Pin compose example to v0.2.1

README.md

@@ -134,6 +134,15 @@ answers on the port, gpu-turnstile just uses it instead of spawning
 instance already holds the port when you open the desktop app, the
 desktop's server is the one that fails to bind.
 
+One catch when gpu-turnstile runs as a service: the sandboxed service
+account may not enter your user profile, so a ComfyUI install under
+`C:\Users\...` (or `/home/...`) fails with "Access is denied".
+`--install-service` fixes that automatically — it grants
+`NT SERVICE\gpu-turnstile` recursive access to `COMFY_DIR` on Windows and
+adds a `BindPaths=` to the systemd unit on Linux. Re-run it after changing
+`COMFY_DIR`; or grant by hand from an admin shell:
+`icacls "<COMFY_DIR>" /grant "NT SERVICE\gpu-turnstile:(OI)(CI)M" /T`.
+
 ## Game detection
 
 Want to game on the same GPU without Ollama/ComfyUI squatting on the VRAM?

SPEC.md

@@ -159,6 +159,14 @@ files are flagged in the startup log.
 - Its stdout/stderr is forwarded to the log at INFO. The health check
   skips the intentionally-stopped/starting states; a failed probe while
   the process is alive and was previously ready is logged as DOWN.
+- **Permissions**: the service account is sandboxed (Windows virtual
+  account, systemd `DynamicUser`), so a ComfyUI install inside a user
+  profile is off-limits by default. `--install-service` opens it up —
+  a recursive ACL grant for `NT SERVICE\gpu-turnstile` on Windows, a
+  `BindPaths=` in the unit on Linux — reading `COMFY_DIR` from the config
+  it installs. Re-run `--install-service` after changing `COMFY_DIR`, or
+  grant by hand (admin shell):
+  `icacls "<COMFY_DIR>" /grant "NT SERVICE\gpu-turnstile:(OI)(CI)M" /T`.
 
 ## Game detection (foreign GPU holders)
 

cmd/gpu-turnstile/main.go

@@ -39,6 +39,11 @@ var version = "dev"
 // process: a signed update has been staged and the GPU lock is idle.
 const exitCodeUpdate = 3
 
+// exitCodeStaged is returned by an elevated --force-update child when it
+// staged a new binary, so the non-elevated parent can tell "updated" from
+// "up to date" (it cannot see the child's console).
+const exitCodeStaged = 4
+
 // stdoutIsTerminal reports whether stdout is a console (char device), as
 // opposed to a pipe or file — which is what Docker containers and services
 // see.
@@ -348,11 +353,12 @@ func forceUpdateCommand(configPath string, elevatedChild bool) int {
 	// instead of hanging in a TCP connect for minutes.
 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()
-	staged, err := u.Check(ctx, exePath)
+	staged, to, err := u.Check(ctx, exePath)
 	if err != nil && isPermission(err) && !service.Elevated() {
 		code, _ := elevateAndMirror("--force-update")
-		if code == 0 {
+		reportElevatedUpdate(code, to)
-			fmt.Println("update applied (elevated)")
+		if code == 0 || code == exitCodeStaged {
+			return 0
 		}
 		return code
 	}
@@ -364,12 +370,13 @@ func forceUpdateCommand(configPath string, elevatedChild bool) int {
 		fmt.Printf("%s is up to date\n", versionLine())
 		return 0
 	}
-	fmt.Printf("%s: update staged\n", versionLine())
+	fmt.Printf("gpu-turnstile: updated from %s to %s\n", version, to)
 	restarted, err := service.RestartIfRunning()
 	if err != nil && isPermission(err) && !service.Elevated() {
 		code, _ := elevateAndMirror("--force-update")
-		if code == 0 {
+		reportElevatedUpdate(code, to)
-			fmt.Println("update applied (elevated)")
+		if code == 0 || code == exitCodeStaged {
+			return 0
 		}
 		return code
 	}
@@ -378,13 +385,35 @@ func forceUpdateCommand(configPath string, elevatedChild bool) int {
 		return 1
 	}
 	if restarted {
-		fmt.Println("service restarted on the new version")
+		fmt.Println("service restarted on " + to)
 	} else {
-		fmt.Println("no running service; the new version applies on next start")
+		fmt.Println("no running service; " + to + " applies on the next start")
+	}
+	if elevatedChild {
+		// Tell the non-elevated parent (which cannot see this console)
+		// whether anything was staged, so its mirror message is honest.
+		return exitCodeStaged
 	}
 	return 0
 }
 
