devchain-cli 0.24.2 → 0.25.0

package/dist/server/modules/remotes/docker/docker-plan.dto.d.ts

@@ -4,54 +4,62 @@ export interface DockerPresence {
     state: 'present' | 'absent' | 'unknown';
 }
 export declare const DockerSelectionModeSchema: z.ZodEnum<["container-and-data", "without-data", "data-only"]>;
-export declare const DockerDataChoiceSchema: z.ZodEnum<["keep-vm", "replace-home"]>;
+export declare const DockerDataChoiceSchema: z.ZodEnum<["keep-vm", "replace-home", "start-empty"]>;
 export type DockerDataChoice = z.infer<typeof DockerDataChoiceSchema>;
 export declare const DockerSelectionItemSchema: z.ZodObject<{
     id: z.ZodString;
     mode: z.ZodEnum<["container-and-data", "without-data", "data-only"]>;
-    dataChoice: z.ZodOptional<z.ZodEnum<["keep-vm", "replace-home"]>>;
+    dataChoice: z.ZodOptional<z.ZodEnum<["keep-vm", "replace-home", "start-empty"]>>;
     acceptPrivileged: z.ZodOptional<z.ZodLiteral<true>>;
+    moveWithoutUserFix: z.ZodOptional<z.ZodLiteral<true>>;
 }, "strict", z.ZodTypeAny, {
     mode: "container-and-data" | "without-data" | "data-only";
     id: string;
-    dataChoice?: "keep-vm" | "replace-home" | undefined;
+    dataChoice?: "keep-vm" | "replace-home" | "start-empty" | undefined;
     acceptPrivileged?: true | undefined;
+    moveWithoutUserFix?: true | undefined;
 }, {
     mode: "container-and-data" | "without-data" | "data-only";
     id: string;
-    dataChoice?: "keep-vm" | "replace-home" | undefined;
+    dataChoice?: "keep-vm" | "replace-home" | "start-empty" | undefined;
     acceptPrivileged?: true | undefined;
+    moveWithoutUserFix?: true | undefined;
 }>;
 export declare const DockerSelectionSchema: z.ZodObject<{
     items: z.ZodArray<z.ZodObject<{
         id: z.ZodString;
         mode: z.ZodEnum<["container-and-data", "without-data", "data-only"]>;
-        dataChoice: z.ZodOptional<z.ZodEnum<["keep-vm", "replace-home"]>>;
+        dataChoice: z.ZodOptional<z.ZodEnum<["keep-vm", "replace-home", "start-empty"]>>;
         acceptPrivileged: z.ZodOptional<z.ZodLiteral<true>>;
+        moveWithoutUserFix: z.ZodOptional<z.ZodLiteral<true>>;
     }, "strict", z.ZodTypeAny, {
         mode: "container-and-data" | "without-data" | "data-only";
         id: string;
-        dataChoice?: "keep-vm" | "replace-home" | undefined;
+        dataChoice?: "keep-vm" | "replace-home" | "start-empty" | undefined;
         acceptPrivileged?: true | undefined;
+        moveWithoutUserFix?: true | undefined;
     }, {
         mode: "container-and-data" | "without-data" | "data-only";
         id: string;
-        dataChoice?: "keep-vm" | "replace-home" | undefined;
+        dataChoice?: "keep-vm" | "replace-home" | "start-empty" | undefined;
         acceptPrivileged?: true | undefined;
+        moveWithoutUserFix?: true | undefined;
     }>, "many">;
 }, "strict", z.ZodTypeAny, {
     items: {
         mode: "container-and-data" | "without-data" | "data-only";
         id: string;
-        dataChoice?: "keep-vm" | "replace-home" | undefined;
+        dataChoice?: "keep-vm" | "replace-home" | "start-empty" | undefined;
         acceptPrivileged?: true | undefined;
+        moveWithoutUserFix?: true | undefined;
     }[];
 }, {
     items: {
         mode: "container-and-data" | "without-data" | "data-only";
         id: string;
-        dataChoice?: "keep-vm" | "replace-home" | undefined;
+        dataChoice?: "keep-vm" | "replace-home" | "start-empty" | undefined;
         acceptPrivileged?: true | undefined;
+        moveWithoutUserFix?: true | undefined;
     }[];
 }>;
 export declare const DockerPlanRequestSchema: z.ZodObject<{
@@ -59,34 +67,39 @@ export declare const DockerPlanRequestSchema: z.ZodObject<{
     items: z.ZodOptional<z.ZodArray<z.ZodObject<{
         id: z.ZodString;
         mode: z.ZodEnum<["container-and-data", "without-data", "data-only"]>;
-        dataChoice: z.ZodOptional<z.ZodEnum<["keep-vm", "replace-home"]>>;
+        dataChoice: z.ZodOptional<z.ZodEnum<["keep-vm", "replace-home", "start-empty"]>>;
         acceptPrivileged: z.ZodOptional<z.ZodLiteral<true>>;
+        moveWithoutUserFix: z.ZodOptional<z.ZodLiteral<true>>;
     }, "strict", z.ZodTypeAny, {
