zevairouter 1.0.93 → 1.0.94

package/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/cli/app/src/lib/terminal/ptyBridge.py

@@ -0,0 +1,163 @@
+#!/usr/bin/env python3
+"""
+Minimal PTY bridge for ZevaiRouter web terminal.
+
+stdin  -> PTY master (keystrokes)
+stdout <- PTY master (shell output), raw binary
+stderr  = control / errors (utf-8 text lines)
+
+Optional control on a side channel is not needed: resize arrives as
+OSC-like escape on stdin:  \\x1b]9999;<cols>;<rows>\\x07
+"""
+from __future__ import annotations
+
+import errno
+import fcntl
+import os
+import select
+import signal
+import struct
+import sys
+import termios
+
+
+def set_winsize(fd: int, rows: int, cols: int) -> None:
+    try:
+        packed = struct.pack("HHHH", max(5, rows), max(20, cols), 0, 0)
+        fcntl.ioctl(fd, termios.TIOCSWINSZ, packed)
+    except Exception:
+        pass
+
+
+def main() -> int:
+    cols = int(sys.argv[1]) if len(sys.argv) > 1 else 120
+    rows = int(sys.argv[2]) if len(sys.argv) > 2 else 40
+    shell = os.environ.get("SHELL") or ("/bin/bash" if os.path.exists("/bin/bash") else "/bin/sh")
+    cwd = os.path.expanduser("~")
+
+    pid, master = pty_fork = _fork_pty()
+    if pid == 0:
+        # child
+        try:
+            os.chdir(cwd)
+        except Exception:
+            pass
+        os.environ.setdefault("TERM", "xterm-256color")
+        os.environ.setdefault("COLORTERM", "truecolor")
+        os.environ.setdefault("FORCE_COLOR", "1")
+        try:
+            os.execv(shell, [shell, "-il"])
+        except Exception:
+            os.execv("/bin/sh", ["/bin/sh", "-i"])
+        return 1
+
+    set_winsize(master, rows, cols)
+
+    # Non-blocking master + stdin
+    for fd in (master, sys.stdin.fileno()):
+        fl = fcntl.fcntl(fd, fcntl.F_GETFL)
+        fcntl.fcntl(fd, fcntl.F_SETFL, fl | os.O_NONBLOCK)
+
+    # Binary stdout
+    stdout = sys.stdout.buffer
+    stdin = sys.stdin.buffer
+
+    resize_buf = b""
+
+    def handle_resize_escape(chunk: bytes) -> bytes:
+        """Strip and apply embedded resize escapes, return remaining bytes."""
+        nonlocal resize_buf
+        data = resize_buf + chunk
+        out = bytearray()
+        i = 0
+        while i < len(data):
+            # ESC ] 9999 ; cols ; rows BEL
+            if data[i] == 0x1B and data[i : i + 6] == b"\x1b]9999;":
+                end = data.find(b"\x07", i + 6)
+                if end < 0:
+                    resize_buf = data[i:]
+                    return bytes(out)
+                payload = data[i + 6 : end].decode("ascii", "ignore")
+                try:
+                    c_s, r_s = payload.split(";", 1)
+                    set_winsize(master, int(r_s), int(c_s))
+                except Exception:
+                    pass
+                i = end + 1
+                resize_buf = b""
+                continue
+            out.append(data[i])
+            i += 1
+        resize_buf = b""
+        return bytes(out)
+
+    alive = True
+
+    def on_chld(signum, frame):  # noqa: ARG001
+        nonlocal alive
+        alive = False
+
+    signal.signal(signal.SIGCHLD, on_chld)
+
+    try:
+        while alive:
+            try:
+                r, _, _ = select.select([master, sys.stdin.fileno()], [], [], 0.25)
+            except InterruptedError:
+                continue
+
+            if master in r:
+                try:
+                    data = os.read(master, 8192)
+                except OSError as e:
+                    if e.errno in (errno.EIO, errno.EAGAIN, errno.EWOULDBLOCK):
+                        data = b""
+                    else:
+                        break
+                if not data:
+                    # EIO often means child exited
+                    if not alive:
+                        break
+                else:
+                    stdout.write(data)
+                    stdout.flush()
+
+            if sys.stdin.fileno() in r:
+                try:
+                    data = stdin.read(8192)
+                except Exception:
+                    data = b""
+                if data is None:
+                    data = b""
+                if data == b"" and not alive:
+                    break
+                if data:
+                    cleaned = handle_resize_escape(data)
+                    if cleaned:
+                        try:
+                            os.write(master, cleaned)
+                        except OSError:
+                            break
+    finally:
+        try:
+            os.close(master)
+        except Exception:
+            pass
+        try:
+            os.waitpid(pid, 0)
+        except Exception:
+            pass
+    return 0
+
+
+def _fork_pty():
+    import pty
+
+    return pty.fork()
+
+
+if __name__ == "__main__":
+    try:
+        raise SystemExit(main())
+    except KeyboardInterrupt:
+        raise SystemExit(0)