+// reportElevatedUpdate prints the parent's summary of an elevated
+// --force-update child: exitCodeStaged means the child staged a new binary,
+// 0 means it found nothing to do. to is the tag the parent's own check
+// resolved before it hit the permission wall ("" when it never got that
+// far).
+func reportElevatedUpdate(code int, to string) {
+	switch {
+	case code == exitCodeStaged && to != "":
+		fmt.Printf("gpu-turnstile: updated from %s to %s (elevated)\n", version, to)
+	case code == exitCodeStaged:
+		fmt.Println("update applied (elevated)")
+	case code == 0:
+		fmt.Printf("%s is up to date\n", versionLine())
+	}
+	// Non-zero, non-staged codes: elevateAndMirror already printed the failure.
+}
+
 // serviceCommand installs (copyBin = register the canonical-layout copy)
 // or removes the service and reports the result. On Windows, when the
 // shell is not elevated, the command relaunches itself through a UAC
@@ -518,14 +547,21 @@ func run(ctx context.Context, cfg config.Config, log *slog.Logger, logOut io.Wri
 	if comfyCmdLine != "" {
 		if cfg.ComfyCmd == "" {
 			// Derived from COMFY_DIR: flag a wrong-looking layout early,
-			// while the operator is still watching the startup log.
+			// while the operator is still watching the startup log. Inside
+			// a profile the service account may not enter, os.Stat fails
+			// with EACCES — that reads as "not found" but means "grant
+			// access", so say so.
 			python, script := supervise.ComfyLayout(runtime.GOOS, cfg.ComfyDir)
 			for _, p := range []string{python, script} {
 				if _, err := os.Stat(p); err != nil {
+					if isPermission(err) {
+						log.Warn("COMFY_DIR: not accessible to the service account; grant access or re-run --install-service", "path", p)
+					} else {
 						log.Warn("COMFY_DIR: file not found; ComfyUI requests will fail until it exists", "path", p)
 					}
 				}
 			}
+		}
 		var err error
 		comfySup, err = supervise.New("comfy", comfyCmdLine, cfg.ComfyDir, comfyClient.Probe, cfg.ComfyStartTimeout, log)
 		if err != nil {
@@ -806,16 +842,16 @@ func updateLoop(ctx context.Context, cfg config.Config, log *slog.Logger, lk *lo
 	}
 	u := &update.Updater{Repo: cfg.UpdateRepo, Asset: cfg.UpdateAsset, Version: version, Desired: cfg.AppVersion, Log: log}
 	for {
-		staged, err := u.Check(ctx, exePath)
+		staged, to, err := u.Check(ctx, exePath)
 		if err != nil && ctx.Err() == nil {
 			log.Warn("auto-update check failed", "err", err)
 		}
 		if staged {
 			if !isService {
-				log.Warn("auto-update: new binary staged; restart gpu-turnstile to apply")
+				log.Warn("auto-update: new binary staged; restart gpu-turnstile to apply", "version", to)
 				return
 			}
-			log.Warn("auto-update: staged; restarting once the GPU is idle")
+			log.Warn("auto-update: staged; restarting once the GPU is idle", "version", to)
 			if waitForIdle(ctx, lk, 24*time.Hour) {
 				log.Warn("auto-update: restarting to apply update")
 				os.Exit(exitCodeUpdate)

compose.yaml.example

@@ -6,7 +6,7 @@
 # ComfyUI --listen 0.0.0.0 --port 8189).
 services:
   gpu-turnstile:
-    image: git.rambossek.at/public/gpu-turnstile:v0.1.10
+    image: git.rambossek.at/public/gpu-turnstile:v0.2.1
     restart: unless-stopped
     environment:
       # Each consumer is enabled by setting its URL; leave one unset to

internal/service/envfile.go

@@ -45,3 +45,19 @@ func writeEnvFile(path, content string) error {
 	}
 	return nil
 }
+
+// configuredValue reads one key from the env file the service will load, so
+// the installers can adapt the sandbox to it (ACL grants, unit directives).
+// "" when unset or unreadable.
+func configuredValue(configPath, key string) string {
+	f, err := os.Open(configPath)
+	if err != nil {
+		return ""
+	}
+	defer f.Close()
+	values, err := config.ParseEnvFile(f)
+	if err != nil {
+		return ""
+	}
+	return values[key]
+}