         mode: "container-and-data" | "without-data" | "data-only";
         id: string;
-        dataChoice?: "keep-vm" | "replace-home" | undefined;
+        dataChoice?: "keep-vm" | "replace-home" | "start-empty" | undefined;
         acceptPrivileged?: true | undefined;
+        moveWithoutUserFix?: true | undefined;
     }, {
         mode: "container-and-data" | "without-data" | "data-only";
         id: string;
-        dataChoice?: "keep-vm" | "replace-home" | undefined;
+        dataChoice?: "keep-vm" | "replace-home" | "start-empty" | undefined;
         acceptPrivileged?: true | undefined;
+        moveWithoutUserFix?: true | undefined;
     }>, "many">>;
 }, "strict", z.ZodTypeAny, {
     remoteId: string;
     items?: {
         mode: "container-and-data" | "without-data" | "data-only";
         id: string;
-        dataChoice?: "keep-vm" | "replace-home" | undefined;
+        dataChoice?: "keep-vm" | "replace-home" | "start-empty" | undefined;
         acceptPrivileged?: true | undefined;
+        moveWithoutUserFix?: true | undefined;
     }[] | undefined;
 }, {
     remoteId: string;
     items?: {
         mode: "container-and-data" | "without-data" | "data-only";
         id: string;
-        dataChoice?: "keep-vm" | "replace-home" | undefined;
+        dataChoice?: "keep-vm" | "replace-home" | "start-empty" | undefined;
         acceptPrivileged?: true | undefined;
+        moveWithoutUserFix?: true | undefined;
     }[] | undefined;
 }>;
 export type DockerPlanRequest = z.infer<typeof DockerPlanRequestSchema>;
@@ -121,7 +134,85 @@ export interface DockerNetworkRange {
     name: string;
     subnets: string[];
 }
+export interface DockerUserIds {
+    uid: number;
+    gid: number;
+}
+export interface DockerOwnershipContext {
+    home: DockerUserIds;
+    vm: DockerUserIds;
+}
+export interface DockerComposeUserSource {
+    directory: string;
+    files: string[];
+    service: string;
+}
+export interface DockerUserFixProposal {
+    id: string;
+    service: string;
+    container: string | null;
+    file: string | null;
+    line: number | null;
+    oldUser: string | null;
+    newUser: string;
+    canApply: boolean;
+    reason?: string;
+    hint: string;
+}
+export declare const DockerUserFixApplySchema: z.ZodObject<{
+    remoteId: z.ZodString;
+    proposalId: z.ZodString;
+    confirmed: z.ZodLiteral<true>;
+}, "strict", z.ZodTypeAny, {
+    remoteId: string;
+    confirmed: true;
+    proposalId: string;
+}, {
+    remoteId: string;
+    confirmed: true;
+    proposalId: string;
+}>;
+export declare const DockerUserFixVerifySchema: z.ZodObject<{
+    remoteId: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    remoteId: string;
+}, {
+    remoteId: string;
+}>;
+export interface DockerUserFixApplyResult {
+    applied: true;
+}
+export interface DockerOwnershipDecision extends DockerOwnershipContext {
+    class: 'exact' | 'follows-user' | 'needs-user-fix' | 'image-user-hint';
+    target?: {
+        user: string;
+        groupAdd: string[];
+    };
+    compose?: DockerComposeUserSource;
+    fixProposal?: DockerUserFixProposal;
+    refusalReasons?: DockerPlanIssue[];
+}
+export interface DockerServiceOwnership {
+    service: string;
+    ownership: DockerOwnershipDecision;
+}
+export interface DockerOwnershipRecord extends DockerOwnershipContext {
+    class: DockerOwnershipDecision['class'];
+    targetUser?: string;
+}
+export interface DockerDataRepresentation extends DockerOwnershipContext {
+    kind: 'exact' | 'mapped';
+}
+export interface DockerDataRepresentationGroup extends DockerDataMembers {
+    representation?: DockerDataRepresentation;
+}
 export interface DockerPlanItem {
+    runtimeUser?: string;
+    vmUser?: string;
+    retainedOwnership?: DockerOwnershipRecord;
+    dataChoices?: DockerDataChoice[];
+    ownership?: DockerOwnershipDecision;
+    serviceOwnership?: DockerServiceOwnership[];
     buildsFromProject?: boolean;
     privileged?: boolean;
     networks?: DockerNetworkRange[];
@@ -223,6 +314,7 @@ export interface DockerTransferDetails {
     result?: {
         withoutData: string[];
         dataOnly: string[];