package/cli/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.93",
+  "version": "1.0.94",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "./cli/cli.js"

package/cli/app/src/lib/updater/updater.js

@@ -9,7 +9,8 @@ const path = require("path");
 const fs = require("fs");
 const os = require("os");
 
-const packageName = process.env.UPDATER_PKG_NAME || "zevai";
+// Must be npm package name (zevairouter), NOT the CLI bin (zevai).
+const packageName = process.env.UPDATER_PKG_NAME || "zevairouter";
 const port = parseInt(process.env.UPDATER_PORT || "20129", 10);
 const tailLines = parseInt(process.env.UPDATER_TAIL_LINES || "8", 10);
 const maxRetries = parseInt(process.env.UPDATER_RETRIES || "3", 10);
@@ -128,19 +129,72 @@ function sleep(ms) {
   return new Promise((r) => setTimeout(r, ms));
 }
 
+function resolveSafeInstallHook() {
+  const candidates = [
+    path.join(path.dirname(process.execPath), "..", "lib", "node_modules", "zevairouter", "cli", "hooks", "safeGlobalInstall.js"),
+    path.join("/usr/lib/node_modules/zevairouter/cli/hooks/safeGlobalInstall.js"),
+    path.join("/usr/local/lib/node_modules/zevairouter/cli/hooks/safeGlobalInstall.js"),
+    path.join("/opt/homebrew/lib/node_modules/zevairouter/cli/hooks/safeGlobalInstall.js"),
+    ...String(process.env.NODE_PATH || "")
+      .split(path.delimiter)
+      .filter(Boolean)
+      .map((p) => path.join(p, "zevairouter", "cli", "hooks", "safeGlobalInstall.js")),
+  ];
+  try {
+    const { createRequire } = require("module");
+    const req = createRequire(path.join(process.cwd(), "package.json"));
+    candidates.unshift(req.resolve("zevairouter/cli/hooks/safeGlobalInstall.js"));
+  } catch { /* ignore */ }
+  // Updater itself may live next to a package tree under ~/.zevai
+  try {
+    const dataDir = getDataDir();
+    candidates.push(
+      path.join(dataDir, "runtime", "node_modules", "zevairouter", "cli", "hooks", "safeGlobalInstall.js"),
+    );
+  } catch { /* ignore */ }
+
+  for (const p of candidates) {
+    try {
+      if (p && fs.existsSync(p)) return p;
+    } catch { /* next */ }
+  }
+  return null;
+}
+
 function runInstall() {
   state.attempt += 1;
   setPhase("installing");
-  pushLog(`[updater] attempt ${state.attempt}/${maxRetries} — npm i -g ${packageName} --prefer-online`);
+  // Force-clean path (ENOTEMPTY-safe) like `zevai update` / install.sh.
+  // Plain `npm i -g` often leaves the old build running or fails half-way on VPS.
+  const pkgSpec = packageName.includes("@") ? packageName : `${packageName}@latest`;
+  pushLog(`[updater] attempt ${state.attempt}/${maxRetries} — safe install ${pkgSpec}`);
 
