fix: harden web ui self-update restart (#552)

packages/server/src/controllers/update.ts

@@ -1,42 +1,75 @@
 import { execFileSync, spawn } from 'child_process'
-import { join } from 'path'
+import { existsSync } from 'fs'
+import { delimiter, dirname, join } from 'path'
 
-function getNpmBin() {
-  return process.platform === 'win32' ? 'npm.cmd' : 'npm'
+function getNodeBinDir() {
+  return dirname(process.execPath)
 }
 
-function getGlobalPrefix() {
-  return execFileSync(getNpmBin(), ['prefix', '-g'], {
+function getNodePrefix() {
+  return process.platform === 'win32' ? getNodeBinDir() : dirname(getNodeBinDir())
+}
+
+function getNpmCliPath() {
+  const prefix = getNodePrefix()
+  const candidates = process.platform === 'win32'
+    ? [
+        join(prefix, 'node_modules', 'npm', 'bin', 'npm-cli.js'),
+        join(getNodeBinDir(), 'node_modules', 'npm', 'bin', 'npm-cli.js'),
+      ]
+    : [join(prefix, 'lib', 'node_modules', 'npm', 'bin', 'npm-cli.js')]
+  const npmCli = candidates.find(existsSync)
+
+  if (!npmCli) {
+    throw new Error(`Unable to locate npm CLI for ${process.execPath}; checked ${candidates.join(', ')}`)
+  }
+
+  return npmCli
+}
+
+function getGlobalPackageBin(prefix: string) {
+  return process.platform === 'win32'
+    ? join(prefix, 'node_modules', 'hermes-web-ui', 'bin', 'hermes-web-ui.mjs')
+    : join(prefix, 'lib', 'node_modules', 'hermes-web-ui', 'bin', 'hermes-web-ui.mjs')
+}
+
+function getCurrentNodeEnv() {
+  return {
+    ...process.env,
+    PATH: [getNodeBinDir(), process.env.PATH].filter(Boolean).join(delimiter),
+    npm_node_execpath: process.execPath,
+  }
+}
+
+function runNpm(args: string[], options: { timeout?: number } = {}) {
+  return execFileSync(process.execPath, [getNpmCliPath(), ...args], {
     encoding: 'utf-8',
+    timeout: options.timeout,
     stdio: ['pipe', 'pipe', 'pipe'],
+    env: getCurrentNodeEnv(),
   }).trim()
 }
 
-function getGlobalCliBin() {
-  const prefix = getGlobalPrefix()
+function getGlobalPrefix() {
+  return runNpm(['prefix', '-g'])
+}
 
-  if (process.platform === 'win32') {
-    return join(prefix, 'hermes-web-ui.cmd')
-  }
-
-  return join(prefix, 'bin', 'hermes-web-ui')
+function getGlobalCliScript() {
+  return getGlobalPackageBin(getGlobalPrefix())
 }
 
 function runUpdateInstall() {
-  return execFileSync(getNpmBin(), ['install', '-g', 'hermes-web-ui@latest'], {
-    encoding: 'utf-8',
-    timeout: 10 * 60 * 1000,
-    stdio: ['pipe', 'pipe', 'pipe'],
-  })
+  return runNpm(['install', '-g', 'hermes-web-ui@latest'], { timeout: 10 * 60 * 1000 })
 }
 
 function spawnRestart(port: string) {
-  const cli = getGlobalCliBin()
+  const cli = getGlobalCliScript()
 
-  return spawn(cli, ['restart', '--port', port], {
+  return spawn(process.execPath, [cli, 'restart', '--port', port], {
     detached: true,
     stdio: 'ignore',
     windowsHide: true,
+    env: getCurrentNodeEnv(),
   })
 }