+        alreadyTargetEntries?: number;
     };
 }
 export declare const DOCKER_WRITABLE_LAYER_NOTE = "Volume data is copied. Changes made inside the container itself are not; they are normally installed packages, not project data.";
@@ -232,6 +324,12 @@ export interface DockerDataMembers {
     bindPaths: string[];
 }
 export interface DockerDataGroup extends DockerDataMembers {
+    ownership?: DockerOwnershipDecision;
+    ownershipConsumers?: Array<DockerDataMembers & {
+        name: string;
+        itemId?: string;
+        ownership: DockerOwnershipDecision;
+    }>;
     itemIds: string[];
 }
 export type DockerDataState = 'in-sync' | 'vm-newer' | 'home-newer' | 'both-changed' | 'unknown' | 'no-record';

package/dist/server/modules/remotes/docker/docker-plan.dto.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DOCKER_TEMPORARY_NOTE = exports.DOCKER_WRITABLE_LAYER_NOTE = exports.COPYABLE_MOUNT_KINDS = exports.DockerPlanRequestSchema = exports.DockerSelectionSchema = exports.DockerSelectionItemSchema = exports.DockerDataChoiceSchema = exports.DockerSelectionModeSchema = void 0;
+exports.DOCKER_TEMPORARY_NOTE = exports.DOCKER_WRITABLE_LAYER_NOTE = exports.DockerUserFixVerifySchema = exports.DockerUserFixApplySchema = exports.COPYABLE_MOUNT_KINDS = exports.DockerPlanRequestSchema = exports.DockerSelectionSchema = exports.DockerSelectionItemSchema = exports.DockerDataChoiceSchema = exports.DockerSelectionModeSchema = void 0;
 exports.isVolumeMount = isVolumeMount;
 const zod_1 = require("zod");
 exports.DockerSelectionModeSchema = zod_1.z.enum([
@@ -8,13 +8,14 @@ exports.DockerSelectionModeSchema = zod_1.z.enum([
     'without-data',
     'data-only',
 ]);
-exports.DockerDataChoiceSchema = zod_1.z.enum(['keep-vm', 'replace-home']);
+exports.DockerDataChoiceSchema = zod_1.z.enum(['keep-vm', 'replace-home', 'start-empty']);
 exports.DockerSelectionItemSchema = zod_1.z
     .object({
     id: zod_1.z.string().min(1).max(512),
     mode: exports.DockerSelectionModeSchema,
     dataChoice: exports.DockerDataChoiceSchema.optional(),
     acceptPrivileged: zod_1.z.literal(true).optional(),
+    moveWithoutUserFix: zod_1.z.literal(true).optional(),
 })
     .strict();
 exports.DockerSelectionSchema = zod_1.z
@@ -35,6 +36,14 @@ exports.COPYABLE_MOUNT_KINDS = [
 function isVolumeMount(kind) {
     return kind === 'named-volume' || kind === 'anonymous-volume';
 }
+exports.DockerUserFixApplySchema = zod_1.z
+    .object({
+    remoteId: zod_1.z.string().uuid(),
+    proposalId: zod_1.z.string().uuid(),
+    confirmed: zod_1.z.literal(true),
+})
+    .strict();
+exports.DockerUserFixVerifySchema = zod_1.z.object({ remoteId: zod_1.z.string().uuid() }).strict();
 exports.DOCKER_WRITABLE_LAYER_NOTE = 'Volume data is copied. Changes made inside the container itself are not; they are normally installed packages, not project data.';
 exports.DOCKER_TEMPORARY_NOTE = 'temporary (`--rm`) container: only its named volumes move; Docker removes the container when it stops';
 //# sourceMappingURL=docker-plan.dto.js.map

package/dist/server/modules/remotes/docker/docker-plan.dto.js.map

@@ -1 +1 @@
-{"version":3,"file":"docker-plan.dto.js","sourceRoot":"","sources":["../../../../src/modules/remotes/docker/docker-plan.dto.ts"],"names":[],"mappings":";;;AAmEA,sCAEC;AArED,6BAAwB;AAOX,QAAA,yBAAyB,GAAG,OAAC,CAAC,IAAI,CAAC;IAC9C,oBAAoB;IACpB,cAAc;IACd,WAAW;CACZ,CAAC,CAAC;AACU,QAAA,sBAAsB,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;AAE7D,QAAA,yBAAyB,GAAG,OAAC;KACvC,MAAM,CAAC;IACN,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC9B,IAAI,EAAE,iCAAyB;IAC/B,UAAU,EAAE,8BAAsB,CAAC,QAAQ,EAAE;IAC7C,gBAAgB,EAAE,OAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,CAAC,EAAE,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,iCAAyB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;KAC/D,MAAM,EAAE,CAAC;AACC,QAAA,uBAAuB,GAAG,OAAC;KACrC,MAAM,CAAC;IACN,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC3B,KAAK,EAAE,6BAAqB,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE;CACpD,CAAC;KACD,MAAM,EAAE,CAAC;AA8BC,QAAA,oBAAoB,GAAuC;IACtE,cAAc;IACd,kBAAkB;IAClB,cAAc;IACd,WAAW;CACZ,CAAC;AACF,SAAgB,aAAa,CAAC,IAA6B;IACzD,OAAO,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,kBAAkB,CAAC;AAChE,CAAC;AAiHY,QAAA,0BAA0B,GACrC,kIAAkI,CAAC;AACxH,QAAA,qBAAqB,GAChC,uGAAuG,CAAC"}
