@0xmaxma/claude-gateway 1.7.10 → 1.8.0

package/dist/apps/installer.d.ts

@@ -177,6 +177,27 @@ type AsyncSpawnFn = (cmd: string, args: string[], opts?: {
     stderr: string;
     status: number | null;
 }>;
+/**
+ * A filesystem call that failed because the gateway user lacks the rights, not
+ * because the path is wrong. Containers running as their image's uid leave
+ * files and directories the gateway user can neither delete nor rename, and
+ * those are the two codes the kernel reports for it.
+ */
+export declare function isPermissionError(err: unknown): boolean;
+/**
+ * Deepest directory containing both paths, never either path itself.
+ *
+ * Used to pick a **single** mount for the root helper that moves a bind path:
+ * mounting each parent separately would put the two paths on different mount
+ * points, where `rename(2)` fails EXDEV and `mv` degrades to a copy.
+ *
+ * The comparison stops one component short of the shorter path, so the result
+ * is always a strict ancestor of both — for siblings (what the callers here
+ * pass) that is exact. When one path contains the other it is the *shallower*
+ * path's parent, i.e. broader than strictly needed; never narrower, which would
+ * put a path outside the mount.
+ */
+export declare function commonAncestorDir(a: string, b: string): string;
 export declare class AppInstaller {
     private readonly registry;
     private readonly registryClient;
@@ -311,13 +332,16 @@ export declare class AppInstaller {
      * are disabled. The timer is `unref`'d so it never holds the event loop open.
      */
     /**
-     * Reclaim update scratch directories a crashed or killed update left behind:
-     * the `.cg-update-*` staging checkout and the `-old-`/`-failed-` release
-     * snapshots. Staging moved next to the install path so the swap is a
+     * Reclaim the `.cg-update-*` staging checkout a crashed or killed update left
+     * behind. Staging moved next to the install path so the swap is a
      * same-filesystem rename, which also means `/tmp` cleanup no longer collects
      * it — without this sweep a mid-update crash leaks a full app checkout
      * forever.
      *
+     * Release snapshots (`-old-`/`-failed-`) are **reported, never removed**: see
+     * {@link RELEASE_SNAPSHOT_DIR_RE}. They can hold the only copy of a live bind
+     * mount, and this sweep deletes with root.
+     *
      * **Boot only.** An update in flight owns directories matching these names,
      * so this must run before any update can start. Never throws; a directory it
      * cannot remove is reported and skipped.
@@ -475,10 +499,54 @@ export declare class AppInstaller {
     private moveBindMounts;
     private moveBindEntry;
     /**
-     * Undo {@link moveBindMounts} after a failed update: replay the recorded
-     * renames backwards so the restored previous app dir gets its state back.
+     * Name what a preserve-the-live-copy collision is about to delete.
+     *
+     * The discarded side is the release's own checkout, so it is always readable
+     * by the gateway user even when the live side is not. Without this the log
+     * says only that "the release's copy was discarded" — which reads as a
+     * `.gitkeep` and hides the case that matters: a release shipping a new
+     * `init.sql` or entrypoint script *inside* a path whose live copy wins, where
+     * the file is dropped on every update and nothing ever says which.
+     */
+    private describeDiscarded;
+    /**
+     * Undo {@link moveBindMounts}. Returns the paths it could **not** move back:
+     * those still live only under `fromDir`, so the caller must keep that
+     * directory rather than clean it up.
+     *
+     * A path that is missing at the source, or already present at the
+     * destination, is not a failure — it needs no move and is not reported.
      */
     private restoreBindMounts;
+    /**
+     * Move one bind-mount path between app directories.
+     *
+     * `rename(2)` that moves a **directory** to a different parent needs write
+     * permission on the directory itself — the kernel has to update its `..`
+     * entry — not just on the two parents, which is exactly what the swap does. A bind mount the app's own container created is owned by that
+     * image's uid (postgres initdb leaves its data directory mode 0700), so the
+     * gateway user cannot rename it and the update swap failed with EACCES on
+     * every attempt.
+     *
+     * The same host-vs-container ownership split is already handled elsewhere in
+     * this file — backups tar through a root helper container, {@link rmrf} falls
+     * back to `sudo rm -rf`. The swap was the one path still doing it bare, so
+     * the fallback here matches the backup mechanism: a throwaway root container.
+     *
+     * The helper mounts the **nearest common ancestor** of the two paths rather
+     * than each parent separately, and that is load-bearing: two bind mounts are
+     * two mount points, so `rename(2)` across them fails EXDEV and busybox `mv`
+     * silently degrades to copy-then-unlink. Measured by inode, two mounts give a
+     * new inode (a copy) where one mount preserves it (a real rename). For a
+     * database directory the degraded path means duplicating it on disk and
+     * losing the atomicity the swap depends on.
