herdr-remote 0.2.32 → 0.2.34

package/dist/tui/screens/About.js

@@ -2,18 +2,17 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useEffect, useState } from 'react';
 import { Box, Text, useInput } from 'ink';
 import { theme } from '../theme.js';
-import { useRelayUpdate } from './useRelayUpdate.js';
 import { Message, Panel, Row, Selectable } from '../components/common.js';
-import { canSelfUpdate, checkForUpdate, configPath, currentVersion, detectLocale, installKind, performUpdate, saveDraft, setField, stateDir, whileServicesStopped, } from '../api.js';
+import { canSelfUpdate, cliTarballUrl, checkForUpdate, configPath, currentVersion, detectLocale, installKind, installedRelayVersion, performUpdate, runsLocalRelay, saveDraft, setField, stateDir, whileServicesStopped, } from '../api.js';
 /** `https://registry.npmmirror.com` → `registry.npmmirror.com`, for one line of text. */
-const registryHost = (registry) => registry.replace(/^https?:\/\//, '');
+const sourceHost = (source) => source.replace(/^https?:\/\//, '');
 export function About({ ctx }) {
     const { t, draft } = ctx;
     const [selected, setSelected] = useState('auto');
     const [update, setUpdate] = useState({ phase: 'idle' });
-    /** Why the install will come from somewhere other than npm's own registry. */
+    /** Why the install will come from somewhere other than where some sources said. */
     const [sourceNote, setSourceNote] = useState(null);
-    const checkRef = useState(() => ({ current: { registry: '', sources: [] } }))[0];
+    const checkRef = useState(() => ({ current: { source: '', sources: [] } }))[0];
     const detected = detectLocale({ preference: 'auto' });
     const languageOptions = [
         { id: 'auto', label: t('about.languageAuto', { detected }) },
@@ -43,24 +42,19 @@ export function About({ ctx }) {
                 return t('update.check');
         }
     })();
-    const relay = useRelayUpdate(ctx);
-    const options = [
-        ...languageOptions,
-        { id: 'update', label: updateLabel },
-        ...(relay.visible ? [{ id: 'relay-update', label: relay.label }] : []),
-    ];
+    const options = [...languageOptions, { id: 'update', label: updateLabel }];
     /** Show a check's answer, whether this screen asked or the TUI did on opening. */
     const applyCheck = (result) => {
-        checkRef.current = { registry: result.registry ?? '', sources: result.sources ?? [] };
-        // A mirror that has not synced the release yet used to be the whole
+        checkRef.current = { source: result.source ?? '', sources: result.sources ?? [] };
+        // A registry that has not synced the release yet used to be the whole
         // answer. It is still asked, and said to be behind.
         const behind = result.behind ?? [];
-        setSourceNote(result.updateAvailable && behind.length > 0 && result.registry
+        setSourceNote(result.updateAvailable && behind.length > 0 && result.source
             ? {
                 registries: behind
-                    .map((entry) => `${registryHost(entry.registry)} ${entry.version ?? ''}`.trim())
+                    .map((entry) => `${sourceHost(entry.source)} ${entry.version ?? ''}`.trim())
                     .join(', '),
-                source: registryHost(result.registry),
+                source: sourceHost(result.source),
             }
             : null);
         setUpdate(result.updateAvailable
@@ -79,7 +73,7 @@ export function About({ ctx }) {
         const result = await checkForUpdate();
         if (!result.ok) {
             setUpdate({ phase: 'error', messageKey: result.errorKey ?? 'update.errorNetwork' });
-            // Which registries were tried, and what each of them said. Without this
+            // Which sources were tried, and what each of them said. Without this
             // the row reads "could not reach npm registry" on a machine where
             // `npm install` works perfectly, and there is nothing to act on.
             const { message } = result;
@@ -93,13 +87,17 @@ export function About({ ctx }) {
     const runUpdate = async (latest) => {
         setUpdate({ phase: 'updating', latest, attempt: 1 });
         const result = await whileServicesStopped(ctx.config, () => performUpdate({
-            registry: checkRef.current.registry,
+            source: checkRef.current.source,
             sources: checkRef.current.sources,
             version: latest,
             onAttempt: ({ attempt }) => setUpdate({ phase: 'updating', latest, attempt }),
         }));
         if (!result.ok) {
-            const params = { version: latest, installed: result.installed ?? '' };
+            const params = {
+                version: latest,
+                installed: result.installed ?? '',
+                url: cliTarballUrl(latest),
+            };
             setUpdate({ phase: 'error', messageKey: result.errorKey ?? 'update.errorFailed', params });
             // npm's own words: "update failed" alone is what left this unfixable.