+{"version":3,"file":"docker-plan.dto.js","sourceRoot":"","sources":["../../../../src/modules/remotes/docker/docker-plan.dto.ts"],"names":[],"mappings":";;;AAoEA,sCAEC;AAtED,6BAAwB;AAOX,QAAA,yBAAyB,GAAG,OAAC,CAAC,IAAI,CAAC;IAC9C,oBAAoB;IACpB,cAAc;IACd,WAAW;CACZ,CAAC,CAAC;AACU,QAAA,sBAAsB,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC;AAE5E,QAAA,yBAAyB,GAAG,OAAC;KACvC,MAAM,CAAC;IACN,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC9B,IAAI,EAAE,iCAAyB;IAC/B,UAAU,EAAE,8BAAsB,CAAC,QAAQ,EAAE;IAC7C,gBAAgB,EAAE,OAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC5C,kBAAkB,EAAE,OAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CAC/C,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,CAAC,EAAE,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,iCAAyB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;KAC/D,MAAM,EAAE,CAAC;AACC,QAAA,uBAAuB,GAAG,OAAC;KACrC,MAAM,CAAC;IACN,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC3B,KAAK,EAAE,6BAAqB,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE;CACpD,CAAC;KACD,MAAM,EAAE,CAAC;AA8BC,QAAA,oBAAoB,GAAuC;IACtE,cAAc;IACd,kBAAkB;IAClB,cAAc;IACd,WAAW;CACZ,CAAC;AACF,SAAgB,aAAa,CAAC,IAA6B;IACzD,OAAO,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,kBAAkB,CAAC;AAChE,CAAC;AAqCY,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC3B,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC7B,SAAS,EAAE,OAAC,CAAC,OAAO,CAAC,IAAI,CAAC;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AACC,QAAA,yBAAyB,GAAG,OAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAuI/E,QAAA,0BAA0B,GACrC,kIAAkI,CAAC;AACxH,QAAA,qBAAqB,GAChC,uGAAuG,CAAC"}

package/dist/server/modules/remotes/docker/docker-plan.service.d.ts

@@ -3,10 +3,10 @@ import type { DockerScanResult } from '../host/host-docker.dto';
 import { DockerImportInventoryStore } from '../operations/docker-import-inventory.store';
 import { RemoteHostClient } from '../operations/remote-host.client';
 import { ConnectChoicesStore } from '../connect-choices.store';
-import { type DockerPlan, type DockerPresence } from './docker-plan.dto';
+import { type DockerPlan, type DockerPresence, type DockerUserFixApplyResult } from './docker-plan.dto';
 import { DockerPlanSourceService } from './docker-plan-source.service';
 export declare function pagedDockerScan(paths: string[], scan: (page: string[], first: boolean) => Promise<DockerScanResult>): Promise<DockerScanResult>;
-interface DockerPlanOptions {
+export interface DockerPlanOptions {
     estimate?: boolean;
     reuse?: boolean;
     dataBindPaths?: readonly string[];
@@ -18,10 +18,13 @@ export declare class DockerPlanService {
     private readonly inventory;
     private readonly choices;
     private readonly speeds;
+    private readonly userFixes;
     constructor(storage: ProjectStorage & RemoteStorage, source: DockerPlanSourceService, remote: RemoteHostClient, inventory: DockerImportInventoryStore, choices: ConnectChoicesStore);
     projectRoot(projectId: string): Promise<string>;
     presence(projectId: string, signal?: AbortSignal): Promise<DockerPresence>;
+    applyUserFix(projectId: string, input: unknown, signal?: AbortSignal): Promise<DockerUserFixApplyResult>;
+    verifyUserFix(projectId: string, input: unknown, signal?: AbortSignal): Promise<DockerPlan>;
     plan(projectId: string, input: unknown, signal?: AbortSignal, { estimate, reuse, dataBindPaths }?: DockerPlanOptions): Promise<DockerPlan>;
+    private userFixProposals;
     private copySpeeds;
 }
-export {};

package/dist/server/modules/remotes/docker/docker-plan.service.js

@@ -15,7 +15,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DockerPlanService = void 0;
 exports.pagedDockerScan = pagedDockerScan;
 const docker_data_groups_1 = require("./docker-data-groups");
+const docker_ownership_1 = require("./docker-ownership");
+const docker_project_resources_1 = require("./docker-project-resources");
 const common_1 = require("@nestjs/common");
+const node_crypto_1 = require("node:crypto");
 const node_stream_1 = require("node:stream");