+     *
+     * The single mount is therefore the apps root, not one app's directory — the
+     * two app directories are siblings under it. The helper is a throwaway
+     * container whose only command is the `mv`, and it is reached only after the
+     * gateway user's own rename was refused.
+     */
+    private moveBindPath;
     /**
      * Stop conflicting containers then run `docker compose up -d --wait`.
      * Captures container logs into the job on failure before rethrowing.

package/dist/apps/installer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"installer.d.ts","sourceRoot":"","sources":["../../src/apps/installer.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,kCAAkC,EAAoB,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAa,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAmB,MAAM,mBAAmB,CAAC;AACpE,OAAO,EAIL,WAAW,EACX,aAAa,EACb,YAAY,EAEZ,gBAAgB,EACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAK/C,MAAM,WAAW,cAAc;IAC7B,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,2EAA2E;IAC3E,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,oDAAoD;AACpD,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,mEAAmE;IACnE,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gBAAgB,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC1D;AAED,iFAAiF;AACjF,MAAM,WAAW,eAAe;IAC9B,0FAA0F;IAC1F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oDAAoD;IACpD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oDAAoD;IACpD,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,iDAAiD;IACjD,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,6EAA6E;AAC7E,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,aAAa,EAAE,YAAY,EAAE,CAAC;IAC9B;;;;;OAKG;IACH,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,gBAAgB,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC1C,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IACvD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,kFAAkF;AAClF,MAAM,WAAW,kBAAkB;IACjC,sGAAsG;IACtG,qBAAqB,EAAE,MAAM,CAAC;IAC9B,2DAA2D;IAC3D,kBAAkB,EAAE,MAAM,CAAC;IAC3B,yEAAyE;IACzE,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,4CAA4C;AAC5C,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IACzB,0DAA0D;IAC1D,MAAM,EAAE;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,cAAc,EAAE,OAAO,CAAA;KAAE,CAAC;IACzD,MAAM,EAAE,kBAAkB,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAC5D,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7H,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,iBAAiB,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChE;AAED,KAAK,OAAO,GAAG,CACb,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,CAAC,EAAE,kCAAkC,KACtC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAE/D;;;;;GAKG;AACH,KAAK,YAAY,GAAG,CAClB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,KACxC,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAAC;AAwGxE,qBAAa,YAAY;IASrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,KAAK;IAEtB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAC9B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAfrC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA+B;IACpD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA4B;IAC5D,kGAAkG;IAClG,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;gBAGlC,QAAQ,EAAE,YAAY,EACtB,cAAc,EAAE,cAAc,EAC9B,SAAS,EAAE,kBAAkB,EAC7B,KAAK,GAAE,OAAsB,EAC9C,OAAO,CAAC,EAAE,MAAM,EACC,YAAY,CAAC,EAAE,YAAY,YAAA,EAC3B,UAAU,GAAE,YAAgC,EAC5C,kBAAkB,GAAE,qBAA0B,EAC/D,eAAe,CAAC,EAAE,eAAe,EACjC,UAAU,CAAC,EAAE,MAAM;IA4BrB,6DAA6D;IAC7D,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM;IA8BxC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS;IAI3C;;;;;;;;;;;OAWG;IACG,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IA8BpE;;;;;OAKG;IACH,OAAO,CAAC,UAAU;IA+BlB,4DAA4D;IAC5D,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IA2B/B;;;;;;OAMG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,MAAM;IA2B3D,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiF/C;;;;;;OAMG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAwB/B;;;OAGG;IACH,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAwBlD,wEAAwE;IACxE,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,EAAE;IAyB1C,yDAAyD;IACzD,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI;YAavC,SAAS;YAUT,UAAU;IAUxB;;;;;;;;;;OAUG;YACW,aAAa;IAmI3B;;;;;OAKG;YACW,cAAc;IAkH5B;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAgBvB;;;;;;;;;;OAUG;IACH;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAWtB,OAAO,CAAC,kBAAkB;IAwC1B;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IAoBpB;;;;;OAKG;IACH,iBAAiB,CAAC,GAAG,SAAa,GAAG,IAAI;IAoBzC;;;;;OAKG;IACH;;;;;;;;;;;OAWG;IACG,oBAAoB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IA8B/C,kBAAkB,IAAI,MAAM,IAAI;IAsBhC,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,YAAY;IAQd,gBAAgB,CACpB