             ctx.notify((t) => result.summary
@@ -149,10 +147,6 @@ export function About({ ctx }) {
         }
     };
     const activate = (id) => {
-        if (id === 'relay-update') {
-            relay.activate();
-            return;
-        }
         if (id === 'update') {
             activateUpdate();
             return;
@@ -174,8 +168,5 @@ export function About({ ctx }) {
                     }, onHover: () => setSelected(option.id), children: `${option.label}${draft.ui.language === option.id ? '  ✓' : ''}` }, option.id))) }), _jsx(Text, { color: theme.muted, children: t('update.title') }), _jsxs(Box, { flexDirection: "column", marginTop: 1, marginBottom: 1, children: [_jsx(Selectable, { selected: selected === 'update', onSelect: () => {
                             setSelected('update');
                             activateUpdate();
-                        }, onHover: () => setSelected('update'), children: updateLabel }), sourceNote ? (_jsx(Text, { color: theme.muted, children: `  ${t('update.mirrorBehind', sourceNote)}` })) : null, relay.visible ? (_jsx(Selectable, { selected: selected === 'relay-update', onSelect: () => {
-                            setSelected('relay-update');
-                            relay.activate();
-                        }, onHover: () => setSelected('relay-update'), children: relay.label })) : null] }), _jsx(Row, { label: t('about.version'), children: _jsx(Text, { color: theme.muted, children: currentVersion() }) }), relay.visible ? (_jsx(Row, { label: t('about.relayPackage'), children: _jsx(Text, { color: theme.muted, children: relay.installed ?? '?' }) })) : null, _jsx(Row, { label: t('about.configPath'), children: _jsx(Text, { color: theme.muted, children: configPath() }) }), _jsx(Row, { label: t('about.statePath'), children: _jsx(Text, { color: theme.muted, children: stateDir() }) }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { color: theme.muted, children: t('about.docs') }) }), _jsx(Message, { text: ctx.message?.text ?? null, level: ctx.message?.level ?? 'info' })] }));
+                        }, onHover: () => setSelected('update'), children: updateLabel }), sourceNote ? (_jsx(Text, { color: theme.muted, children: `  ${t('update.mirrorBehind', sourceNote)}` })) : null] }), _jsx(Row, { label: t('about.version'), children: _jsx(Text, { color: theme.muted, children: currentVersion() }) }), runsLocalRelay(ctx.config) ? (_jsx(Row, { label: t('about.relayPackage'), children: _jsx(Text, { color: theme.muted, children: installedRelayVersion() ?? '?' }) })) : null, _jsx(Row, { label: t('about.configPath'), children: _jsx(Text, { color: theme.muted, children: configPath() }) }), _jsx(Row, { label: t('about.statePath'), children: _jsx(Text, { color: theme.muted, children: stateDir() }) }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { color: theme.muted, children: t('about.docs') }) }), _jsx(Message, { text: ctx.message?.text ?? null, level: ctx.message?.level ?? 'info' })] }));
 }

package/dist/update-command.js

@@ -6,11 +6,11 @@
 // still runs the old code, and would start the services as the old release
 // described them.
