nodebb-plugin-safe-updater 1.1.0 → 2.0.1

package/README.md

@@ -2,49 +2,49 @@
 
 A conservative utility that keeps a NodeBB forum up to date safely.
 
-This repository now includes both:
-- a CLI update tool
-- a NodeBB plugin-style integration that exposes a one-click update action from the admin area
+This repository includes a CLI update tool and a NodeBB admin plugin with a one-click update action.
 
 ## Features
-- Validates that the target directory is a Git repository
-- Refuses to run on a dirty working tree unless explicitly allowed
-- Creates a backup before updating
-- Fetches and fast-forwards the selected branch
-- Runs `npm install`, `yarn install`, or `pnpm install` when a project uses dependencies
-- Exposes an admin route and an API endpoint suitable for a NodeBB plugin integration
 
-## Install as a NodeBB plugin
-
-1. Copy the repository contents into your NodeBB plugin directory, for example:
+- Verifies the target directory using Git itself (including linked worktrees).
+- Refuses to run on a dirty working tree unless explicitly allowed.
+- Creates a backup outside the target repository before updating.
+- Fetches the selected branch and only fast-forwards it; existing local commits are not reset.
+- Runs `npm install`, `yarn install`, or `pnpm install` when the project has a `package.json`.
+- Restricts the NodeBB update endpoint to administrators and prevents overlapping updates.
 
-```bash
-plugins/nodebb-safe-updater/
-```
+## Install as a NodeBB plugin
 
-2. Make sure the NodeBB server has environment variables configured, for example:
+1. Copy the repository into your NodeBB plugin directory, for example `plugins/nodebb-safe-updater/`.
+2. Configure the environment variables for the NodeBB server as needed:
 
-```bash
-export NODEBB_DIRECTORY=/srv/nodebb
-export NODEBB_BRANCH=main
-export NODEBB_REMOTE=origin
-export NODEBB_ALLOW_DIRTY=false
-export NODEBB_SKIP_INSTALL=false
-```
+   ```bash
+   export NODEBB_DIRECTORY=/srv/nodebb
+   export NODEBB_BRANCH=main
+   export NODEBB_REMOTE=origin
+   export NODEBB_ALLOW_DIRTY=false
+   export NODEBB_SKIP_INSTALL=false
+   # Optional; must be outside NODEBB_DIRECTORY
+   export NODEBB_BACKUP_ROOT=/var/backups/nodebb-safe-updater
+   ```
 
-3. Restart NodeBB.
+3. Restart NodeBB, then open **Admin → Plugins → NodeBB Safe Updater**.
 
-4. Open the admin area and use the new "NodeBB Safe Updater" item.
+The admin page is `/admin/plugins/nodebb-safe-updater`; its update endpoint is `/api/v3/plugins/nodebb-safe-updater/update`. Both are protected by NodeBB's admin middleware.
 
-5. Trigger the update from the browser by clicking the button in the plugin page.
+## Standalone web updater
 
-## Browser update flow
+Run `npm start` to start the optional standalone updater. It binds to `127.0.0.1` by default, serves the UI at `/`, and accepts updates at `/api/update`. The UI uses a per-process token and cross-origin requests are rejected. Do not expose this service publicly; use a trusted reverse proxy and appropriate access controls if remote access is required.
 
-The plugin registers:
-- `/admin/plugins/nodebb-safe-updater` as the admin page
-- `/api/v3/plugins/nodebb-safe-updater/update` as the POST endpoint used by the button
+Configuration:
 
-The page executes a safe update using the configured repo directory and then prints the JSON result.
+```bash
+export NODEBB_DIRECTORY=/srv/nodebb
+export NODEBB_UPDATER_PORT=3000
+export NODEBB_UPDATER_HOST=127.0.0.1
+# Optional; an ephemeral token is generated when omitted
+export NODEBB_UPDATER_TOKEN='use-a-long-random-secret'
+```
 
 ## CLI usage
 
@@ -60,37 +60,28 @@ Update a specific installation:
 node src/index.js --directory /srv/nodebb --branch main --remote origin
 ```
 
-Allow dirty working trees:
+Allow a dirty working tree or skip dependency installation:
 