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,GACnC,OAAO,CAAC,IAAI,CAAC;IA2BhB;;;;;;;;;;;;;;;;;OAiBG;IACG,eAAe,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAazD,wGAAwG;IAClG,iBAAiB,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAIjE;;;;;;;;;OASG;YACW,kBAAkB;IAkBhC;;;;;;;;;;;;;;;;;;;OAmBG;IACG,kBAAkB,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,KAAK,CAAC;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;YA2B7F,UAAU;YAiWV,SAAS;IA2TvB;;;;;;OAMG;IACG,aAAa,CACjB,KAAK,EAAE,QAAQ,GACd,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE,CAAC;IAgB9F;;;;;;OAMG;YACW,cAAc;IA0L5B;;;;OAIG;IACG,qBAAqB,CACzB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,GAC/C,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAkBzB;;;;;;;OAOG;IACH,OAAO,CAAC,YAAY;IA+DpB,2EAA2E;IAC3E,OAAO,CAAC,WAAW;IAenB;;;;;;OAMG;YACW,mBAAmB;YA2BnB,aAAa;IA2F3B,wFAAwF;IACxF,OAAO,CAAC,IAAI;IAgBZ;;;;;OAKG;IACH,OAAO,CAAC,QAAQ;IAUhB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,wBAAwB;IA2BhC,8EAA8E;IAC9E,OAAO,CAAC,aAAa;IAQrB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,cAAc;IAiBtB,OAAO,CAAC,aAAa;IA8CrB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAkBzB;;;;OAIG;IACH,OAAO,CAAC,SAAS;IA2BjB;;;;;;;OAOG;YACW,cAAc;IAQ5B,gEAAgE;YAClD,QAAQ;IAStB,sEAAsE;IACtE,OAAO,CAAC,YAAY;IASpB;;;;OAIG;IACH,OAAO,CAAC,yBAAyB;IA0BjC;;;;;;;;OAQG;IACH;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,qBAAqB;IAiD7B;;;;;;OAMG;IACH,OAAO,CAAC,sBAAsB;IA4B9B;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB;IAS9B,OAAO,CAAC,sBAAsB;IAe9B;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAiB/B,4EAA4E;IAC5E,OAAO,CAAC,mBAAmB;IAa3B;;;;;;;;;OASG;IACH,OAAO,CAAC,eAAe;IA0BvB;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;IAiB7B,+EAA+E;IAC/E,kBAAkB,IAAI,kBAAkB;IAIxC;;;;;;OAMG;IACH,iBAAiB,IAAI,kBAAkB;IAsBvC,OAAO,CAAC,uBAAuB;IAY/B,6EAA6E;IAC7E,OAAO,CAAC,aAAa;IAQrB,OAAO,CAAC,UAAU;IAIlB,kFAAkF;IAClF,OAAO,CAAC,yBAAyB;IAajC,OAAO,CAAC,GAAG;IAoBX,OAAO,CAAC,GAAG;IAKX,OAAO,CAAC,OAAO;CAMhB;AAoBD,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,6FAA6F;IAC7F,KAAK,EAAE,MAAM,CAAC;IACd,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,kBAAkB,EAAE,CA4CnE;AAcD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,6BAA6B,CAC3C,UAAU,EAAE,kBAAkB,EAAE,GAC/B,QAAQ,CAAC,QAAQ,CAAC,CAsBpB"}
+{"version":3,"file":"installer.d.ts","sourceRoot":"","sources":["../../src/apps/installer.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,kCAAkC,EAAoB,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAa,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAmB,MAAM,mBAAmB,CAAC;AACpE,OAAO,EAIL,WAAW,EACX,aAAa,EACb,YAAY,EAEZ,gBAAgB,EACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAK/C,MAAM,WAAW,cAAc;IAC7B,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,2EAA2E;IAC3E,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,oDAAoD;AACpD,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,mEAAmE;IACnE,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gBAAgB,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC1D;AAED,iFAAiF;AACjF,MAAM,WAAW,eAAe;IAC9B,0FAA0F;IAC1F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oDAAoD;IACpD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oDAAoD;IACpD,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,iDAAiD;IACjD,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,6EAA6E;AAC7E,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,aAAa,EAAE,YAAY,EAAE,CAAC;IAC9B;;;;;OAKG;IACH,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,gBAAgB,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC1C,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IACvD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,kFAAkF;AAClF,MAAM,WAAW,kBAAkB;IACjC,sGAAsG;IACtG,qBAAqB,EAAE,MAAM,CAAC;IAC9B,2DAA2D;IAC3D,kBAAkB,EAAE,MAAM,CAAC;IAC3B,yEAAyE;IACzE,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,4CAA4C;AAC5C,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IACzB,0DAA0D;IAC1D,MAAM,EAAE;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,cAAc,EAAE,OAAO,CAAA;KAAE,CAAC;IACzD,MAAM,EAAE,kBAAkB,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAC5D,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7H,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,iBAAiB,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChE;AAED,KAAK,OAAO,GAAG,CACb,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,CAAC,EAAE,kCAAkC,KACtC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAE/D;;;;;GAKG;AACH,KAAK,YAAY,GAAG,CAClB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,KACxC,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAAC;AAqFxE;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGvD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAS9D;AAsCD,qBAAa,YAAY;IASrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,KAAK;IAEtB