 import { spawnSync } from 'node:child_process';
+import { cliTarballUrl } from 'herdr-remote-relay/protocol';
 import { loadConfig } from './config.js';
 import { startAdminBrokerTask, stopAdminBroker, waitForAdminBroker, } from './connector/admin-broker.js';
 import { cliEntryPoint } from './keepalive/environment.js';
 import { servicesRunning, startAll, stopAll } from './lifecycle.js';
-import { checkForRelayUpdate, performRelayUpdate } from './relay-updater.js';
 import { checkForUpdate, performUpdate } from './updater.js';
 import { heldByAnotherProcess } from './updater/in-place.js';
 const RESTART_TIMEOUT_MS = 120_000;
@@ -27,16 +27,11 @@ function restartWithInstalledRelease() {
 }
 export async function runUpdate(t, options = {}) {
     const config = () => options.config ?? loadConfig();
-    const { platform = process.platform, checkCli = () => checkForUpdate(), checkRelay = () => checkForRelayUpdate(), installCli = (check, onAttempt) => performUpdate({
-        registry: check.registry,
+    const { platform = process.platform, checkCli = () => checkForUpdate(), installCli = (check, onAttempt) => performUpdate({
+        source: check.source,
         sources: check.sources,
         version: check.latest,
         onAttempt,
-    }), installRelay = (check, onAttempt) => performRelayUpdate({
-        registry: check.registry,
-        sources: check.sources,
-        relayVersion: check.latest ?? '',
-        onAttempt,
     }), isRunning = () => servicesRunning(config()), stop = () => stopAll(config()), start = () => startAll(config()), restartInstalled = restartWithInstalledRelease, stopBroker = stopAdminBroker, startBroker = async () => {
         try {
             startAdminBrokerTask(t);
@@ -47,20 +42,18 @@ export async function runUpdate(t, options = {}) {
         return waitForAdminBroker();
     }, report = (line) => process.stdout.write(`${line}\n`), } = options;
     report(t('update.checking'));
-    const [cli, relay] = await Promise.all([checkCli(), checkRelay()]);
+    const cli = await checkCli();
     const { current } = cli;
     if (!cli.ok) {
         report(t('update.errorNetworkDetail', { message: cli.message ?? '' }));
         return { ok: false, current, updated: null, restarted: false, errorKey: cli.errorKey };
     }
-    // A new herdr-remote brings the newest relay its range allows; only a
-    // current one needs the relay installed by itself.
-    const updated = cli.updateAvailable ? 'cli' : relay.ok && relay.updateAvailable ? 'relay' : null;
-    if (!updated) {
+    if (!cli.updateAvailable) {
         report(t('update.upToDate', { version: current }));
-        return { ok: true, current, updated, restarted: false };
+        return { ok: true, current, updated: null, restarted: false };
     }
-    const version = (updated === 'cli' ? cli.latest : relay.latest) ?? '';
+    const updated = 'cli';
+    const version = cli.latest ?? '';
     const wasRunning = isRunning();
     // Windows refuses to replace files a running process holds, as services
     // started by older releases do. Elsewhere they keep serving until the restart.
@@ -78,18 +71,22 @@ export async function runUpdate(t, options = {}) {
         report(t(back ? 'update.brokerRestarted' : 'update.brokerRestartFailed'));
         return back ? 'restarted' : 'failed';
     };
-    report(t(updated === 'cli' ? 'update.updating' : 'relayUpdate.updating', { version }));
+    report(t('update.updating', { version }));
     const onAttempt = ({ attempt }) => {
         if (attempt > 1)
             report(t('update.updatingRetry', { version, attempt }));
     };
-    const result = updated === 'cli' ? await installCli(cli, onAttempt) : await installRelay(relay, onAttempt);
+    const result = await installCli(cli, onAttempt);
     if (!result.ok) {
         // Nothing was replaced, so the old release starts as it was.
         if (stopped)
             start();
         const adminBroker = await restoreBroker();
-        report(t(result.errorKey ?? 'update.errorFailed', { version, installed: result.installed ?? '' }));
+        report(t(result.errorKey ?? 'update.errorFailed', {
+            version,
+            installed: result.installed ?? '',
+            url: cliTarballUrl(version),
+        }));
         if (result.summary)
             report(t('update.errorFailedDetail', { message: result.summary }));
         if (platform === 'win32' && heldByAnotherProcess(result.output)) {
@@ -99,7 +96,7 @@ export async function runUpdate(t, options = {}) {
         return { ok: false, current, updated, restarted: false, adminBroker, errorKey, summary };
     }
     const installed = result.installed ?? version;
-    report(t(updated === 'cli' ? 'update.done' : 'relayUpdate.done', { version: installed }));
+    report(t('update.done', { version: installed }));
     let ok = true;
     let restarted = false;
     if (!wasRunning) {

package/dist/updater.js

@@ -1,17 +1,25 @@
-// Self-update for the npm-installed CLI.
+// Self-update for the installed CLI.
 //
-// The update path is only meaningful for a package installed from npm. A source
-// checkout is managed by git and a linked development copy by the developer, so
-// this refuses to touch either: silently running `npm install -g` over a
-// checkout would replace the tree someone is working in.
+// Releases come from GitHub first and npm second: a GitHub Release installs the
+// moment it exists, while npm can take many minutes after publishing before a
+// version resolves. Both carry the same self-contained tarball, which bundles
+// the relay, so one install updates both.
+//
+// The update path is only meaningful for a package installed with npm. A
+// source checkout is managed by git and a linked development copy by the
+// developer, so this refuses to touch either: silently running `npm install -g`
+// over a checkout would replace the tree someone is working in.
