir(),
             env: {
                 // Let the shared web UI tell a private workstation relay apart from
                 // the operator-facing self-hosted relay. Standalone relay installs
@@ -71,6 +72,7 @@ export function serviceSpecs(config = loadConfig(), state = ensureRuntime()) {
         name: 'host',
         command: process.execPath,
         args: [path.join(PACKAGE_ROOT, 'dist', 'connector', 'main.js')],
+        cwd: stateDir(),
         env: {
             // Captured here, where a terminal may still be attached, because the
             // connector itself usually runs detached with no terminal to ask.
@@ -96,7 +98,7 @@ function spawnDetached(spec) {
     const logFd = fs.openSync(logPath(spec.name), 'a');
     try {
         const child = spawn(spec.command, spec.args, {
-            cwd: PACKAGE_ROOT,
+            cwd: spec.cwd,
             env: { ...baseEnvironment(), ...spec.env },
             detached: true,
             // A detached console program can open a visible window from a console-less Windows parent.

package/dist/supervisor.js

@@ -1,7 +1,7 @@
 import fs from 'node:fs';
 import { spawn } from 'node:child_process';
 import { loadConfig } from './config.js';
-import { logPath, PACKAGE_ROOT, stateDir } from './paths.js';
+import { logPath, stateDir } from './paths.js';
 import { ensureDir } from 'herdr-remote-relay/state';
 import { ensureRuntime, managedPids, recordManagedPid, updateRuntime, } from './runtime.js';
 import { baseEnvironment, serviceSpecs } from './service.js';
@@ -131,7 +131,7 @@ class Supervisor {
         let child;
         try {
             child = spawn(entry.spec.command, entry.spec.args, {
-                cwd: PACKAGE_ROOT,
+                cwd: entry.spec.cwd,
                 env: { ...baseEnvironment(), ...entry.spec.env },
                 windowsHide: true,
                 stdio,