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAC9B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAfrC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA+B;IACpD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA4B;IAC5D,kGAAkG;IAClG,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;gBAGlC,QAAQ,EAAE,YAAY,EACtB,cAAc,EAAE,cAAc,EAC9B,SAAS,EAAE,kBAAkB,EAC7B,KAAK,GAAE,OAAsB,EAC9C,OAAO,CAAC,EAAE,MAAM,EACC,YAAY,CAAC,EAAE,YAAY,YAAA,EAC3B,UAAU,GAAE,YAAgC,EAC5C,kBAAkB,GAAE,qBAA0B,EAC/D,eAAe,CAAC,EAAE,eAAe,EACjC,UAAU,CAAC,EAAE,MAAM;IA4BrB,6DAA6D;IAC7D,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM;IA8BxC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS;IAI3C;;;;;;;;;;;OAWG;IACG,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IA8BpE;;;;;OAKG;IACH,OAAO,CAAC,UAAU;IA+BlB,4DAA4D;IAC5D,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IA2B/B;;;;;;OAMG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,MAAM;IA2B3D,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiF/C;;;;;;OAMG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAwB/B;;;OAGG;IACH,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAwBlD,wEAAwE;IACxE,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,EAAE;IAyB1C,yDAAyD;IACzD,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI;YAavC,SAAS;YAUT,UAAU;IAUxB;;;;;;;;;;OAUG;YACW,aAAa;IAmI3B;;;;;OAKG;YACW,cAAc;IAkH5B;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAgBvB;;;;;;;;;;OAUG;IACH;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAWtB,OAAO,CAAC,kBAAkB;IAwC1B;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IAoBpB;;;;;OAKG;IACH,iBAAiB,CAAC,GAAG,SAAa,GAAG,IAAI;IAoBzC;;;;;OAKG;IACH;;;;;;;;;;;;;;OAcG;IACG,oBAAoB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAqC/C,kBAAkB,IAAI,MAAM,IAAI;IAsBhC,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,YAAY;IAQd,gBAAgB,CACpB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,GACnC,OAAO,CAAC,IAAI,CAAC;IA2BhB;;;;;;;;;;;;;;;;;OAiBG;IACG,eAAe,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAazD,wGAAwG;IAClG,iBAAiB,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAIjE;;;;;;;;;OASG;YACW,kBAAkB;IAkBhC;;;;;;;;;;;;;;;;;;;OAmBG;IACG,kBAAkB,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,KAAK,CAAC;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;YA2B7F,UAAU;YAiWV,SAAS;IAwWvB;;;;;;OAMG;IACG,aAAa,CACjB,KAAK,EAAE,QAAQ,GACd,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE,CAAC;IAgB9F;;;;;;OAMG;YACW,cAAc;IA0L5B;;;;OAIG;IACG,qBAAqB,CACzB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,GAC/C,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAkBzB;;;;;;;OAOG;IACH,OAAO,CAAC,YAAY;IA+DpB,2EAA2E;IAC3E,OAAO,CAAC,WAAW;IAenB;;;;;;OAMG;YACW,mBAAmB;YA2BnB,aAAa;IA2F3B,wFAAwF;IACxF,OAAO,CAAC,IAAI;IAgBZ;;;;;OAKG;IACH,OAAO,CAAC,QAAQ;IAUhB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,wBAAwB;IA2BhC,8EAA8E;IAC9E,OAAO,CAAC,aAAa;IAQrB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,cAAc;IAiBtB,OAAO,CAAC,aAAa;IAiErB;;;;;;;;;OASG;IACH,OAAO,CAAC,iBAAiB;IAgBzB;;;;;;;OAOG;IACH,OAAO,CAAC,iBAAiB;IAsBzB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,OAAO,CAAC,YAAY;IAkCpB;;;;OAIG;IACH,OAAO,CAAC,SAAS;IA2BjB;;;;;;;OAOG;YACW,cAAc;IAQ5B,gEAAgE;YAClD,QAAQ;IAStB,sEAAsE;IACtE,OAAO,CAAC,YAAY;IASpB;;;;OAIG;IACH,OAAO,CAAC,yBAAyB;IA0BjC;;;;;;;;OAQG;IACH;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,qBAAqB;IAiD7B;;;;;;OAMG;IACH,OAAO,CAAC,sBAAsB;IA4B9B;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB;IAS9B,OAAO,CAAC,sBAAsB;IAe9B;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAiB/B,4EAA4E;IAC5E,OAAO,CAAC,mBAAmB;IAa3B;;;;;;;;;OASG;IACH,OAAO,CAAC,eAAe;IA0BvB;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;IAiB7B,+EAA+E;IAC/E,kBAAkB,IAAI,kBAAkB;IAIxC;;;;;;OAMG;IACH,iBAAiB,IAAI,kBAAkB;IAsBvC,OAAO,CAAC,uBAAuB;IAY/B,6EAA6E;IAC7E,OAAO,CAAC,aAAa;IAQrB,OAAO,CAAC,UAAU;IAIlB,kFAAkF;IAClF,OAAO,CAAC,yBAAyB;IAajC,OAAO,CAAC,GAAG;IAoBX,OAAO,CAAC,GAAG;IAKX,OAAO,CAAC,OAAO;CAMhB;AAoBD,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,6FAA6F;IAC7F,KAAK,EAAE,MAAM,CAAC;IACd,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,kBAAkB,EAAE,CA4CnE;AAcD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,6BAA6B,CAC3C,UAAU,EAAE,kBAAkB,EAAE,GAC/B,QAAQ,CAAC,QAAQ,CAAC,CAsBpB"}

package/dist/apps/installer.js

@@ -34,6 +34,8 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AppInstaller = void 0;
+exports.isPermissionError = isPermissionError;
+exports.commonAncestorDir = commonAncestorDir;
 exports.parseComposePs = parseComposePs;
 exports.mapContainerStatesToAppStatus = mapContainerStatesToAppStatus;
 const fs = __importStar(require("node:fs"));
@@ -65,6 +67,10 @@ const VOLUME_TAR_TIMEOUT_MS = 300000;
 // OCI image used for the throwaway tar helper. Small, ubiquitous, already a
 // transitive dependency of most stacks, so it is almost always cache-warm.