 const node_path_1 = require("node:path");
 const error_types_1 = require("../../../common/errors/error-types");
@@ -26,6 +29,7 @@ const remote_host_client_1 = require("../operations/remote-host.client");
 const connect_choices_store_1 = require("../connect-choices.store");
 const vm_user_identity_1 = require("../vm-user-identity");
 const docker_plan_dto_1 = require("./docker-plan.dto");
+const docker_compose_user_fix_1 = require("./docker-compose-user-fix");
 const docker_plan_fit_1 = require("./docker-plan-fit");
 const docker_plan_files_1 = require("./docker-plan-files");
 const docker_plan_policy_1 = require("./docker-plan-policy");
@@ -38,11 +42,15 @@ async function pagedDockerScan(paths, scan) {
             const original = result.containers.find((entry) => entry.id === c.id);
             if (original && c.metadata)
                 original.metadata = c.metadata;
+            if (original && c.user !== undefined)
+                original.user = c.user;
         }
         result.paths.push(...more.paths);
     }
     return result;
 }
+const USER_FIX_PROPOSAL_TTL_MS = 600_000;
+const proposalExpired = (issued) => Date.now() - issued.at >= USER_FIX_PROPOSAL_TTL_MS;
 let DockerPlanService = class DockerPlanService {
     storage;
     source;
@@ -50,6 +58,7 @@ let DockerPlanService = class DockerPlanService {
     inventory;
     choices;
     speeds = new Map();
+    userFixes = new Map();
     constructor(storage, source, remote, inventory, choices) {
         this.storage = storage;
         this.source = source;
@@ -63,6 +72,50 @@ let DockerPlanService = class DockerPlanService {
     async presence(projectId, signal) {
         return this.source.presence(await this.projectRoot(projectId), signal);
     }
+    async applyUserFix(projectId, input, signal) {
+        const request = docker_plan_dto_1.DockerUserFixApplySchema.parse(input);
+        const issued = this.userFixes.get(request.proposalId);
+        if (!issued ||
+            issued.projectId !== projectId ||
+            issued.remoteId !== request.remoteId ||
+            proposalExpired(issued) ||
+            (await this.projectRoot(projectId)) !== issued.root)
+            throw new error_types_1.AppError('The Compose user proposal is unavailable. Get a fresh plan.', 'DOCKER_USER_FIX_STALE', 409);
+        if (issued.proposal.canApply) {
+            const fresh = await this.plan(projectId, { remoteId: request.remoteId }, signal, {
+                estimate: false,
+                reuse: false,
+            });
+            const fixes = issued.itemId
+                ? fresh.items
+                    .filter((item) => item.id === issued.itemId)
+                    .flatMap((item) => [
+                    item.ownership?.fixProposal,
+                    ...(item.serviceOwnership?.map((service) => service.ownership.fixProposal) ?? []),
+                ])
+                : (fresh.dataGroups?.flatMap((group) => group.ownershipConsumers?.map((consumer) => consumer.ownership.fixProposal) ?? []) ?? []);
+            const current = fixes.find((proposal) => proposal?.service === issued.proposal.service &&
+                proposal.file === issued.proposal.file &&
+                proposal.container === issued.proposal.container);
+            if (!current ||
+                current.oldUser !== issued.proposal.oldUser ||
+                current.newUser !== issued.proposal.newUser)
+                throw new error_types_1.AppError('The Compose service or user changed since the plan. Get a fresh plan.', 'DOCKER_USER_FIX_STALE', 409);
+            if (!current.canApply)
+                throw new error_types_1.AppError(current.reason ?? 'This proposal requires a manual edit, then Verify.', 'DOCKER_USER_FIX_SHOW_ONLY', 422);
+        }
+        signal?.throwIfAborted();
+        await (0, docker_compose_user_fix_1.applyComposeUserFix)(issued.root, issued.proposal);
+        this.source.invalidate();
+        for (const [id, fix] of this.userFixes)
+            if (fix.projectId === projectId && fix.proposal.file === issued.proposal.file)
+                this.userFixes.delete(id);
+        return { applied: true };
+    }
+    verifyUserFix(projectId, input, signal) {