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { spawn } from 'node:child_process';
+import { createRequire } from 'node:module';
+import { cliTarballUrl, GITHUB_RELEASES_URL, LATEST_CLI_TARBALL_URL, LATEST_RELEASE_MANIFEST_URL, } from 'herdr-remote-relay/protocol';
 import { PACKAGE_ROOT } from './paths.js';
 import { heldByAnotherProcess, installInPlace } from './updater/in-place.js';
 import { runNpm } from './updater/npm.js';
 const PACKAGE_NAME = 'herdr-remote';
+const RELAY_PACKAGE = 'herdr-remote-relay';
 const DEFAULT_REGISTRY = 'https://registry.npmjs.org';
 /**
  * A public mirror, tried last.
@@ -30,10 +38,20 @@ function currentVersion() {
         return '0.0.0';
     }
 }
+/** The relay bundled with this herdr-remote, read from disk: an update replaces it. */
+function installedRelayVersion() {
+    try {
+        const manifest = createRequire(import.meta.url).resolve(`${RELAY_PACKAGE}/package.json`);
+        return JSON.parse(fs.readFileSync(manifest, 'utf8')).version;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * How this copy got here.
  *
- * - `npm`      installed from the registry; updating is `npm install -g`.
+ * - `npm`      installed with npm, from a release tarball or a registry; updating is `npm install -g`.
  * - `linked`   `npm link`ed into a global tree from a working copy.
  * - `source`   run straight out of a checkout.
  *
@@ -167,13 +185,13 @@ async function fetchJson(url, { timeoutMs, fetchImpl }) {
  * format, which npmjs refuses on that path with a 406, so every check quietly
  * fell through to a mirror that had not synced the release yet.
  */
-async function askRegistry(registry, { timeoutMs, fetchImpl, packageName, }) {
+async function askRegistry(registry, { timeoutMs, fetchImpl }) {
     const endpoints = [
         {
-            url: `${registry}/-/package/${packageName}/dist-tags`,
+            url: `${registry}/-/package/${PACKAGE_NAME}/dist-tags`,
             read: (body) => body?.latest,
         },
-        { url: `${registry}/${packageName}/latest`, read: (body) => body?.version },
+        { url: `${registry}/${PACKAGE_NAME}/latest`, read: (body) => body?.version },
     ];
     let message = null;
     for (const endpoint of endpoints) {
@@ -189,25 +207,47 @@ async function askRegistry(registry, { timeoutMs, fetchImpl, packageName, }) {
     }
     return { ok: false, message };
 }
+const VERSION_PATTERN = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+/** The newest GitHub Release, from the manifest every release carries. */
+async function askGithubReleases(manifestUrl, { timeoutMs, fetchImpl }) {
+    const attempt = await fetchJson(manifestUrl, { timeoutMs, fetchImpl });
+    if (!attempt.ok)
+        return attempt;
+    const version = attempt.body?.version;
+    if (typeof version === 'string' && VERSION_PATTERN.test(version)) {
+        return { ok: true, latest: version };
+    }
+    return { ok: false, message: 'release manifest has no version' };
+}
 /**
  * Ask what the current release is.
  *
  * Never throws: an update check is a convenience, and a machine that is offline
  * or behind a proxy should still get a working settings screen.
  *
- * Every registry is asked at once and the newest answer wins. Taking the first
- * answer let a mirror a few minutes (or hours) behind report the release before
- * last as current. `sources` lists the registries that already carry the
- * newest version, preferred order first, which is where an install should come
- * from; `behind` lists the ones that do not, so the screen can say why.
+ * GitHub Releases and every registry are asked at once and the newest answer
+ * wins. Taking the first answer let a mirror a few minutes (or hours) behind
+ * report the release before last as current. `sources` lists the ones that
+ * already carry the newest version, GitHub first, which is where an install
+ * should come from; `behind` lists the ones that do not, so the screen can say
+ * why. GitHub is not reachable from every network, which is what the
+ * registries are still asked for.
  */
-async function checkForUpdate({ timeoutMs = 6000, fetchImpl = globalThis.fetch, registries = registryCandidates(), 
-// Another package this one installs, and the version of it on disk: the relay.