 ```bash
 node src/index.js --directory /srv/nodebb --allow-dirty
-```
-
-Skip post-update install:
-
-```bash
 node src/index.js --directory /srv/nodebb --skip-install
 ```
 
-## Safety checks
+## Safety notes
 
-This updater intentionally prefers a cautious workflow:
-- it aborts if the repo is dirty,
-- it creates a backup before the change,
-- it uses a fast-forward pull strategy,
-- and it keeps the update process explicit and inspectable.
+The updater aborts on a dirty repository by default, creates a backup before updating, and uses `git pull --ff-only`. `--allow-dirty` permits the update to proceed with local changes; review the backup and working tree carefully before using it. Backup folders must be outside the target repository.
 
-## Example response
+## Example result
 
 ```json
 {
   "ok": true,
-  "result": {
-    "directory": "/srv/nodebb",
-    "branch": "main",
-    "remote": "origin",
-    "backupDir": "/tmp/nodebb-safe-updater/nodebb-backup-2026-10-24T12-00-00.000Z",
-    "statusAfter": ""
-  }
+  "directory": "/srv/nodebb",
+  "branch": "main",
+  "remote": "origin",
+  "backupDir": "/tmp/nodebb-safe-updater/nodebb-backup-2026-10-24T12-00-00-000Z",
+  "statusBefore": "",
+  "statusAfter": "",
+  "packageManager": "npm"
 }
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nodebb-plugin-safe-updater",
-  "version": "1.1.0",
+  "version": "2.0.1",
   "description": "Safe NodeBB updater plugin with a one-click update endpoint and CLI fallback.",
   "license": "MIT",
   "homepage": "https://github.com/amer-raba/nodebb-plugin-safe-updater",

package/src/index.js

@@ -2,21 +2,26 @@
 
 const { safeUpdate, parseArgs } = require('./safeUpdater');
 
-function main() {
+function main(argv = process.argv.slice(2)) {
   try {
-    const options = parseArgs(process.argv.slice(2));
+    const options = parseArgs(argv);
 
     if (options.help) {
-      console.log('Usage: nodebb-safe-updater [--directory /path/to/nodebb] [--branch main] [--remote origin] [--allow-dirty] [--skip-install]');
-      process.exit(0);
+      console.log('Usage: nodebb-safe-updater [--directory /path/to/nodebb] [--branch main] [--remote origin] [--allow-dirty] [--skip-install] [--backup-root /path/to/backups]');
+      return 0;
     }
 
     const result = safeUpdate(options);
     console.log(JSON.stringify(result, null, 2));
+    return 0;
   } catch (error) {
     console.error(error.message || error);
-    process.exit(1);
+    return 1;
   }
 }
 
-main();
+if (require.main === module) {
+  process.exitCode = main();
+}
+
+module.exports = { main };

package/src/nodebbPlugin.js

@@ -2,37 +2,45 @@
 
 const { safeUpdate } = require('./safeUpdater');
 
+let updateInProgress = false;
+
 const plugin = {
   async init(params) {
     const { router, middleware } = params;
-
     const adminRoute = '/admin/plugins/nodebb-safe-updater';
     const apiRoute = '/api/v3/plugins/nodebb-safe-updater/update';
 
     router.get(adminRoute, middleware.admin.build, async (req, res) => {
-      const context = {
+      res.render('admin/plugins/nodebb-safe-updater', {
         title: 'NodeBB Safe Updater',
         directory: process.env.NODEBB_DIRECTORY || process.cwd(),
         branch: process.env.NODEBB_BRANCH || 'main',
         remote: process.env.NODEBB_REMOTE || 'origin'
-      };
-
-      res.render('admin/plugins/nodebb-safe-updater', context);
+      });
     });
 
-    router.post(apiRoute, middleware.ensureLoggedIn, async (req, res) => {
+    // Updating changes the server's code and runs its package manager, so this
+    // endpoint must be restricted to administrators, not merely logged-in users.
+    router.post(apiRoute, middleware.admin.build, async (req, res) => {
+      if (updateInProgress) {
+        return res.status(409).json({ ok: false, error: 'An update is already in progress.' });
+      }
+
+      updateInProgress = true;
       try {
         const result = safeUpdate({
           directory: process.env.NODEBB_DIRECTORY || process.cwd(),
           branch: process.env.NODEBB_BRANCH || 'main',
           remote: process.env.NODEBB_REMOTE || 'origin',
-          allowDirty: Boolean(process.env.NODEBB_ALLOW_DIRTY === 'true'),
-          skipInstall: Boolean(process.env.NODEBB_SKIP_INSTALL === 'true')
+          allowDirty: process.env.NODEBB_ALLOW_DIRTY === 'true',
+          skipInstall: process.env.NODEBB_SKIP_INSTALL === 'true',
+          backupRoot: process.env.NODEBB_BACKUP_ROOT
         });
-
-        res.json({ ok: true, result });
+        return res.json({ ok: true, result });
       } catch (error) {
-        res.status(500).json({ ok: false, error: error.message || String(error) });
+        return res.status(500).json({ ok: false, error: error.message || String(error) });
+      } finally {
+        updateInProgress = false;
       }
     });
   },
@@ -43,7 +51,6 @@ const plugin = {
       icon: 'fa-rocket',
       name: 'NodeBB Safe Updater'
     });
-
     callback(null, header);
   }
 };