 const BACKUP_HELPER_IMAGE = 'alpine';
+// Ceiling for the root helper that moves a bind path the gateway user cannot
+// rename itself. The move is a single rename(2) — instant — so this only bounds
+// a stuck container (or a cold pull of the helper image) during an update swap.
+const BIND_MOVE_TIMEOUT_MS = 120000;
 // Per-app ceiling for the boot-time `compose up --wait` during restore. Runs in
 // the background (non-blocking), so this only bounds how long a hung container
 // keeps its child process alive — not the gateway's responsiveness. Shorter than
@@ -98,12 +104,60 @@ const GITHUB_URL_RE = /^https:\/\/github\.com\/(?!.*\.\.)[A-Za-z0-9][A-Za-z0-9_.
 // ─── Installer ────────────────────────────────────────────────────────────────
 const UUID_RE_SRC = '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}';
 /**
- * Scratch directories `runUpdate` creates beside an app's install path:
- * `.cg-update-<app>-<uuid>` (staging checkout) and `<appDir>-old-<uuid>` /
- * `<appDir>-failed-<uuid>` (release snapshots). All three carry a v4 UUID, so
- * the pattern cannot match an app directory named by a user.
+ * The staging checkout `runUpdate` creates beside an app's install path,
+ * `.cg-update-<app>-<uuid>`. It holds a fresh clone and nothing else, so a
+ * crash leftover is pure garbage and safe to reclaim. The UUID means the
+ * pattern cannot match an app directory named by a user.
  */
-const STALE_UPDATE_DIR_RE = new RegExp(`^\\.cg-update-.+-${UUID_RE_SRC}$|-(?:old|failed)-${UUID_RE_SRC}$`);
+const STALE_UPDATE_DIR_RE = new RegExp(`^\\.cg-update-.+-${UUID_RE_SRC}$`);
+/**
+ * The release snapshots `runUpdate` renames an install path to during the swap:
+ * `<appDir>-old-<uuid>` (previous release) and `<appDir>-failed-<uuid>` (the
+ * release that failed). Deliberately **not** swept.
+ *
+ * Both can hold the only copy of live bind-mount data. `-failed-` is kept on
+ * purpose when a rollback cannot move a bind path back, and a crash between the
+ * swap's two renames leaves an `-old-` still holding the paths that had not
+ * moved yet. Sweeping them would delete a database — through {@link rmrf}'s
+ * `sudo rm -rf` fallback, which exists precisely to defeat the container
+ * ownership that made the data unmovable in the first place. They are reported
+ * at boot instead, so a leak is visible rather than silent.
+ */
+const RELEASE_SNAPSHOT_DIR_RE = new RegExp(`-(?:old|failed)-${UUID_RE_SRC}$`);
+/**
+ * A filesystem call that failed because the gateway user lacks the rights, not
+ * because the path is wrong. Containers running as their image's uid leave
+ * files and directories the gateway user can neither delete nor rename, and
+ * those are the two codes the kernel reports for it.
+ */
+function isPermissionError(err) {
+    const code = err?.code;
+    return code === 'EACCES' || code === 'EPERM';
+}
+/**
+ * Deepest directory containing both paths, never either path itself.
+ *
+ * Used to pick a **single** mount for the root helper that moves a bind path:
+ * mounting each parent separately would put the two paths on different mount
+ * points, where `rename(2)` fails EXDEV and `mv` degrades to a copy.
+ *
+ * The comparison stops one component short of the shorter path, so the result
+ * is always a strict ancestor of both — for siblings (what the callers here
+ * pass) that is exact. When one path contains the other it is the *shallower*
+ * path's parent, i.e. broader than strictly needed; never narrower, which would
+ * put a path outside the mount.