-packageName = PACKAGE_NAME, current = currentVersion(), } = {}) {
-    const attempts = await Promise.all(registries.map(async (registry) => ({
-        registry,
-        ...(await askRegistry(registry, { timeoutMs, fetchImpl, packageName })),
-    })));
+async function checkForUpdate({ timeoutMs = 6000, fetchImpl = globalThis.fetch, registries = registryCandidates(), releaseManifest = LATEST_RELEASE_MANIFEST_URL, current = currentVersion(), } = {}) {
+    const attempts = await Promise.all([
+        ...(releaseManifest
+            ? [
+                askGithubReleases(releaseManifest, { timeoutMs, fetchImpl }).then((answer) => ({
+                    source: GITHUB_RELEASES_URL,
+                    ...answer,
+                })),
+            ]
+            : []),
+        ...registries.map(async (registry) => ({
+            source: registry,
+            ...(await askRegistry(registry, { timeoutMs, fetchImpl })),
+        })),
+    ]);
     const answers = attempts.filter((attempt) => attempt.ok);
     if (answers.length === 0) {
         // The reason is carried out with the failure. "Could not reach npm
@@ -218,9 +258,8 @@ packageName = PACKAGE_NAME, current = currentVersion(), } = {}) {
             current,
             errorKey: 'update.errorNetwork',
             message: attempts
-                .map((attempt) => `${attempt.registry}: ${'message' in attempt ? attempt.message : ''}`)
+                .map((attempt) => `${attempt.source}: ${'message' in attempt ? attempt.message : ''}`)
                 .join('; '),
-            triedRegistries: registries,
         };
     }
     const latest = answers
@@ -228,15 +267,15 @@ packageName = PACKAGE_NAME, current = currentVersion(), } = {}) {
         .reduce((best, version) => (compareVersions(version, best) > 0 ? version : best));
     const sources = answers
         .filter((answer) => compareVersions(answer.latest, latest) === 0)
-        .map((answer) => answer.registry);
+        .map((answer) => answer.source);
     const behind = answers
         .filter((answer) => compareVersions(answer.latest, latest) < 0)
-        .map((answer) => ({ registry: answer.registry, version: answer.latest }));
+        .map((answer) => ({ source: answer.source, version: answer.latest }));
     return {
         ok: true,
         current,
         latest,
-        registry: sources[0],
+        source: sources[0],
         sources,
         behind,
         updateAvailable: compareVersions(latest, current) > 0,
@@ -270,7 +309,6 @@ function installedVersionOnDisk() {
         return null;
     }
 }
-const VERSION_PATTERN = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
 /**
  * Install a release over this one.
  *
@@ -278,13 +316,14 @@ const VERSION_PATTERN = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
  * npm's own message; npm's diagnostics are more useful than anything that could
  * be invented here.
  *
- * - The exact version the check found is installed, not `@latest`, from a
- *   registry that reported it, with `--prefer-online` so npm revalidates the
- *   package metadata it cached before the release existed.
+ * - The exact version the check found is installed, not `@latest`, from the
+ *   sources that reported it: GitHub's release tarball first, then registries,
+ *   asked with `--prefer-online` so npm revalidates the package metadata it
+ *   cached before the release existed.
  * - Right after a release, npm's view of the package can still lack the new
  *   version although its dist-tag already points at it: npm answers ETARGET.
  *   That is a wait, not a failure, so it is retried a few times, then the next
- *   registry that carries the version is tried.
+ *   source that carries the version is tried.
  * - On Windows, when something holds the package directory so npm cannot
  *   rename it, the release is copied over it instead.
  * - Success is what is on disk afterwards, not npm's exit code.
@@ -293,30 +332,34 @@ async function performUpdate({ spawnImpl = spawn, timeoutMs = 180_000,
 // Seam for tests: the suite runs from a checkout, where the guard below is
 // correctly the only reachable outcome.
 installKindImpl = installKind, 
-// The registries that reported `version`, preferred first. Empty means
-// "whatever npm is configured with", which is right when no check has run.
-registry = '', sources = [], version = null, attempts = 3, retryDelayMs = 15_000, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), readInstalledVersion = installedVersionOnDisk, onAttempt = () => { }, platform = process.platform, inPlace = installInPlace, } = {}) {
+// The sources that reported `version`, preferred first. Empty means GitHub,
+// then whatever registry npm is configured with, which is right when no
+// check has run.