package/src/safeUpdater.js

@@ -7,6 +7,7 @@ function runCommand(command, args, options = {}) {
   const result = spawnSync(command, args, {
     cwd: options.cwd || process.cwd(),
     encoding: 'utf8',
+    maxBuffer: 10 * 1024 * 1024,
     stdio: ['inherit', 'pipe', 'pipe']
   });
 
@@ -16,31 +17,41 @@ function runCommand(command, args, options = {}) {
 
   if (result.status !== 0) {
     const output = [result.stdout, result.stderr].filter(Boolean).join('\n').trim();
-    throw new Error(`${command} ${args.join(' ')} failed with exit code ${result.status}. ${output}`);
+    const reason = result.signal ? `signal ${result.signal}` : `exit code ${result.status}`;
+    throw new Error(`${command} ${args.join(' ')} failed with ${reason}. ${output}`);
   }
 
   return (result.stdout || '').trim();
 }
 
 function ensureGitRepository(directory) {
-  const gitDir = path.join(directory, '.git');
-  if (!fs.existsSync(directory)) {
+  if (!fs.existsSync(directory) || !fs.statSync(directory).isDirectory()) {
     throw new Error(`Directory does not exist: ${directory}`);
   }
 
-  if (!fs.existsSync(gitDir)) {
+  try {
+    runCommand('git', ['-C', directory, 'rev-parse', '--is-inside-work-tree']);
+  } catch {
     throw new Error(`Not a git repository: ${directory}`);
   }
 }
 
 function getGitStatus(directory) {
-  return runCommand('git', ['-C', directory, 'status', '--porcelain']);
+  return runCommand('git', ['-C', directory, 'status', '--porcelain', '--untracked-files=all']);
+}
+
+function isPathInside(parent, candidate) {
+  const relative = path.relative(path.resolve(parent), path.resolve(candidate));
+  return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative));
 }
 
 function createBackup(directory, backupRoot) {
+  if (isPathInside(directory, backupRoot)) {
+    throw new Error('Backup directory must be outside the target repository.');
+  }
+
   const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
   const backupDir = path.join(backupRoot, `nodebb-backup-${timestamp}`);
-
   fs.mkdirSync(backupDir, { recursive: true });
 
   const entries = fs.readdirSync(directory);
@@ -51,10 +62,7 @@ function createBackup(directory, backupRoot) {
 
     const sourcePath = path.join(directory, entry);
     const targetPath = path.join(backupDir, entry);
-
-    if (fs.existsSync(sourcePath)) {
-      fs.cpSync(sourcePath, targetPath, { recursive: true, force: true });
-    }
+    fs.cpSync(sourcePath, targetPath, { recursive: true, force: true, errorOnExist: false });
   }
 
   return backupDir;
@@ -81,30 +89,39 @@ function parseArgs(argv = []) {
     skipInstall: false,
     backupRoot: path.join(os.tmpdir(), 'nodebb-safe-updater')
   };
+  let positionalDirectorySet = false;
+
+  function readValue(arg, index) {
+    const value = argv[index + 1];
+    if (!value || value.startsWith('-')) {
+      throw new Error(`Missing value for ${arg}`);
+    }
+    return value;
+  }
 
   for (let index = 0; index < argv.length; index += 1) {
     const arg = argv[index];
 
     if (arg === '--directory' || arg === '-d') {
-      options.directory = argv[index + 1];
+      options.directory = readValue(arg, index);
       index += 1;
       continue;
     }
 
     if (arg === '--branch' || arg === '-b') {
-      options.branch = argv[index + 1];
+      options.branch = readValue(arg, index);
       index += 1;
       continue;
     }
 
     if (arg === '--remote' || arg === '-r') {
-      options.remote = argv[index + 1];
+      options.remote = readValue(arg, index);
       index += 1;
       continue;
     }
 
     if (arg === '--backup-root') {
-      options.backupRoot = argv[index + 1];
+      options.backupRoot = readValue(arg, index);
       index += 1;
       continue;
     }
@@ -128,56 +145,79 @@ function parseArgs(argv = []) {
       throw new Error(`Unknown option: ${arg}`);
     }
 