   const isWin = process.platform === "win32";
-  const cmd = isWin ? "npm.cmd" : "npm";
-  const args = ["i", "-g", packageName, "--prefer-online"];
+  const hook = resolveSafeInstallHook();
+
+  let cmd;
+  let args;
+  if (hook) {
+    cmd = process.execPath;
+    args = [hook, "--latest"];
+    pushLog(`[updater] using safeGlobalInstall: ${hook}`);
+  } else {
+    cmd = isWin ? "npm.cmd" : "npm";
+    // Explicit @latest — never install a phantom "zevai" package.
+    args = ["i", "-g", pkgSpec, "--prefer-online"];
+    pushLog(`[updater] safe hook missing — fallback npm ${args.join(" ")}`);
+  }
 
   const child = spawn(cmd, args, {
     stdio: ["ignore", "pipe", "pipe"],
     windowsHide: true,
-    shell: isWin,
+    shell: isWin && !hook,
+    env: {
+      ...process.env,
+      npm_config_fund: "false",
+      npm_config_audit: "false",
+      npm_config_update_notifier: "false",
+    },
   });
 
   child.stdout.on("data", (buf) => {
@@ -158,7 +212,7 @@ function runInstall() {
   });
 
   child.on("close", (code) => {
-    pushLog(`[updater] npm exited with code ${code}`);
+    pushLog(`[updater] install exited with code ${code}`);
     if (code === 0) {
       finalize(true, code, null);
       return;
@@ -195,8 +249,40 @@ async function waitForAppAndOpenBrowser() {
   pushLog(`[updater] app not responding within 30s, skip browser open`);
 }
 
+function trySystemdRestart() {
+  if (process.platform === "win32" || process.platform === "darwin") return false;
+  try {
+    const { execFileSync } = require("child_process");
+    // Prefer our unit name; fall back to common aliases.
+    const units = ["zevairouter.service", "zevai.service"];
+    for (const unit of units) {
+      try {
+        execFileSync("systemctl", ["cat", unit], { stdio: "ignore", timeout: 3000 });
+      } catch {
+        continue;
+      }
+      pushLog(`[updater] restarting systemd unit ${unit}`);
+      execFileSync("systemctl", ["daemon-reload"], { stdio: "ignore", timeout: 10000 });
+      execFileSync("systemctl", ["restart", unit], { stdio: "ignore", timeout: 30000 });
+      pushLog(`[updater] systemctl restart ${unit} OK`);
+      return true;
+    }
+  } catch (e) {
+    pushLog(`[updater] systemd restart skipped: ${e.message}`);
+  }
+  return false;
+}
+
 function relaunchApp() {
   if (process.env.UPDATER_RELAUNCH !== "1") return;
+
+  // VPS path: if systemd owns the service, restart that — don't spawn a second
+  // tray process that leaves the unit on the old binary forever.
+  if (trySystemdRestart()) {
+    waitForAppAndOpenBrowser();
+    return;
+  }
+
   const cmd = process.env.UPDATER_RELAUNCH_CMD;
   if (!cmd) return;
   let args = [];
@@ -208,11 +294,17 @@ function relaunchApp() {
       stdio: "ignore",
       windowsHide: true,
       shell: isWin,
-      env: { ...process.env, UPDATER_RELAUNCH: "", UPDATER_RELAUNCH_CMD: "", UPDATER_RELAUNCH_ARGS: "" },
+      env: {
+        ...process.env,
+        UPDATER_RELAUNCH: "",
+        UPDATER_RELAUNCH_CMD: "",
+        UPDATER_RELAUNCH_ARGS: "",
+        // Prevent cli.js from flipping headless server restarts into tray mode.
+        ZEVAI_SERVER_MODE: args.includes("--tray") ? "" : "1",
+      },
     });
     child.unref();
     pushLog(`[updater] relaunched: ${cmd} ${args.join(" ")} (pid=${child.pid})`);
-    // Wait for new app to come up, then auto-open browser so user sees the result
     waitForAppAndOpenBrowser();
   } catch (e) {
     pushLog(`[updater] relaunch failed: ${e.message}`);

package/cli/cli.js

@@ -123,12 +123,16 @@ Options:
   --force-restart     Kill existing instance and start a new one (default: attach if healthy)
   --doctor            Show install paths (Node/npm/global) + dual-install hints
   --fix-install      Repair/reinstall global package for THIS Node (ENOTEMPTY-safe)
+  update [--to X.Y.Z] Force update + restart (VPS: systemctl, desktop: relaunch)
   -h, --help          Show this help message
   -v, --version       Show version
 