+source = '', sources = [], version = null, attempts = 3, retryDelayMs = 15_000, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), readInstalledVersion = installedVersionOnDisk, onAttempt = () => { }, platform = process.platform, inPlace = installInPlace, } = {}) {
     const kind = installKindImpl();
     if (kind !== 'npm')
         return { ok: false, errorKey: `update.cannot.${kind}` };
     const target = typeof version === 'string' && VERSION_PATTERN.test(version) ? version : null;
-    const spec = `${PACKAGE_NAME}@${target || 'latest'}`;
-    const registries = [];
-    for (const candidate of [registry, ...sources]) {
+    const candidates = [];
+    for (const candidate of [source, ...sources]) {
         const normalized = normalizeRegistry(candidate);
-        if (normalized && !registries.includes(normalized))
-            registries.push(normalized);
+        if (normalized && !candidates.includes(normalized))
+            candidates.push(normalized);
     }
-    if (registries.length === 0)
-        registries.push('');
+    // '' is npm's own configured registry.
+    if (candidates.length === 0)
+        candidates.push(GITHUB_RELEASES_URL, '');
     let last = { ok: false, output: '' };
     let notYetPublished = false;
-    for (const source of registries) {
+    for (const candidate of candidates) {
+        const github = candidate === GITHUB_RELEASES_URL;
+        const args = github
+            ? ['install', '-g', target ? cliTarballUrl(target) : LATEST_CLI_TARBALL_URL]
+            : ['install', '-g', `${PACKAGE_NAME}@${target || 'latest'}`, '--prefer-online'];
+        if (candidate && !github)
+            args.push('--registry', candidate);
         for (let attempt = 1; attempt <= attempts; attempt += 1) {
-            onAttempt({ registry: source, attempt });
-            const args = ['install', '-g', spec, '--prefer-online'];
-            if (source)
-                args.push('--registry', source);
+            onAttempt({ source: candidate, attempt });
             let result = await runNpm(spawnImpl, args, timeoutMs);
             if (!result.ok && platform === 'win32' && heldByAnotherProcess(result.output))
                 result = await inPlace(args, (stagedArgs) => runNpm(spawnImpl, stagedArgs, timeoutMs));
@@ -343,7 +386,7 @@ registry = '', sources = [], version = null, attempts = 3, retryDelayMs = 15_000
             }
             notYetPublished = isNotYetPublished(result.output);
             if (!notYetPublished)
-                break; // Not a wait: this registry will not do better.
+                break; // Not a wait: this source will not do better.
             if (attempt < attempts)
                 await sleep(retryDelayMs);
         }
@@ -355,4 +398,4 @@ registry = '', sources = [], version = null, attempts = 3, retryDelayMs = 15_000
         summary: npmErrorSummary(last.output),
     };
 }
-export { DEFAULT_REGISTRY, MIRROR_REGISTRY, canSelfUpdate, checkForUpdate, compareVersions, currentVersion, installKind, installedVersionOnDisk, performUpdate, registryCandidates, updateChecksEnabled, };
+export { DEFAULT_REGISTRY, MIRROR_REGISTRY, canSelfUpdate, checkForUpdate, compareVersions, currentVersion, installKind, installedVersionOnDisk, installedRelayVersion, performUpdate, registryCandidates, updateChecksEnabled, };

package/herdr-plugin.toml

@@ -1,7 +1,7 @@
 id = "herdr.remote.web"
 name = "Herdr Remote Web"
-version = "0.2.32"
-min_herdr_version = "0.9.1"
+version = "0.2.34"
+min_herdr_version = "0.9.3"
 description = "Browser access to Herdr workspaces via local or self-hosted relay"
 platforms = ["linux", "macos", "windows"]
 

package/node_modules/herdr-remote-relay/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 dibin666
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/node_modules/herdr-remote-relay/README.md

@@ -0,0 +1,76 @@
+# herdr-remote-relay
+
+*[English](README.md) · [简体中文](README.zh-CN.md)*
+
+Standalone relay server and WebUI for [Herdr Remote](https://www.npmjs.com/package/herdr-remote).
+
+Brokers WebSocket connections between browsers and workstation host connectors. Runtime dependency is `ws` only; requires no compilers or Herdr binaries.
+
+> **Note**: `herdr-remote` runs a local relay automatically. Install this package only when deploying a dedicated relay server.
+
+## Installation
+
+```bash
+npm install -g https://github.com/dibin666/herdr-remote/releases/latest/download/herdr-remote-relay.tgz
+herdr-remote-relay --public-url https://herdr.example.com --password <password>
+```
+
+From npm instead: `npm install -g herdr-remote-relay` (it can lag a new release by a while).
+
+Requirements: Node.js 22+, TLS reverse proxy (nginx, Caddy, Cloudflare Tunnel).