+        const request = docker_plan_dto_1.DockerUserFixVerifySchema.parse(input);
+        return this.plan(projectId, request, signal, { estimate: false, reuse: false });
+    }
     async plan(projectId, input, signal, { estimate = true, reuse = false, dataBindPaths = [] } = {}) {
         const request = docker_plan_dto_1.DockerPlanRequestSchema.parse(input);
         const [project] = await Promise.all([
@@ -111,8 +164,14 @@ let DockerPlanService = class DockerPlanService {
             return unavailable(plan, 'remote', 'remote-unreachable', 'The VM is unavailable.');
         }
         const mismatch = (0, vm_user_identity_1.vmUserMismatch)(this.source.uid(), this.source.gid(), runtime);
-        if (mismatch)
+        if (mismatch && (0, vm_user_identity_1.hasUnknownUserIds)(mismatch))
             return unavailable(plan, 'remote', 'vm-user-mismatch', (0, vm_user_identity_1.vmUserWarning)(mismatch), mismatch);
+        const ownership = mismatch
+            ? {
+                home: { uid: mismatch.homeUid, gid: mismatch.homeGid },
+                vm: { uid: mismatch.vmUid, gid: mismatch.vmGid },
+            }
+            : undefined;
         if (!runtime.docker?.installed)
             return unavailable(plan, 'remote', 'remote-no-docker', 'The VM reports no usable Docker engine and Compose installation.');
         try {
@@ -136,7 +195,8 @@ let DockerPlanService = class DockerPlanService {
         try {
             scanned = await this.source.scan(client, project.rootPath, scanSignal, {
                 reuse,
-                previousBindPaths: absolutePaths(inventory?.items.flatMap((item) => item.bindPaths) ?? []),
+                ownership,
+                previousBindPaths: absolutePaths((0, docker_import_inventory_store_1.inventoryBindPaths)(inventory, project.rootPath)),
                 dataBindPaths: absolutePaths(dataBindPaths),
             });
         }
@@ -149,7 +209,12 @@ let DockerPlanService = class DockerPlanService {
         plan.codePaths = scanned.codePaths.map((path) => (0, node_path_1.resolve)(path) === (0, node_path_1.resolve)(project.rootPath)
             ? '/'
             : (0, docker_plan_files_1.projectAnchoredPath)(project.rootPath, path));
-        const dataGroups = (0, docker_data_groups_1.groupDockerData)(plan.items, project.rootPath);
+        const records = inventory?.groups ?? [];
+        const dataGroups = (0, docker_data_groups_1.groupDockerData)(plan.items, project.rootPath, records.map((group) => ({
+            volumes: group.volumes,
+            bindPaths: group.bindPaths.filter((path) => (0, docker_plan_files_1.strictlyWithin)(project.rootPath, path) &&
+                !plan.codePaths.includes((0, docker_plan_files_1.projectAnchoredPath)(project.rootPath, path))),
+        })), scanned.ownershipConsumers);
         const holderVolumes = [...new Set(dataGroups.flatMap((g) => g.volumes))];
         const externalPaths = [
             ...new Set([
@@ -174,10 +239,88 @@ let DockerPlanService = class DockerPlanService {
                 throw error;
             return unavailable(plan, 'remote', 'remote-docker-routes', VM_ROUTES_MESSAGE);
         }
-        const records = inventory?.groups ?? [];
-        plan.dataGroups = dataGroups.map((group) => (0, docker_data_groups_1.checkDockerDataGroup)(group, records, scanned.holders, target, projectId));
+        const consumers = scanned.ownershipConsumers ?? [];
+        const vmConsumers = new Map();
+        if (ownership) {
+            for (const container of target.containers) {
+                const consumer = {
+                    name: `VM ${container.name}`,
+                    user: container.user,
+                    ownership: {
+                        ...ownership,
+                        class: ((0, docker_project_resources_1.projectContainer)(container, project.rootPath, projectId, target.volumes)
+                            ? inventory?.items.find((item) => item.name === container.name.replace(/^\//, ''))
+                                ?.ownership?.class
+                            : undefined) ?? 'exact',
+                    },