-One-shot install (any device):
-  macOS/Linux:  curl -fsSL https://raw.githubusercontent.com/Verifiedlabs/zevairouter/main/install.sh | bash
-  Windows:      irm https://raw.githubusercontent.com/Verifiedlabs/zevairouter/main/install.ps1 | iex
+Update (simple — same Node as this zevai, restarts service):
+  zevai update
+  zevai update --to 1.0.93
+
+One-shot install / reinstall (any device):
+  curl -fsSL https://gist.githubusercontent.com/Verifiedlabs/7fe0ab16692acbacd1b471d2c1bbd09b/raw/install.sh | bash
 `);
     process.exit(0);
   } else if (args[i] === "--version" || args[i] === "-v") {
@@ -142,30 +146,63 @@ One-shot install (any device):
       process.exit(1);
     }
     process.exit(0);
-  } else if (args[i] === "--fix-install") {
+  } else if (args[i] === "--fix-install" || args[i] === "update" || args[i] === "--update") {
+    // `zevai update` — one command, same as 9router simplicity.
+    // Force-clean global install + restart systemd (VPS) or relaunch process.
     try {
       const { safeInstallGlobal } = require("./hooks/safeGlobalInstall");
-      const { spawn } = require("child_process");
+      const { spawn, execFileSync } = require("child_process");
       const fs = require("fs");
       const path = require("path");
       const verIdx = args.indexOf("--to");
       const version = verIdx >= 0 && args[verIdx + 1] ? args[verIdx + 1] : "latest";
       const wasTray = process.argv.includes("--tray") || process.env.TRAY_MODE === "1";
+      console.log(`\nUpdating zevairouter@${version}…`);
       const result = safeInstallGlobal({ version, forceClean: true });
       if (!result.ok) {
         console.error(result.error || "install failed");
         process.exit(1);
       }
-      console.log(`\nInstalled zevairouter@${result.version || version}`);
+      console.log(`\n✓ Installed zevairouter@${result.version || version}`);
+      console.log(`  binary: ${result.zevaiPath || "zevai"}`);
 
       // Relaunch new binary detached, then exit this process so the new build loads.
       if (process.env.ZEVAI_SKIP_RESTART === "1") {
         console.log(`Restart skipped (ZEVAI_SKIP_RESTART=1). Run: zevai`);
         process.exit(0);
       }
+
+      // VPS: prefer systemd so the unit picks up the new binary path.
+      if (process.platform === "linux") {
+        for (const unit of ["zevairouter.service", "zevai.service"]) {
+          try {
+            execFileSync("systemctl", ["cat", unit], { stdio: "ignore", timeout: 3000 });
+            console.log(`Restarting ${unit}…`);
+            try { execFileSync("systemctl", ["daemon-reload"], { stdio: "ignore", timeout: 10000 }); } catch { /* ignore */ }
+            execFileSync("systemctl", ["restart", unit], { stdio: "inherit", timeout: 30000 });
+            // Brief health check
+            try {
+              const { execSync } = require("child_process");
+              for (let i = 0; i < 15; i++) {
+                execSync("sleep 1");
+                try {
+                  const out = execSync("curl -sS -m 2 http://127.0.0.1:1997/api/version", { encoding: "utf8" });
+                  console.log(`✓ Live: ${out.trim()}`);
+                  process.exit(0);
+                } catch { /* wait */ }
+              }
+            } catch { /* ignore */ }
+            console.log(`✓ systemctl restart ${unit} done. Check: curl -s http://127.0.0.1:1997/api/version`);
+            process.exit(0);
+          } catch {
+            /* try next unit */
+          }
+        }
+      }
+
       const relaunchArgs = wasTray
         ? ["--tray", "--skip-update"]
-        : ["--port", process.env.PORT || "1997", "--no-browser", "--skip-update"];
+        : ["--port", process.env.PORT || "1997", "--no-browser", "--skip-update", "--log"];
       try {
         const logDir = path.join(process.env.HOME || process.env.USERPROFILE || ".", ".zevai", "logs");
         fs.mkdirSync(logDir, { recursive: true });
@@ -179,13 +216,21 @@ One-shot install (any device):
           ? spawn(process.execPath, [cliEntry, ...relaunchArgs], {
               detached: true,
               stdio: ["ignore", out, out],
-              env: { ...process.env, TRAY_MODE: wasTray ? "1" : process.env.TRAY_MODE },
+              env: {
+                ...process.env,
+                TRAY_MODE: wasTray ? "1" : "",
+                ZEVAI_SERVER_MODE: wasTray ? "" : "1",
+              },
             })
           : spawn(result.zevaiPath || "zevai", relaunchArgs, {
               detached: true,
               stdio: ["ignore", out, out],
               shell: process.platform === "win32",
-              env: { ...process.env, TRAY_MODE: wasTray ? "1" : process.env.TRAY_MODE },
+              env: {
+                ...process.env,
+                TRAY_MODE: wasTray ? "1" : "",
+                ZEVAI_SERVER_MODE: wasTray ? "" : "1",
+              },
             });
         child.unref();
         console.log(`Restarting ${wasTray ? "tray" : "server"}… (log ${logFile})`);
@@ -197,14 +242,24 @@ One-shot install (any device):
       // Exit soon so :1997 is free for the new process.
       setTimeout(() => process.exit(0), 500);
     } catch (e) {
-      console.error("fix-install failed:", e.message);
+      console.error("update failed:", e.message);
       process.exit(1);
     }
   }
 }
 