-    if (!options.directory || options.directory === process.cwd()) {
-      options.directory = arg;
+    if (positionalDirectorySet) {
+      throw new Error(`Unexpected argument: ${arg}`);
     }
+    options.directory = arg;
+    positionalDirectorySet = true;
   }
 
-  if (options.directory && options.directory !== process.cwd() && !path.isAbsolute(options.directory)) {
+  if (!path.isAbsolute(options.directory)) {
     options.directory = path.resolve(options.directory);
   }
+  if (!path.isAbsolute(options.backupRoot)) {
+    options.backupRoot = path.resolve(options.backupRoot);
+  }
 
   return options;
 }
 
 function safeUpdate(options = {}) {
   const finalOptions = {
-    directory: options.directory || process.cwd(),
+    directory: path.resolve(options.directory || process.cwd()),
     branch: options.branch || 'main',
     remote: options.remote || 'origin',
     allowDirty: Boolean(options.allowDirty),
     skipInstall: Boolean(options.skipInstall),
-    backupRoot: options.backupRoot || path.join(os.tmpdir(), 'nodebb-safe-updater')
+    backupRoot: path.resolve(options.backupRoot || path.join(os.tmpdir(), 'nodebb-safe-updater'))
   };
 
   ensureGitRepository(finalOptions.directory);
+  runCommand('git', ['check-ref-format', '--branch', finalOptions.branch]);
 
   const statusBefore = getGitStatus(finalOptions.directory);
   if (statusBefore && !finalOptions.allowDirty) {
     throw new Error(`Working tree is not clean. Commit or stash your changes before updating, or use --allow-dirty.\n${statusBefore}`);
   }
 
+  if (isPathInside(finalOptions.directory, finalOptions.backupRoot)) {
+    throw new Error('Backup directory must be outside the target repository.');
+  }
+
   fs.mkdirSync(finalOptions.backupRoot, { recursive: true });
   const backupDir = createBackup(finalOptions.directory, finalOptions.backupRoot);
 
   runCommand('git', ['-C', finalOptions.directory, 'fetch', finalOptions.remote, finalOptions.branch]);
-  runCommand('git', ['-C', finalOptions.directory, 'checkout', finalOptions.branch]);
+  const localBranches = runCommand('git', [
+    '-C', finalOptions.directory,
+    'branch', '--list', '--format=%(refname:short)'
+  ]).split('\n').filter(Boolean);
+
+  if (localBranches.includes(finalOptions.branch)) {
+    runCommand('git', ['-C', finalOptions.directory, 'checkout', finalOptions.branch]);
+  } else {
+    runCommand('git', [
+      '-C', finalOptions.directory,
+      'checkout', '--track', '-b', finalOptions.branch,
+      `${finalOptions.remote}/${finalOptions.branch}`
+    ]);
+  }
+
   runCommand('git', ['-C', finalOptions.directory, 'pull', '--ff-only', finalOptions.remote, finalOptions.branch]);
 
+  let packageManager = null;
   if (!finalOptions.skipInstall && fs.existsSync(path.join(finalOptions.directory, 'package.json'))) {
-    const packageManager = detectPackageManager(finalOptions.directory);
-    const installCommand =
-      packageManager === 'pnpm'
-        ? ['pnpm', 'install']
-        : packageManager === 'yarn'
-          ? ['yarn', 'install']
-          : ['npm', 'install'];
-
+    packageManager = detectPackageManager(finalOptions.directory);
+    const installCommand = packageManager === 'pnpm'
+      ? ['pnpm', 'install']
+      : packageManager === 'yarn'
+        ? ['yarn', 'install']
+        : ['npm', 'install'];
     runCommand(installCommand[0], installCommand.slice(1), { cwd: finalOptions.directory });
+  } else if (fs.existsSync(path.join(finalOptions.directory, 'package.json'))) {
+    packageManager = detectPackageManager(finalOptions.directory);
   }
 