+                    ...(0, docker_data_groups_1.mountedData)(container.mounts),
+                };
+                consumers.push(consumer);
+                vmConsumers.set(container.id, consumer);
+            }
+        }
+        const ownershipGroups = ownership
+            ? (0, docker_data_groups_1.groupDockerData)(plan.items, project.rootPath, dataGroups, consumers)
+            : dataGroups;
+        const extraPaths = ownershipGroups
+            .flatMap((group) => group.bindPaths)
+            .filter((path) => !externalPaths.includes(path));
+        const extraVolumes = ownershipGroups
+            .flatMap((group) => group.volumes)
+            .filter((volume) => !holderVolumes.includes(volume));
+        if (extraPaths.length || extraVolumes.length) {
+            try {
+                const extra = await pagedDockerScan([...new Set(extraPaths)], (paths) => this.remote.dockerScan(request.remoteId, paths, options, [
+                    ...new Set([...holderVolumes, ...extraVolumes]),
+                ]));
+                target.paths.push(...extra.paths);
+                for (const container of extra.containers) {
+                    const original = target.containers.find((entry) => entry.id === container.id);
+                    if (original && container.metadata)
+                        original.metadata = container.metadata;
+                }
+            }
+            catch (error) {
+                if (signal?.aborted)
+                    throw error;
+                return unavailable(plan, 'remote', 'remote-docker-routes', VM_ROUTES_MESSAGE);
+            }
+        }
+        plan.dataGroups = ownershipGroups.map((group) => (0, docker_data_groups_1.checkDockerDataGroup)(group, records, scanned.holders, target, projectId, project.rootPath));
         (0, docker_plan_policy_1.applyDockerPolicy)(plan.items, request, target, projectId, runtime.homePath ?? null, project.rootPath, request.items === undefined ? this.choices.get(projectId)?.items : undefined);
-        (0, docker_plan_policy_1.applyDockerDataPolicy)(plan.items, plan.dataGroups, request, target);
+        if (ownership) {
+            for (const container of target.containers) {
+                const counterpart = plan.items.find((item) => item.name === container.name.replace(/^\//, ''));
+                if (!counterpart?.selectedMode ||
+                    !['replace', 'leave-as-is'].includes(counterpart.targetAction))
+                    continue;
+                const group = plan.dataGroups.find((entry) => entry.itemIds.includes(counterpart.id));
+                if (!group ||
+                    !consumers.some((consumer) => (0, docker_data_groups_1.overlapsData)(group, consumer) && consumer.ownership.class === 'follows-user'))
+                    continue;
+                const consumer = vmConsumers.get(container.id);
+                if (consumer)
+                    consumer.counterpart = true;
+            }
+            (0, docker_ownership_1.applyDockerGroupOwnership)(plan.dataGroups, plan.items, consumers, ownership);
+            await this.userFixProposals(plan, consumers, project.rootPath);
+        }
+        (0, docker_plan_policy_1.applyDockerDataPolicy)(plan.items, plan.dataGroups, request, target, inventory, project.rootPath, projectId);
+        const acceptedFixes = new Set(request.items?.filter((entry) => entry.moveWithoutUserFix).map((entry) => entry.id));
+        for (const item of plan.items) {
+            if (item.ownership?.class !== 'needs-user-fix' || !item.selectedMode)
+                continue;
+            if (acceptedFixes.has(item.id))
+                item.warnings.push({
+                    code: 'user-fix-skipped',
+                    message: 'Move without the fix: this container keeps the home user on the VM and cannot write project folders or read project files restricted to the VM user.',
+                });
+            else
+                item.blockers.push({
+                    code: 'user-fix-not-accepted',
+                    message: 'Apply and Verify the Compose user fix, choose Move without the fix, or deselect this item. Skipping its data does not fix project-folder access.',