+ */
+function commonAncestorDir(a, b) {
+    const left = path.resolve(a).split(path.sep);
+    const right = path.resolve(b).split(path.sep);
+    const shared = [];
+    for (let i = 0; i < Math.min(left.length, right.length) - 1; i++) {
+        if (left[i] !== right[i])
+            break;
+        shared.push(left[i]);
+    }
+    return shared.join(path.sep) || path.sep;
+}
 /**
  * Rows from a `docker compose … --format json` call. Compose has emitted both a
  * single JSON array and one object per line across its 2.x line, so accept
@@ -876,13 +930,16 @@ class AppInstaller {
      * are disabled. The timer is `unref`'d so it never holds the event loop open.
      */
     /**
-     * Reclaim update scratch directories a crashed or killed update left behind:
-     * the `.cg-update-*` staging checkout and the `-old-`/`-failed-` release
-     * snapshots. Staging moved next to the install path so the swap is a
+     * Reclaim the `.cg-update-*` staging checkout a crashed or killed update left
+     * behind. Staging moved next to the install path so the swap is a
      * same-filesystem rename, which also means `/tmp` cleanup no longer collects
      * it — without this sweep a mid-update crash leaks a full app checkout
      * forever.
      *
+     * Release snapshots (`-old-`/`-failed-`) are **reported, never removed**: see
+     * {@link RELEASE_SNAPSHOT_DIR_RE}. They can hold the only copy of a live bind
+     * mount, and this sweep deletes with root.
+     *
      * **Boot only.** An update in flight owns directories matching these names,
      * so this must run before any update can start. Never throws; a directory it
      * cannot remove is reported and skipped.
@@ -906,11 +963,16 @@ class AppInstaller {
             return swept; // registry unreadable — do not guess
         }
         for (const name of names) {
-            if (!STALE_UPDATE_DIR_RE.test(name))
-                continue;
             const full = path.join(this.appsDir, name);
             if (live.has(full))
                 continue;
+            if (RELEASE_SNAPSHOT_DIR_RE.test(name)) {
+                console.warn(`[installer] keeping app release snapshot "${full}" — it may hold the only copy of a `
+                    + 'bind mount an update could not move back. Recover or delete it by hand.');
+                continue;
+            }
+            if (!STALE_UPDATE_DIR_RE.test(name))
+                continue;
             try {
                 this.rmrf(full);
                 swept.push(full);
@@ -1542,6 +1604,7 @@ class AppInstaller {
             const finalDir = entry.installPath;
             const oldBackupDir = `${finalDir}-old-${crypto.randomUUID()}`;
             let swapped = false;
+            let reachedContainerStart = false;
             let failedDir = null;
             const movedBindMounts = [];
             try {
@@ -1562,17 +1625,25 @@ class AppInstaller {
                 }
                 // ── Start new containers ────────────────────────────────────────────
                 this.log(job, 'Starting new containers');
+                reachedContainerStart = true;
                 this.composeUp(appName, finalDir, job);
             }
             catch (upErr) {
-                this.log(job, 'New containers failed — rolling back to previous version');
+                // The catch spans the whole swap, so a failure here is not necessarily a
+                // container failure — saying it is sends diagnosis to the wrong
+                // subsystem (a bind-mount move that threw looked exactly like a crashed
+                // container in the job log).
+                this.log(job, reachedContainerStart
+                    ? 'New containers failed — rolling back to previous version'
+                    : `Update failed during the directory swap — rolling back to previous version: ${upErr.message}`);
                 let rollbackFailed = false;
                 failedDir = `${finalDir}-failed-${crypto.randomUUID()}`;
                 try {
+                    let unrestored = [];
                     if (swapped) {
                         fs.renameSync(finalDir, failedDir);
                         fs.renameSync(oldBackupDir, finalDir);
-                        this.restoreBindMounts(failedDir, finalDir, movedBindMounts, job);
+                        unrestored = this.restoreBindMounts(failedDir, finalDir, movedBindMounts, job);
                     }
                     else if (fs.existsSync(oldBackupDir)) {
                         fs.renameSync(oldBackupDir, finalDir);
@@ -1581,7 +1652,25 @@ class AppInstaller {
                     // before this update built over it, so the restored source and the
                     // restored image are the same release. Falls back to rebuilding from
                     // the restored source when an old image is no longer on disk.
+                    //
+                    // This has to happen even when the bind restore below refuses to
+                    // start the app: the source is already back on the previous release,
+                    // so `<app>-<service>:latest` must name that release's build before
+                    // *anything* starts it. Leaving it on the failed release's build
+                    // means an operator who finishes the recovery by hand brings old
+                    // source up on a new image — the crash-loop `preserveRunningImages`
+                    // exists to prevent.
                     const rebuild = !this.restorePreservedImages(preservedImages, finalDir, job);
+                    if (unrestored.length > 0) {
+                        // Throwing here is deliberate: it skips both the container start
+                        // below and the safeRmrf of failedDir, so the only copy of that
+                        // data stays on disk. Starting the app on a half-restored
+                        // directory is worse than not starting it — postgres on an empty
+                        // pgdata initialises a fresh cluster and then looks healthy.
