fix(update): enable auto-update for source installs running under PM2

When running from a git source checkout via PM2 service, the update
detection now correctly identifies PM2 and enables auto-update. The
install command runs git pull && npm install && npm run build:frontend
in the repo root via sh -c, and PM2 handles the restart automatically.

Also adds source-aware permission checks (verifies git is on PATH) and
version verification (reads package.json after pull instead of npm ls -g).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: dorlugasigal

src/server/routes.js

@@ -101,12 +101,12 @@ function setupRoutes(app, { auth, sessions, config, state, pushManager }) {
 
     try {
       const info = await checkForUpdate({ currentVersion: config.version, force });
-      const { installCmd, installArgs, ...publicInstallInfo } = detectInstallMethod();
+      const { installCmd, installArgs, cwd, ...publicInstallInfo } = detectInstallMethod();
       state.updateInfo = { ...info, ...publicInstallInfo };
       res.json(state.updateInfo);
     } catch (err) {
       log.warn(`Update check failed: ${err.message}`);
-      const { installCmd, installArgs, ...publicInstallInfo } = detectInstallMethod();
+      const { installCmd, installArgs, cwd, ...publicInstallInfo } = detectInstallMethod();
       const fallback = {
         current: config.version,
         latest: null,
@@ -226,6 +226,7 @@ function setupRoutes(app, { auth, sessions, config, state, pushManager }) {
       restartStrategy: installInfo.restartStrategy,
       onProgress: broadcastProgress,
       performRestart,
+      cwd: installInfo.cwd,
     }).catch((err) => {
       log.error(`Update execution error: ${err.message}`);
     });

src/utils/update-check.js

@@ -292,14 +292,31 @@ function detectInstallMethod() {
   // Check before Docker: a git checkout running inside a container (CI/devcontainers)
   // should be treated as source, not Docker
   if (isRunningFromSource()) {
+    const sourceRoot = getSourceRoot();
+    const baseCmd = 'git pull && npm install && npm run build:frontend';
+
+    if (isPm2) {
+      log.debug('Install method: source (PM2)');
+      return {
+        method: 'source',
+        command: `${baseCmd} && pm2 restart termbeam`,
+        installCmd: process.platform === 'win32' ? process.env.COMSPEC || 'cmd.exe' : 'sh',
+        installArgs: process.platform === 'win32' ? ['/c', baseCmd] : ['-c', baseCmd],
+        canAutoUpdate: true,
+        restartStrategy: 'pm2',
+        cwd: sourceRoot,
+      };
+    }
+
     log.debug('Install method: source');
     return {
       method: 'source',
-      command: 'git pull && npm install && npm run build:frontend',
+      command: baseCmd,
       installCmd: null,
       installArgs: null,
       canAutoUpdate: false,
       restartStrategy: 'none',
+      cwd: sourceRoot,
     };
   }
 
@@ -346,6 +363,26 @@ function isRunningInDocker() {
   return false;
 }
 
+/**
+ * Find the root of the source checkout by walking up from __dirname.
+ * Returns the absolute path to the repo root, or null if not found.
+ */
+function getSourceRoot() {
+  if (__dirname.includes('node_modules')) return null;
+  try {
+    let currentDir = __dirname;
+    for (let i = 0; i < 10; i++) {
+      if (fs.existsSync(path.join(currentDir, '.git'))) return currentDir;
+      const parentDir = path.dirname(currentDir);
+      if (!parentDir || parentDir === currentDir) break;
+      currentDir = parentDir;
+    }
+  } catch {
+    // ignore
+  }
+  return null;
+}
+
 /**
  * Detect if running from a git source checkout (not installed as a package).
  * Walks upward from __dirname looking for .git to avoid fragile fixed-depth assumptions.
@@ -387,4 +424,5 @@ module.exports = {
   isRunningInDocker,
   isRunningFromSource,
   isRunningUnderPm2,
+  getSourceRoot,
 };

src/utils/update-executor.js

@@ -71,6 +71,16 @@ function resetState() {
  * Returns { canUpdate, reason } — if canUpdate is false, reason explains why.
  */
 async function checkPermissions(method) {
+  // Source installs use git, not a package manager
+  if (method === 'source') {
+    try {
+      await execFilePromise('git', ['--version'], { timeout: VERIFY_TIMEOUT_MS });
+    } catch {
+      return { canUpdate: false, reason: 'git not found on PATH' };
+    }
+    return { canUpdate: true, reason: null };
+  }
+
   const cmd = method === 'yarn' ? 'yarn' : method === 'pnpm' ? 'pnpm' : 'npm';
 
   // Check if the package manager is available by running it directly
@@ -124,6 +134,7 @@ async function executeUpdate({
   restartStrategy,
   onProgress,
   performRestart,
+  cwd,
 }) {
   if (updateState.status !== 'idle' && updateState.status !== 'failed') {
     return { ...updateState, error: 'Update already in progress' };
@@ -169,6 +180,7 @@ async function executeUpdate({
       timeout: INSTALL_TIMEOUT_MS,
       maxBuffer: 10 * 1024 * 1024, // 10 MB — package manager installs can be verbose
       env: { ...process.env, NO_UPDATE_NOTIFIER: '1' },
+      cwd: cwd || undefined,
     });
 
     const output = (stdout + '\n' + stderr).trim();
@@ -178,7 +190,7 @@ async function executeUpdate({
     // Step 3: Verify
     notify({ status: 'verifying', phase: 'Verifying update...' });
 