package/dist/update-command.js

@@ -0,0 +1,120 @@
+// `herdr-remote update`: install the newest release and restart what was running.
+//
+// The TUI's update row installs and leaves the restart to a second key press;
+// a command run over SSH or from a script has nobody to press it. The restart
+// is run by the release just installed, not by this process: this process
+// still runs the old code, and would start the services as the old release
+// described them.
+import { spawnSync } from 'node:child_process';
+import { loadConfig } from './config.js';
+import { startAdminBrokerTask, stopAdminBroker, waitForAdminBroker, } from './connector/admin-broker.js';
+import { cliEntryPoint } from './keepalive/environment.js';
+import { servicesRunning, startAll, stopAll } from './lifecycle.js';
+import { checkForRelayUpdate, performRelayUpdate } from './relay-updater.js';
+import { checkForUpdate, performUpdate } from './updater.js';
+const RESTART_TIMEOUT_MS = 120_000;
+function restartWithInstalledRelease() {
+    const result = spawnSync(process.execPath, [cliEntryPoint(), 'restart', '--json'], {
+        encoding: 'utf8',
+        timeout: RESTART_TIMEOUT_MS,
+        windowsHide: true,
+    });
+    if (!result.error && result.status === 0)
+        return { ok: true, message: '' };
+    const output = String(result.stderr || result.stdout || '').trim();
+    return { ok: false, message: result.error?.message || output || `exit ${result.status}` };
+}
+export async function runUpdate(t, options = {}) {
+    const config = () => options.config ?? loadConfig();
+    const { platform = process.platform, checkCli = () => checkForUpdate(), checkRelay = () => checkForRelayUpdate(), installCli = (check, onAttempt) => performUpdate({
+        registry: check.registry,
+        sources: check.sources,
+        version: check.latest,
+        onAttempt,
+    }), installRelay = (check, onAttempt) => performRelayUpdate({
+        registry: check.registry,
+        sources: check.sources,
+        relayVersion: check.latest ?? '',
+        onAttempt,
+    }), isRunning = () => servicesRunning(config()), stop = () => stopAll(config()), start = () => startAll(config()), restartInstalled = restartWithInstalledRelease, stopBroker = stopAdminBroker, startBroker = async () => {
+        try {
+            startAdminBrokerTask(t);
+        }
+        catch {
+            // Denied or no task: the broker does not answer, which is reported next.
+        }
+        return waitForAdminBroker();
+    }, report = (line) => process.stdout.write(`${line}\n`), } = options;
+    report(t('update.checking'));
+    const [cli, relay] = await Promise.all([checkCli(), checkRelay()]);
+    const { current } = cli;
+    if (!cli.ok) {
+        report(t('update.errorNetworkDetail', { message: cli.message ?? '' }));
+        return { ok: false, current, updated: null, restarted: false, errorKey: cli.errorKey };
+    }
+    // A new herdr-remote brings the newest relay its range allows; only a
+    // current one needs the relay installed by itself.
+    const updated = cli.updateAvailable ? 'cli' : relay.ok && relay.updateAvailable ? 'relay' : null;
+    if (!updated) {
+        report(t('update.upToDate', { version: current }));
+        return { ok: true, current, updated, restarted: false };
+    }
+    const version = (updated === 'cli' ? cli.latest : relay.latest) ?? '';
+    const wasRunning = isRunning();
+    // Windows refuses to replace files a running process holds, as services
+    // started by older releases do. Elsewhere they keep serving until the restart.
+    const stopped = platform === 'win32' && wasRunning;
+    if (stopped) {
+        report(t('update.stoppingServices'));
+        stop();
+    }
+    // The admin broker stops too, so its task starts it on the new release.
+    const broker = platform === 'win32' ? await stopBroker() : 'unavailable';
+    const restoreBroker = async () => {
+        if (broker !== 'stopped')
+            return broker === 'busy' ? 'busy' : null;
+        const back = await startBroker();
+        report(t(back ? 'update.brokerRestarted' : 'update.brokerRestartFailed'));
+        return back ? 'restarted' : 'failed';
+    };
+    report(t(updated === 'cli' ? 'update.updating' : 'relayUpdate.updating', { version }));
+    const onAttempt = ({ attempt }) => {
+        if (attempt > 1)
+            report(t('update.updatingRetry', { version, attempt }));
+    };
+    const result = updated === 'cli' ? await installCli(cli, onAttempt) : await installRelay(relay, onAttempt);
+    if (!result.ok) {
+        // Nothing was replaced, so the old release starts as it was.
+        if (stopped)
+            start();
+        const adminBroker = await restoreBroker();
+        report(t(result.errorKey ?? 'update.errorFailed', { version, installed: result.installed ?? '' }));
+        if (result.summary)
+            report(t('update.errorFailedDetail', { message: result.summary }));
+        if (platform === 'win32' && /\b(EBUSY|EPERM)\b/.test(result.output ?? '')) {
+            report(t('update.errorBusy'));
+        }
+        const { errorKey, summary } = result;
+        return { ok: false, current, updated, restarted: false, adminBroker, errorKey, summary };
+    }
+    const installed = result.installed ?? version;
+    report(t(updated === 'cli' ? 'update.done' : 'relayUpdate.done', { version: installed }));
+    let ok = true;
+    let restarted = false;
+    if (!wasRunning) {
+        report(t('update.notRunning'));
+    }
+    else {
+        report(t('update.restarting'));
+        const restart = restartInstalled();
+        ok = restart.ok;
+        restarted = restart.ok;
+        report(restart.ok
+            ? t('services.restarted')
+            : t('update.restartFailed', { message: restart.message }));
+    }
+    if (broker === 'busy')
+        report(t('update.brokerBusy'));
+    const adminBroker = await restoreBroker();
+    return { ok, current, updated, installed, restarted, adminBroker };
+}

package/herdr-plugin.toml

@@ -1,6 +1,6 @@
 id = "herdr.remote.web"
 name = "Herdr Remote Web"
-version = "0.2.27"
+version = "0.2.28"
 min_herdr_version = "0.9.1"
 description = "Browser access to Herdr workspaces via local or self-hosted relay"
 platforms = ["linux", "macos", "windows"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "herdr-remote",
-  "version": "0.2.27",
+  "version": "0.2.28",
   "description": "Browser access to Herdr workspaces: plugin, host connector, and configuration TUI",
   "license": "MIT",
   "type": "module",