 // Auto-relaunch after update: detached process has no TTY → fallback to tray
-if (skipUpdate && !trayMode && !process.stdin.isTTY) {
+// ONLY for desktop/tray flows. VPS server mode must stay server.
+if (
+  skipUpdate
+  && !trayMode
+  && !process.stdin.isTTY
+  && process.env.ZEVAI_SERVER_MODE !== "1"
+  && !process.env.PORT
+  && process.env.TRAY_MODE !== "0"
+) {
+  // Heuristic: systemd / nohup restarts often set PORT or ZEVAI_SERVER_MODE.
+  // If neither is set and no TTY, assume desktop tray (legacy 9router behaviour).
   trayMode = true;
   process.env.TRAY_MODE = "1";
 }

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter-cli",
-  "version": "1.0.93",
+  "version": "1.0.94",
   "description": "ZevaiRouter CLI - Start and manage ZevaiRouter server",
   "bin": {
     "zevai": "./cli.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.93",
+  "version": "1.0.94",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "./cli/cli.js"

package/src/lib/appUpdater.js

@@ -169,10 +169,12 @@ export function spawnUpdaterAndExit(packageName = UPDATER_CONFIG.npmPackageName)
   const updaterPath = ensureRuntimeUpdater(resolveBundledUpdaterPath());
   const isTray = process.env.TRAY_MODE === "1";
   const relaunch = resolveRelaunchCommand();
-  // Relaunch matching original env: tray stays tray, foreground stays foreground
+  // Relaunch matching original env: tray stays tray; server stays server
+  // (must pass --port/--no-browser so VPS doesn't flip into tray via no-TTY).
+  const appPort = String(process.env.PORT || UPDATER_CONFIG.appPort || 1997);
   const relaunchArgs = isTray
     ? [...relaunch.args, "--tray", "--skip-update"]
-    : [...relaunch.args, "--skip-update"];
+    : [...relaunch.args, "--port", appPort, "--no-browser", "--skip-update", "--log"];
 