-    const newVersion = await verifyInstalledVersion(method);
+    const newVersion = await verifyInstalledVersion(method, cwd);
     if (!newVersion) {
       notify({
         status: 'failed',
@@ -230,7 +242,22 @@ async function executeUpdate({
 
 // ── Version Verification ─────────────────────────────────────────────────────
 
-async function verifyInstalledVersion(method) {
+async function verifyInstalledVersion(method, cwd) {
+  // Source installs: read version from the repo's package.json after git pull
+  if (method === 'source') {
+    try {
+      const pkgPath = cwd
+        ? path.join(cwd, 'package.json')
+        : path.resolve(__dirname, '../../package.json');
+      const content = await fs.promises.readFile(pkgPath, 'utf8');
+      const pkg = JSON.parse(content);
+      return pkg.version || null;
+    } catch (err) {
+      log.debug(`Version verification via package.json failed: ${err.message}`);
+    }
+    return null;
+  }
+
   const cmd = method === 'yarn' ? 'yarn' : method === 'pnpm' ? 'pnpm' : 'npm';
   try {
     // Use npm/yarn/pnpm to read the installed version

test/utils/update-check.test.js

@@ -404,16 +404,77 @@ describe('update-check', () => {
     it('should detect source when running from git repo', () => {
       delete process.env.npm_command;
       delete process.env.npm_execpath;
-      const { detectInstallMethod } = require('../../src/utils/update-check');
-      const result = detectInstallMethod();
-      // Running tests from the repo — .git exists and not in node_modules.
-      // In Docker/CI containers, may report 'docker' instead — both are non-auto-updatable.
+      // Clear PM2 env vars to test the non-PM2 source path
+      const origPm2Home = process.env.PM2_HOME;
+      const origPmId = process.env.pm_id;
+      const origPm2Usage = process.env.PM2_USAGE;
+      delete process.env.PM2_HOME;
+      delete process.env.pm_id;
+      delete process.env.PM2_USAGE;
+      delete require.cache[require.resolve('../../src/utils/update-check')];
+      try {
+        const { detectInstallMethod } = require('../../src/utils/update-check');
+        const result = detectInstallMethod();
+        // Running tests from the repo — .git exists and not in node_modules.
+        // In Docker/CI containers, may report 'docker' instead — both are non-auto-updatable.
+        assert.ok(
+          ['source', 'docker'].includes(result.method),
+          `expected 'source' or 'docker', got '${result.method}'`,
+        );
+        assert.equal(result.canAutoUpdate, false);
+        assert.equal(result.restartStrategy, 'none');
+        if (result.method === 'source') {
+          assert.ok(result.cwd, 'source method should include cwd');
+        }
+      } finally {
+        if (origPm2Home !== undefined) process.env.PM2_HOME = origPm2Home;
+        else delete process.env.PM2_HOME;
+        if (origPmId !== undefined) process.env.pm_id = origPmId;
+        else delete process.env.pm_id;
+        if (origPm2Usage !== undefined) process.env.PM2_USAGE = origPm2Usage;
+        else delete process.env.PM2_USAGE;
+      }
+    });
+
+    it('should enable auto-update for source under PM2', () => {
+      delete process.env.npm_command;
+      delete process.env.npm_execpath;
+      const origPm2Home = process.env.PM2_HOME;
+      const origPmId = process.env.pm_id;
+      process.env.PM2_HOME = '/home/user/.pm2';
+      process.env.pm_id = '0';
+      delete require.cache[require.resolve('../../src/utils/update-check')];
+      try {
+        const {
+          detectInstallMethod,
+          isRunningFromSource,
+        } = require('../../src/utils/update-check');
+        if (!isRunningFromSource()) return; // Skip in Docker/CI
+        const result = detectInstallMethod();
+        assert.equal(result.method, 'source');
+        assert.equal(result.canAutoUpdate, true);
+        assert.equal(result.restartStrategy, 'pm2');
+        assert.ok(result.command.includes('pm2 restart'), 'command should include pm2 restart');
+        assert.ok(result.installCmd, 'should have installCmd for auto-update');
+        assert.ok(result.installArgs, 'should have installArgs for auto-update');
+        assert.ok(result.cwd, 'should include cwd for source install');
+      } finally {
+        if (origPm2Home !== undefined) process.env.PM2_HOME = origPm2Home;
+        else delete process.env.PM2_HOME;
+        if (origPmId !== undefined) process.env.pm_id = origPmId;
+        else delete process.env.pm_id;
+      }
+    });
+
+    it('getSourceRoot should return repo root directory', () => {
+      const { getSourceRoot } = require('../../src/utils/update-check');
+      const root = getSourceRoot();
+      assert.ok(root, 'should find source root');
+      assert.ok(fs.existsSync(path.join(root, '.git')), 'source root should contain .git');
       assert.ok(
-        ['source', 'docker'].includes(result.method),
-        `expected 'source' or 'docker', got '${result.method}'`,
+        fs.existsSync(path.join(root, 'package.json')),
+        'source root should contain package.json',
       );
-      assert.equal(result.canAutoUpdate, false);
-      assert.equal(result.restartStrategy, 'none');
     });
 
     it('should return canAutoUpdate and restartStrategy fields', () => {