+                        throw new Error(`live bind-mount data for ${unrestored.map((r) => `"${r}"`).join(', ')} could not be moved back `
+                            + `— it is still in "${failedDir}", which has been kept. Move those paths back into `
+                            + `"${finalDir}" before starting the app.`);
+                    }
                     const upArgs = ['docker', 'compose', '-p', appName, 'up', '-d'];
                     if (rebuild)
                         upArgs.push('--build');
@@ -1603,6 +1692,20 @@ class AppInstaller {
                     this.log(job, `ROLLBACK FAILED — app "${appName}" may be in a broken state: ${rollbackErr.message}`);
                 }
                 if (rollbackFailed) {
+                    // Keep the private `cg-rollback-*` tags: they are the only remaining
+                    // reference to the pre-update build, and the outer catch drops them.
+                    // Clearing the list here is what stops that — an incomplete rollback
+                    // is finished by hand, and that recovery needs the old image to still
+                    // exist. Untagged, containerd is free to reclaim it.
+                    if (preservedImages.some((i) => i.backupRef)) {
+                        this.log(job, `Pre-update images kept for manual recovery: ${preservedImages.filter((i) => i.backupRef).map((i) => `"${i.backupRef}" (for "${i.ref}")`).join(', ')}`);
+                    }
+                    preservedImages = [];
+                    // The success path above sets 'running'. Leaving the registry on the
+                    // pre-update 'running' here would report a healthy app that is not
+                    // running at all — and this branch now includes the case where the
+                    // app was deliberately not restarted.
+                    await this.registry.updateStatus(appName, 'error').catch(() => { });
                     throw new Error(`Update failed and rollback also failed — app "${appName}" may be in a broken state. Check job logs for details.`);
                 }
                 throw upErr;
@@ -2111,7 +2214,7 @@ class AppInstaller {
             const code = err.code;
             // Containers running as root leave root-owned files (e.g. postgres pgdata)
             // that the gateway user cannot delete — fs.rmSync surfaces EACCES or EPERM.
-            if (code === 'EACCES' || code === 'EPERM') {
+            if (isPermissionError(err)) {
                 console.warn(`[installer] ${code} removing "${dirPath}" — falling back to sudo rm -rf`);
                 this.run(['sudo', 'rm', '-rf', dirPath]);
             }
@@ -2218,7 +2321,7 @@ class AppInstaller {
             destStat = null;
         }
         if (destStat === null) {
-            fs.renameSync(source, destination);
+            this.moveBindPath(source, destination, rel, job);
             moved?.push(rel);
             return;
         }
@@ -2232,24 +2335,78 @@ class AppInstaller {
             // into the restored previous app dir. Exact rollback beats the renames,
             // which are same-filesystem and only walk a directory the release also
             // ships content in.
-            for (const name of fs.readdirSync(source)) {
-                this.moveBindEntry(fromDir, toDir, `${rel}/${name}`, job, moved);
+            let entries;
+            try {
+                entries = fs.readdirSync(source);
+            }
+            catch (err) {
+                // The live directory is one the app's container owns and the gateway
+                // user cannot even list (postgres leaves pgdata 0700). There is no way
+                // to merge into it entry by entry, so preserve it wholesale — the same
+                // trade the non-directory collision below already makes.
+                if (!isPermissionError(err))
+                    throw err;
+                entries = null;
+            }
+            if (entries !== null) {
+                // Each child that needs the root helper costs its own container. That
+                // is bounded by the live directory's own entry count, and only reached
+                // when a release ships tracked content *inside* a path whose children
+                // the gateway user cannot rename — rare enough not to trade the exact
+                // rollback above for one wholesale move.
+                for (const name of entries) {
+                    this.moveBindEntry(fromDir, toDir, `${rel}/${name}`, job, moved);
+                }
+                return;
             }
-            return;
         }
-        this.log(job, `Warning: preserved existing bind-mount data at "${rel}" — the updated release's copy of that path was discarded`);
+        this.log(job, `Warning: preserved existing bind-mount data at "${rel}" — the updated release's copy of that path `
+            + `was discarded (${this.describeDiscarded(destination)})`);
         fs.rmSync(destination, { recursive: true, force: true });
-        fs.renameSync(source, destination);
+        this.moveBindPath(source, destination, rel, job);
         moved?.push(rel);
     }
     /**
-     * Undo {@link moveBindMounts} after a failed update: replay the recorded
-     * renames backwards so the restored previous app dir gets its state back.
+     * Name what a preserve-the-live-copy collision is about to delete.