   spawn(process.execPath, [updaterPath], {
     detached: true,
@@ -180,7 +182,8 @@ export function spawnUpdaterAndExit(packageName = UPDATER_CONFIG.npmPackageName)
     windowsHide: true,
     env: {
       ...process.env,
-      UPDATER_PKG_NAME: packageName,
+      // Always npm package name — never the CLI bin name "zevai".
+      UPDATER_PKG_NAME: packageName || "zevairouter",
       UPDATER_PORT: String(UPDATER_CONFIG.statusPort),
       UPDATER_TAIL_LINES: String(UPDATER_CONFIG.statusLogTailLines),
       UPDATER_RETRIES: String(UPDATER_CONFIG.installRetries),
@@ -189,10 +192,11 @@ export function spawnUpdaterAndExit(packageName = UPDATER_CONFIG.npmPackageName)
       UPDATER_WAIT_MIN_MS: String(UPDATER_CONFIG.waitForExitMinMs),
       UPDATER_WAIT_MAX_MS: String(UPDATER_CONFIG.waitForExitMaxMs),
       UPDATER_WAIT_CHECK_MS: String(UPDATER_CONFIG.waitForExitCheckMs),
-      UPDATER_APP_PORT: String(UPDATER_CONFIG.appPort),
+      UPDATER_APP_PORT: appPort,
       UPDATER_RELAUNCH: "1",
       UPDATER_RELAUNCH_CMD: relaunch.cmd,
       UPDATER_RELAUNCH_ARGS: JSON.stringify(relaunchArgs),
+      ZEVAI_SERVER_MODE: isTray ? "" : "1",
     },
   }).unref();
 

package/src/lib/updater/updater.js

@@ -9,7 +9,8 @@ const path = require("path");
 const fs = require("fs");
 const os = require("os");
 
-const packageName = process.env.UPDATER_PKG_NAME || "zevai";
+// Must be npm package name (zevairouter), NOT the CLI bin (zevai).
+const packageName = process.env.UPDATER_PKG_NAME || "zevairouter";
 const port = parseInt(process.env.UPDATER_PORT || "20129", 10);
 const tailLines = parseInt(process.env.UPDATER_TAIL_LINES || "8", 10);
 const maxRetries = parseInt(process.env.UPDATER_RETRIES || "3", 10);
@@ -128,19 +129,72 @@ function sleep(ms) {
   return new Promise((r) => setTimeout(r, ms));
 }
 
+function resolveSafeInstallHook() {
+  const candidates = [
+    path.join(path.dirname(process.execPath), "..", "lib", "node_modules", "zevairouter", "cli", "hooks", "safeGlobalInstall.js"),
+    path.join("/usr/lib/node_modules/zevairouter/cli/hooks/safeGlobalInstall.js"),
+    path.join("/usr/local/lib/node_modules/zevairouter/cli/hooks/safeGlobalInstall.js"),
+    path.join("/opt/homebrew/lib/node_modules/zevairouter/cli/hooks/safeGlobalInstall.js"),
+    ...String(process.env.NODE_PATH || "")
+      .split(path.delimiter)
+      .filter(Boolean)
+      .map((p) => path.join(p, "zevairouter", "cli", "hooks", "safeGlobalInstall.js")),
+  ];
+  try {
+    const { createRequire } = require("module");
+    const req = createRequire(path.join(process.cwd(), "package.json"));
+    candidates.unshift(req.resolve("zevairouter/cli/hooks/safeGlobalInstall.js"));
+  } catch { /* ignore */ }
+  // Updater itself may live next to a package tree under ~/.zevai
+  try {
+    const dataDir = getDataDir();
+    candidates.push(
+      path.join(dataDir, "runtime", "node_modules", "zevairouter", "cli", "hooks", "safeGlobalInstall.js"),
+    );
+  } catch { /* ignore */ }
+
+  for (const p of candidates) {
+    try {
+      if (p && fs.existsSync(p)) return p;
+    } catch { /* next */ }
+  }
+  return null;
+}
+
 function runInstall() {
   state.attempt += 1;
   setPhase("installing");
-  pushLog(`[updater] attempt ${state.attempt}/${maxRetries} — npm i -g ${packageName} --prefer-online`);
+  // Force-clean path (ENOTEMPTY-safe) like `zevai update` / install.sh.
+  // Plain `npm i -g` often leaves the old build running or fails half-way on VPS.
+  const pkgSpec = packageName.includes("@") ? packageName : `${packageName}@latest`;
+  pushLog(`[updater] attempt ${state.attempt}/${maxRetries} — safe install ${pkgSpec}`);
 