+                });
+        }
         for (const item of plan.items) {
             if (item.selectedMode && (0, docker_plan_fit_1.skipsImageCopy)(item, project.rootPath)) {
                 item.images = item.images.map((image) => ({ ...image, notCopied: true }));
@@ -247,9 +390,18 @@ let DockerPlanService = class DockerPlanService {
                 .filter((i) => i.selectedMode && i.dataAction === 'keep-vm')
                 .flatMap((i) => (0, docker_plan_fit_1.potentialDataMounts)(i, project.rootPath)),
         ];
-        plan.managedExclusions = managedMounts
-            .filter((m) => m.kind === 'project-bind')
-            .map((m) => (0, docker_plan_files_1.projectAnchoredPath)(project.rootPath, m.source));
+        const resetBinds = plan.dataGroups
+            .filter((group) => plan.items.some((item) => group.itemIds.includes(item.id) &&
+            item.selectedMode &&
+            item.dataAction === 'start-empty'))
+            .flatMap((group) => group.bindPaths)
+            .filter((path) => (0, docker_plan_files_1.strictlyWithin)(project.rootPath, path));
+        plan.managedExclusions = [
+            ...new Set([
+                ...managedMounts.filter((m) => m.kind === 'project-bind').map((m) => m.source),
+                ...resetBinds,
+            ]),
+        ].map((path) => (0, docker_plan_files_1.projectAnchoredPath)(project.rootPath, path));
         plan.reconnect = (0, docker_plan_policy_1.dockerReconnect)(plan.items, this.inventory.get(projectId, request.remoteId), project.rootPath);
         if (!estimate)
             return plan;
@@ -271,6 +423,52 @@ let DockerPlanService = class DockerPlanService {
         }
         return plan;
     }
+    async userFixProposals(plan, consumers, root) {
+        for (const [id, issued] of this.userFixes)
+            if (proposalExpired(issued))
+                this.userFixes.delete(id);
+        const seen = new Set();
+        const proposals = new Map();
+        for (const consumer of consumers) {
+            const ownership = consumer.ownership;
+            const compose = ownership.compose;
+            if (seen.has(ownership) ||
+                !compose ||
+                !['needs-user-fix', 'image-user-hint'].includes(ownership.class))
+                continue;
+            seen.add(ownership);
+            const item = plan.items.find((entry) => entry.id === consumer.itemId);
+            const container = item?.kind === 'container'
+                ? item
+                : plan.items.find((entry) => entry.kind === 'container' &&
+                    entry.ownership?.compose?.service === compose.service &&
+                    entry.ownership.compose.directory === compose.directory &&
+                    JSON.stringify(entry.ownership.compose.files) === JSON.stringify(compose.files));
+            const itemId = consumer.itemId ?? container?.id;
+            const key = JSON.stringify([itemId, ownership.class, compose, consumer.user]);
+            const proposal = proposals.get(key) ??
+                (await (0, docker_compose_user_fix_1.composeUserFixProposal)(root, ownership, container?.name ?? null, (0, node_crypto_1.randomUUID)(), consumer.user));
+            if (!proposal)
+                continue;
+            proposals.set(key, proposal);
+            ownership.fixProposal = proposal;
+            this.userFixes.set(proposal.id, {
+                at: Date.now(),
+                projectId: plan.projectId,
+                remoteId: plan.remoteId,
+                ...(itemId ? { itemId } : {}),
+                root,
+                proposal,
+            });
+        }
+        const current = new Set([...proposals.values()].map((proposal) => proposal.id));
+        for (const id of this.userFixes.keys()) {
+            if (this.userFixes.size <= 1000)
+                break;
+            if (!current.has(id))
+                this.userFixes.delete(id);
+        }
+    }
     async copySpeeds(remoteId, client, image, options, reuse) {
         const recent = this.speeds.get(remoteId);
         if (reuse && recent && (0, docker_plan_source_service_1.reusable)(recent.at) && (recent.exportRate !== null || !image))