-  const statusAfter = getGitStatus(finalOptions.directory);
-
   return {
     ok: true,
     directory: finalOptions.directory,
@@ -185,8 +225,8 @@ function safeUpdate(options = {}) {
     remote: finalOptions.remote,
     backupDir,
     statusBefore,
-    statusAfter,
-    packageManager: fs.existsSync(path.join(finalOptions.directory, 'package.json')) ? detectPackageManager(finalOptions.directory) : null
+    statusAfter: getGitStatus(finalOptions.directory),
+    packageManager
   };
 }
 

package/src/webUpdater.js

@@ -1,6 +1,6 @@
-const { safeUpdate, parseArgs } = require('./safeUpdater');
+const { safeUpdate } = require('./safeUpdater');
 const http = require('node:http');
-const fs = require('node:fs');
+const crypto = require('node:crypto');
 const path = require('node:path');
 
 const HTML_PAGE = `<!doctype html>
@@ -10,87 +10,33 @@ const HTML_PAGE = `<!doctype html>
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>NodeBB Safe Updater</title>
     <style>
-      body {
-        font-family: system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
-        background: #0f172a;
-        color: #e2e8f0;
-        display: grid;
-        place-items: center;
-        min-height: 100vh;
-        margin: 0;
-      }
-
-      .panel {
-        width: min(520px, 90vw);
-        background: rgba(15, 23, 42, 0.8);
-        border: 1px solid rgba(148, 163, 184, 0.25);
-        border-radius: 14px;
-        padding: 28px;
-        box-shadow: 0 20px 45px rgba(15, 23, 42, 0.5);
-      }
-
-      h1 {
-        margin-top: 0;
-        font-size: 1.8rem;
-      }
-
-      button {
-        background: #22c55e;
-        color: #052e16;
-        border: none;
-        border-radius: 10px;
-        padding: 14px 22px;
-        font-size: 1rem;
-        font-weight: 700;
-        cursor: pointer;
-        transition: transform 0.15s ease;
-      }
-
-      button:hover {
-        transform: translateY(-1px);
-      }
-
-      button:disabled {
-        opacity: 0.6;
-        cursor: wait;
-      }
-
-      #result {
-        margin-top: 20px;
-        min-height: 80px;
-        background: rgba(15, 118, 110, 0.1);
-        border: 1px solid rgba(45, 212, 191, 0.2);
-        border-radius: 10px;
-        padding: 12px 14px;
-        white-space: pre-wrap;
-        word-break: break-word;
-      }
+      body { font-family: system-ui, sans-serif; background: #0f172a; color: #e2e8f0; display: grid; place-items: center; min-height: 100vh; margin: 0; }
+      .panel { width: min(520px, 90vw); background: rgba(15, 23, 42, .8); border: 1px solid rgba(148, 163, 184, .25); border-radius: 14px; padding: 28px; }
+      button { background: #22c55e; color: #052e16; border: 0; border-radius: 10px; padding: 14px 22px; font-size: 1rem; font-weight: 700; cursor: pointer; }
+      button:disabled { opacity: .6; cursor: wait; }
+      #result { margin-top: 20px; min-height: 80px; white-space: pre-wrap; word-break: break-word; }
     </style>
   </head>
   <body>
     <div class="panel">
       <h1>NodeBB Safe Updater</h1>
-      <p>Click the button below to update the forum to the latest version safely.</p>
+      <p>Click below to update the configured NodeBB installation.</p>
       <button id="updateButton">Update to latest version</button>
       <div id="result">Waiting for action...</div>
     </div>
-
     <script>
       const button = document.getElementById('updateButton');
       const result = document.getElementById('result');
-
       button.addEventListener('click', async () => {
         button.disabled = true;
         result.textContent = 'Updating...';
-
         try {
-          const response = await fetch('/api/update', { method: 'POST' });
+          const response = await fetch('/api/update', {
+            method: 'POST',
+            headers: { 'x-updater-token': '__UPDATER_TOKEN__' }
+          });
           const data = await response.json();
-
-          if (!response.ok) {
-            throw new Error(data.error || 'Update failed');
-          }
-
+          if (!response.ok) throw new Error(data.error || 'Update failed');
           result.textContent = JSON.stringify(data, null, 2);
         } catch (error) {
           result.textContent = 'ERROR: ' + (error.message || String(error));
@@ -103,26 +49,83 @@ const HTML_PAGE = `<!doctype html>
 </html>`;
 