   const isWin = process.platform === "win32";
-  const cmd = isWin ? "npm.cmd" : "npm";
-  const args = ["i", "-g", packageName, "--prefer-online"];
+  const hook = resolveSafeInstallHook();
+
+  let cmd;
+  let args;
+  if (hook) {
+    cmd = process.execPath;
+    args = [hook, "--latest"];
+    pushLog(`[updater] using safeGlobalInstall: ${hook}`);
+  } else {
+    cmd = isWin ? "npm.cmd" : "npm";
+    // Explicit @latest — never install a phantom "zevai" package.
+    args = ["i", "-g", pkgSpec, "--prefer-online"];
+    pushLog(`[updater] safe hook missing — fallback npm ${args.join(" ")}`);
+  }
 
   const child = spawn(cmd, args, {
     stdio: ["ignore", "pipe", "pipe"],
     windowsHide: true,
-    shell: isWin,
+    shell: isWin && !hook,
+    env: {
+      ...process.env,
+      npm_config_fund: "false",
+      npm_config_audit: "false",
+      npm_config_update_notifier: "false",
+    },
   });
 
   child.stdout.on("data", (buf) => {
@@ -158,7 +212,7 @@ function runInstall() {
   });
 
   child.on("close", (code) => {
-    pushLog(`[updater] npm exited with code ${code}`);
+    pushLog(`[updater] install exited with code ${code}`);
     if (code === 0) {
       finalize(true, code, null);
       return;
@@ -195,8 +249,40 @@ async function waitForAppAndOpenBrowser() {
   pushLog(`[updater] app not responding within 30s, skip browser open`);
 }
 
+function trySystemdRestart() {
+  if (process.platform === "win32" || process.platform === "darwin") return false;
+  try {
+    const { execFileSync } = require("child_process");
+    // Prefer our unit name; fall back to common aliases.
+    const units = ["zevairouter.service", "zevai.service"];
+    for (const unit of units) {
+      try {
+        execFileSync("systemctl", ["cat", unit], { stdio: "ignore", timeout: 3000 });
+      } catch {
+        continue;
+      }
+      pushLog(`[updater] restarting systemd unit ${unit}`);
+      execFileSync("systemctl", ["daemon-reload"], { stdio: "ignore", timeout: 10000 });
+      execFileSync("systemctl", ["restart", unit], { stdio: "ignore", timeout: 30000 });
+      pushLog(`[updater] systemctl restart ${unit} OK`);
+      return true;
+    }
+  } catch (e) {
+    pushLog(`[updater] systemd restart skipped: ${e.message}`);
+  }
+  return false;
+}
+
 function relaunchApp() {
   if (process.env.UPDATER_RELAUNCH !== "1") return;
+
+  // VPS path: if systemd owns the service, restart that — don't spawn a second
+  // tray process that leaves the unit on the old binary forever.
+  if (trySystemdRestart()) {
+    waitForAppAndOpenBrowser();
+    return;
+  }
+
   const cmd = process.env.UPDATER_RELAUNCH_CMD;
   if (!cmd) return;
   let args = [];
@@ -208,11 +294,17 @@ function relaunchApp() {
       stdio: "ignore",
       windowsHide: true,
       shell: isWin,
-      env: { ...process.env, UPDATER_RELAUNCH: "", UPDATER_RELAUNCH_CMD: "", UPDATER_RELAUNCH_ARGS: "" },
+      env: {
+        ...process.env,
+        UPDATER_RELAUNCH: "",
+        UPDATER_RELAUNCH_CMD: "",
+        UPDATER_RELAUNCH_ARGS: "",
+        // Prevent cli.js from flipping headless server restarts into tray mode.
+        ZEVAI_SERVER_MODE: args.includes("--tray") ? "" : "1",
+      },
     });
     child.unref();
     pushLog(`[updater] relaunched: ${cmd} ${args.join(" ")} (pid=${child.pid})`);
-    // Wait for new app to come up, then auto-open browser so user sees the result
     waitForAppAndOpenBrowser();
   } catch (e) {
     pushLog(`[updater] relaunch failed: ${e.message}`);