+
+## Docker
+
+```bash
+docker run -d --name herdr-relay --restart unless-stopped \
+  -p 127.0.0.1:8787:8787 \
+  -v herdr-relay:/data \
+  -e RELAY_BIND=0.0.0.0 \
+  -e RELAY_PUBLIC_URL=https://herdr.example.com \
+  -e RELAY_PASSWORD=your-password \
+  -e RELAY_ADMIN_TOKEN=your-admin-token \
+  -e RELAY_TRUST_PROXY=1 \
+  -e RELAY_AUTH_STATE_FILE=/data/relay-auth.json \
+  node:22-alpine npx -y herdr-remote-relay
+```
+
+## Options
+
+| Option | Env Var | Default | Description |
+|---|---|---|---|
+| `--public-url` | `RELAY_PUBLIC_URL` | `http://127.0.0.1:8787` | Public URL for browsers |
+| `--password` | `RELAY_PASSWORD` | *(empty)* | Workstation join password (empty = public) |
+| `--admin-token` | `RELAY_ADMIN_TOKEN` | *(empty)* | Operator token for `/admin` |
+| `--bind` | `RELAY_BIND` | `127.0.0.1` | Listen address |
+| `--port` | `RELAY_PORT` | `8787` | Listen port |
+| `--trust-proxy` | `RELAY_TRUST_PROXY` | `0` | Trust `X-Forwarded-For` header (`1` behind proxy) |
+| `--state-file` | `RELAY_AUTH_STATE_FILE` | `~/.local/state/herdr-remote-relay/relay-auth.json` | Auth state file path |
+| `--allowed-origins` | `RELAY_ALLOWED_ORIGINS` | *(same-origin)* | Allowed CORS origins, comma-separated |
+| `--max-clients` | `RELAY_MAX_CLIENTS_PER_HOST` | `16` | Maximum browser clients per host |
+| `--max-hosts` | `RELAY_MAX_HOSTS` | `1024` | Maximum workstations on this relay |
+| `--max-pending-handshakes` | `RELAY_MAX_PENDING_HANDSHAKES` | `1024` | Maximum unauthenticated WebSockets |
+| `--max-buffered-bytes` | `RELAY_MAX_BUFFERED_BYTES_PER_CLIENT` | `4194304` | Maximum queued bytes per browser |
+| `--host-reconnect-grace-ms` | `RELAY_HOST_RECONNECT_GRACE_MS` | `30000` | Host reconnect grace period |
+| `--config` | `HERDR_RELAY_CONFIG` | *(none)* | JSON configuration file path |
+
+Reverse proxies must pass WebSocket `Upgrade` headers and maintain reasonable idle timeouts. The relay disables WebSocket compression and enables TCP NoDelay for terminal frames. When no browser is attached, business heartbeats stop while low-frequency transport keepalive (minimal idle heartbeat and WebSocket ping/pong watchdog) remains active to prevent proxies from dropping idle connections. Deployment examples for nginx, systemd, and Docker Compose are in `deploy/`.
+
+## Multiple workstations and isolation
+
+A browser can save multiple workstation pairings. The switcher in the lower-left WebUI only shows profiles saved by that browser; it never enumerates other relay hosts. `/api/status` is scoped to the workstation bound to the presented credentials, while only `RELAY_ADMIN_TOKEN` can inspect relay-wide state. `/healthz` does not disclose host or client counts.