+     *
+     * The discarded side is the release's own checkout, so it is always readable
+     * by the gateway user even when the live side is not. Without this the log
+     * says only that "the release's copy was discarded" — which reads as a
+     * `.gitkeep` and hides the case that matters: a release shipping a new
+     * `init.sql` or entrypoint script *inside* a path whose live copy wins, where
+     * the file is dropped on every update and nothing ever says which.
+     */
+    describeDiscarded(destination, limit = 10) {
+        let names;
+        try {
+            names = fs.statSync(destination).isDirectory()
+                ? fs.readdirSync(destination).sort()
+                : [path.basename(destination)];
+        }
+        catch {
+            return 'contents unreadable';
+        }
+        if (names.length === 0)
+            return 'it was empty';
+        const shown = names.slice(0, limit).map((n) => `"${n}"`).join(', ');
+        return names.length > limit
+            ? `${shown} and ${names.length - limit} more`
+            : shown;
+    }
+    /**
+     * Undo {@link moveBindMounts}. Returns the paths it could **not** move back:
+     * those still live only under `fromDir`, so the caller must keep that
+     * directory rather than clean it up.
+     *
+     * A path that is missing at the source, or already present at the
+     * destination, is not a failure — it needs no move and is not reported.
      */
     restoreBindMounts(fromDir, toDir, moved, job) {
+        const unrestored = [];
         for (const rel of [...moved].reverse()) {
             if (!this.isSafeBindRel(fromDir, toDir, rel)) {
                 this.log(job, `Warning: skipping bind-mount path outside the app directory: "${rel}"`);
+                unrestored.push(rel);
                 continue;
             }
             const source = path.resolve(fromDir, rel);
@@ -2258,12 +2415,70 @@ class AppInstaller {
                 continue;
             try {
                 this.ensureDirWithinNoSymlink(toDir, path.dirname(destination));
-                fs.renameSync(source, destination);
+                this.moveBindPath(source, destination, rel, job);
             }
             catch (err) {
                 this.log(job, `Warning: could not restore bind-mount path "${rel}": ${err.message}`);
+                unrestored.push(rel);
             }
         }
+        return unrestored;
+    }
+    /**
+     * Move one bind-mount path between app directories.
+     *
+     * `rename(2)` that moves a **directory** to a different parent needs write
+     * permission on the directory itself — the kernel has to update its `..`
+     * entry — not just on the two parents, which is exactly what the swap does. A bind mount the app's own container created is owned by that
+     * image's uid (postgres initdb leaves its data directory mode 0700), so the
+     * gateway user cannot rename it and the update swap failed with EACCES on
+     * every attempt.
+     *
+     * The same host-vs-container ownership split is already handled elsewhere in
+     * this file — backups tar through a root helper container, {@link rmrf} falls
+     * back to `sudo rm -rf`. The swap was the one path still doing it bare, so
+     * the fallback here matches the backup mechanism: a throwaway root container.
+     *
+     * The helper mounts the **nearest common ancestor** of the two paths rather
+     * than each parent separately, and that is load-bearing: two bind mounts are
+     * two mount points, so `rename(2)` across them fails EXDEV and busybox `mv`
+     * silently degrades to copy-then-unlink. Measured by inode, two mounts give a
+     * new inode (a copy) where one mount preserves it (a real rename). For a
+     * database directory the degraded path means duplicating it on disk and
+     * losing the atomicity the swap depends on.
+     *
+     * The single mount is therefore the apps root, not one app's directory — the
+     * two app directories are siblings under it. The helper is a throwaway
+     * container whose only command is the `mv`, and it is reached only after the
+     * gateway user's own rename was refused.
+     */
+    moveBindPath(source, destination, rel, job) {
+        try {
+            fs.renameSync(source, destination);
+            return;
+        }
+        catch (err) {
+            if (!isPermissionError(err))
+                throw err;
+        }
+        const base = commonAncestorDir(source, destination);
+        const from = path.relative(base, source);
+        const to = path.relative(base, destination);
+        if (base === path.parse(base).root || base.includes(':') || from === '' || to === ''
+            || from.split(path.sep).includes('..') || to.split(path.sep).includes('..')) {
+            // A colon would be read as the mount separator by `docker -v`, silently
+            // mounting something other than what was asked for.
+            throw new Error(`Cannot move bind-mount path "${rel}" as root: unsafe mount base "${base}"`);
+        }
+        this.log(job, `Bind-mount path "${rel}" is not writable by the gateway user (created by the app's container) `
+            + '— moving it with a root helper container');
+        this.run([
+            'docker', 'run', '--rm',
+            '-v', `${base}:/mnt`,
+            BACKUP_HELPER_IMAGE,
+            'mv', path.posix.join('/mnt', from.split(path.sep).join('/')),
+            path.posix.join('/mnt', to.split(path.sep).join('/')),
+        ], undefined, BIND_MOVE_TIMEOUT_MS);
     }
     /**
      * Stop conflicting containers then run `docker compose up -d --wait`.