 function parseOptionsFromEnv() {
+  const port = Number(process.env.NODEBB_UPDATER_PORT || 3000);
+  if (!Number.isInteger(port) || port < 1 || port > 65535) {
+    throw new Error('NODEBB_UPDATER_PORT must be an integer between 1 and 65535.');
+  }
+
   return {
     directory: process.env.NODEBB_DIRECTORY || process.cwd(),
     branch: process.env.NODEBB_BRANCH || 'main',
     remote: process.env.NODEBB_REMOTE || 'origin',
     allowDirty: (process.env.NODEBB_ALLOW_DIRTY || '').toLowerCase() === 'true',
     skipInstall: (process.env.NODEBB_SKIP_INSTALL || '').toLowerCase() === 'true',
-    port: Number(process.env.NODEBB_UPDATER_PORT || 3000),
-    backupRoot: process.env.NODEBB_BACKUP_ROOT || path.join(process.cwd(), '.nodebb-safe-updater-backups')
+    port,
+    host: process.env.NODEBB_UPDATER_HOST || '127.0.0.1',
+    token: process.env.NODEBB_UPDATER_TOKEN || crypto.randomBytes(32).toString('hex'),
+    backupRoot: process.env.NODEBB_BACKUP_ROOT || path.join(require('node:os').tmpdir(), 'nodebb-safe-updater')
   };
 }
 
+function isLoopbackHost(hostHeader) {
+  if (!hostHeader) return false;
+  try {
+    const hostname = new URL(`http://${hostHeader}`).hostname.toLowerCase();
+    return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]' || hostname === '::1';
+  } catch {
+    return false;
+  }
+}
+
 function createServer(options) {
+  const token = options.token || crypto.randomBytes(32).toString('hex');
+  let updateInProgress = false;
+
   const server = http.createServer(async (req, res) => {
+    if (!isLoopbackHost(req.headers.host)) {
+      res.writeHead(403, { 'Content-Type': 'application/json; charset=utf-8' });
+      res.end(JSON.stringify({ ok: false, error: 'Requests must use a loopback host.' }));
+      return;
+    }
+
     if (req.method === 'GET' && req.url === '/') {
-      res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-      res.end(HTML_PAGE);
+      res.writeHead(200, {
+        'Content-Type': 'text/html; charset=utf-8',
+        'Cache-Control': 'no-store',
+        'X-Content-Type-Options': 'nosniff'
+      });
+      res.end(HTML_PAGE.replace('__UPDATER_TOKEN__', token));
       return;
     }
 
     if (req.method === 'POST' && req.url === '/api/update') {
+      const origin = req.headers.origin;
+      if (origin) {
+        try {
+          if (new URL(origin).host !== req.headers.host) throw new Error('Origin mismatch');
+        } catch {
+          res.writeHead(403, { 'Content-Type': 'application/json; charset=utf-8' });
+          res.end(JSON.stringify({ ok: false, error: 'Cross-origin requests are not allowed.' }));
+          return;
+        }
+      }
+
+      const suppliedToken = req.headers['x-updater-token'];
+      const expected = Buffer.from(token);
+      const supplied = Buffer.from(typeof suppliedToken === 'string' ? suppliedToken : '');
+      if (supplied.length !== expected.length || !crypto.timingSafeEqual(supplied, expected)) {
+        res.writeHead(403, { 'Content-Type': 'application/json; charset=utf-8' });
+        res.end(JSON.stringify({ ok: false, error: 'Invalid updater token.' }));
+        return;
+      }
+
+      if (updateInProgress) {
+        res.writeHead(409, { 'Content-Type': 'application/json; charset=utf-8' });
+        res.end(JSON.stringify({ ok: false, error: 'An update is already in progress.' }));
+        return;
+      }
+
+      updateInProgress = true;
       try {
         const result = safeUpdate(options);
         res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8' });
@@ -130,6 +133,8 @@ function createServer(options) {
       } catch (error) {
         res.writeHead(500, { 'Content-Type': 'application/json; charset=utf-8' });
         res.end(JSON.stringify({ ok: false, error: error.message || String(error) }, null, 2));
+      } finally {
+        updateInProgress = false;
       }
       return;
     }
@@ -144,13 +149,13 @@ function createServer(options) {
 function main() {
   const options = parseOptionsFromEnv();
   const server = createServer(options);
-
-  server.listen(options.port, () => {
+  server.listen(options.port, options.host, () => {
     console.log(JSON.stringify({
       status: 'ready',
+      host: options.host,
       port: options.port,
       directory: options.directory,
-      endpoint: `http://localhost:${options.port}/`
+      endpoint: `http://${options.host}:${options.port}/`
     }, null, 2));
   });
 }
@@ -159,4 +164,4 @@ if (require.main === module) {
   main();
 }
 
-module.exports = { parseOptionsFromEnv, createServer, main };
+module.exports = { parseOptionsFromEnv, createServer, main, isLoopbackHost };