+
+## Connecting a Workstation
+
+In `herdr-remote` TUI under **Relay** tab:
+- Set mode to **Self-hosted relay**
+- Set Relay URL to `wss://herdr.example.com`
+- Set Relay Password to matching `RELAY_PASSWORD`
+
+Check connection status:
+```bash
+curl https://herdr.example.com/healthz
+```
+
+## License
+
+MIT

package/node_modules/herdr-remote-relay/README.zh-CN.md

@@ -0,0 +1,76 @@
+# herdr-remote-relay
+
+*[English](README.md) · [简体中文](README.zh-CN.md)*
+
+[Herdr Remote](https://www.npmjs.com/package/herdr-remote) 的独立 Relay 服务端与 WebUI。
+
+负责在浏览器与工作站主机连接器之间转发 WebSocket 连接。运行时仅依赖 `ws`，无需编译环境或 Herdr 二进制文件。
+
+> **提示**：`herdr-remote` 默认在本地自动运行 relay。仅在需要部署独立中继服务器时安装本包。
+
+## 安装
+
+```bash
+npm install -g https://github.com/dibin666/herdr-remote/releases/latest/download/herdr-remote-relay.tgz
+herdr-remote-relay --public-url https://herdr.example.com --password <密码>
+```
+
+也可从 npm 安装：`npm install -g herdr-remote-relay`（新版本上线后 npm 可能要过一段时间才同步）。
+
+前置要求：Node.js 22+、TLS 反向代理（nginx、Caddy、Cloudflare Tunnel 等）。
+
+## Docker 运行
+
+```bash
+docker run -d --name herdr-relay --restart unless-stopped \
+  -p 127.0.0.1:8787:8787 \
+  -v herdr-relay:/data \
+  -e RELAY_BIND=0.0.0.0 \
+  -e RELAY_PUBLIC_URL=https://herdr.example.com \
+  -e RELAY_PASSWORD=你的密码 \
+  -e RELAY_ADMIN_TOKEN=你的管理令牌 \
+  -e RELAY_TRUST_PROXY=1 \
+  -e RELAY_AUTH_STATE_FILE=/data/relay-auth.json \
+  node:22-alpine npx -y herdr-remote-relay
+```
+
+## 配置参数
+
+| 参数 | 环境变量 | 默认值 | 说明 |
+|---|---|---|---|
+| `--public-url` | `RELAY_PUBLIC_URL` | `http://127.0.0.1:8787` | 浏览器访问的公开地址 |
+| `--password` | `RELAY_PASSWORD` | *(空)* | 工作站接入密码（留空为公用 Relay） |
+| `--admin-token` | `RELAY_ADMIN_TOKEN` | *(空)* | `/admin` 管理后台操作员令牌 |
+| `--bind` | `RELAY_BIND` | `127.0.0.1` | 监听地址 |
+| `--port` | `RELAY_PORT` | `8787` | 监听端口 |
+| `--trust-proxy` | `RELAY_TRUST_PROXY` | `0` | 信任 `X-Forwarded-For` 头（反代后设为 `1`） |
+| `--state-file` | `RELAY_AUTH_STATE_FILE` | `~/.local/state/herdr-remote-relay/relay-auth.json` | 认证状态文件路径 |
+| `--allowed-origins` | `RELAY_ALLOWED_ORIGINS` | *(同源)* | 允许的跨域源，逗号分隔 |
+| `--max-clients` | `RELAY_MAX_CLIENTS_PER_HOST` | `16` | 每台工作站最大客户端连接数 |
+| `--max-hosts` | `RELAY_MAX_HOSTS` | `1024` | relay 最大工作站数 |
+| `--max-pending-handshakes` | `RELAY_MAX_PENDING_HANDSHAKES` | `1024` | 最大未认证 WebSocket 握手数 |
+| `--max-buffered-bytes` | `RELAY_MAX_BUFFERED_BYTES_PER_CLIENT` | `4194304` | 单个慢浏览器最大待发送缓冲 |
+| `--host-reconnect-grace-ms` | `RELAY_HOST_RECONNECT_GRACE_MS` | `30000` | 工作站断线恢复宽限时间 |
+| `--config` | `HERDR_RELAY_CONFIG` | *(无)* | JSON 配置文件路径 |
+
+反向代理必须转发 WebSocket `Upgrade` 头，并设置合理的空闲超时时间。relay 会关闭 WebSocket 压缩并启用 TCP NoDelay；没有浏览器连接时，工作站会停止业务 heartbeat，同时保留低频 transport keepalive（最小空闲 heartbeat 与 WebSocket ping/pong 探针）以防止反代断开空闲连接并维持 relay 存活。`deploy/` 目录下提供 nginx、systemd 与 Docker Compose 示例。
+
+## 多工作站与隔离
+
+同一个浏览器可以保存多个工作站配对，WebUI 左下角的实例切换器只显示本地已保存的实例，不会枚举 relay 上的其他工作站。`/api/status` 按设备令牌绑定的工作站隔离，只有 `RELAY_ADMIN_TOKEN` 才能查看 relay 全局状态；`/healthz` 不公开工作站和客户端数量。
+
+## 工作站连接
+
+在工作站的 `herdr-remote` TUI 中进入 **Relay** 页面：
+- 访问方式选择 **自建 relay**
+- Relay 地址填写 `wss://herdr.example.com`
+- Relay 密码填写对应的 `RELAY_PASSWORD`
+
+验证连接状态：
+```bash
+curl https://herdr.example.com/healthz
+```
+
+## 开源协议
+
+MIT