internal/service/service_linux.go

@@ -62,8 +62,19 @@ func Run(run func(ctx context.Context) error) error {
 // filesystem is read-only except StateDirectory (the install dir, so
 // self-updates can rewrite the binary), and the usual no-privilege-escalation
 // directives apply. The proxy needs nothing but outbound TCP/UDP and the
-// notify socket, so it loses nothing.
+// notify socket, so it loses nothing. A managed ComfyUI (comfyDir) gets a
-func renderUnit(exePath, configPath string) string {
+// BindPaths hole through ProtectHome/ProtectSystem: it reads its venv and
+// writes output/temp/user data under COMFY_DIR. A venv whose base
+// interpreter (pyvenv.cfg home) lives outside COMFY_DIR gets an additional
+// read-only bind.
+func renderUnit(exePath, configPath, comfyDir string) string {
+	bind := ""
+	if comfyDir != "" {
+		bind = "BindPaths=" + comfyDir + "\n"
+		if home := comfyVenvHome(comfyDir); home != "" {
+			bind += "BindReadOnlyPaths=" + home + "\n"
+		}
+	}
 	return fmt.Sprintf(`[Unit]
 Description=gpu-turnstile GPU arbitration proxy for Ollama and ComfyUI
 After=network-online.target
@@ -78,7 +89,7 @@ RestartSec=5s
 
 DynamicUser=yes
 StateDirectory=%s
-ProtectSystem=strict
+%sProtectSystem=strict
 ProtectHome=yes
 PrivateTmp=yes
 NoNewPrivileges=yes
@@ -100,7 +111,7 @@ SystemCallErrorNumber=EPERM
 
 [Install]
 WantedBy=multi-user.target
-`, exePath, configPath, Name)
+`, exePath, configPath, Name, bind)
 }
 
 // copyFile copies src to dst, creating dst with the given mode.
@@ -125,7 +136,9 @@ func copyFile(src, dst string, mode os.FileMode) error {
 // sure /etc/gpu-turnstile.env exists (copied from the given config file if
 // provided), writes the hardened unit, then enables and starts it. With
 // copyBin=false the current executable location and config path are
-// registered as-is instead. Needs root.
+// registered as-is instead. When the config sets COMFY_DIR, the unit gets a
+// BindPaths= for it so the sandboxed service can reach the managed ComfyUI
+// even under /home. Needs root.
 //
 // Re-running install converges an existing unit instead of failing: it is
 // stopped first if active, the installed binary is replaced only when the
@@ -186,7 +199,7 @@ func Install(configPath string, copyBin bool, version string) error {
 			cfg = abs
 		}
 	}
-	rendered := renderUnit(exe, cfg)
+	rendered := renderUnit(exe, cfg, configuredValue(cfg, "COMFY_DIR"))
 	if old, _ := os.ReadFile(unitPath); string(old) != rendered {
 		if err := os.WriteFile(unitPath, []byte(rendered), 0o644); err != nil {
 			return fmt.Errorf("write %s (run as root): %w", unitPath, err)

internal/service/service_linux_test.go

@@ -8,7 +8,7 @@ import (
 )
 
 func TestRenderUnit(t *testing.T) {
-	unit := renderUnit("/var/lib/gpu-turnstile/gpu-turnstile", "/etc/gpu-turnstile.env")
+	unit := renderUnit("/var/lib/gpu-turnstile/gpu-turnstile", "/etc/gpu-turnstile.env", "")
 	for _, want := range []string{
 		"Type=notify",
 		"WatchdogSec=30s",
@@ -26,4 +26,12 @@ func TestRenderUnit(t *testing.T) {
 			t.Fatalf("unit missing %q:\n%s", want, unit)
 		}
 	}
+	if strings.Contains(unit, "BindPaths") {
+		t.Fatalf("unit without COMFY_DIR must not bind anything:\n%s", unit)
+	}
+
+	unit = renderUnit("/var/lib/gpu-turnstile/gpu-turnstile", "/etc/gpu-turnstile.env", "/home/gpu/ComfyUI")
+	if !strings.Contains(unit, "BindPaths=/home/gpu/ComfyUI\n") {
+		t.Fatalf("unit with COMFY_DIR must bind it:\n%s", unit)
+	}
 }

internal/service/service_windows.go

@@ -24,8 +24,6 @@ import (
 	"golang.org/x/sys/windows"
 	"golang.org/x/sys/windows/svc"
 	"golang.org/x/sys/windows/svc/mgr"
-
-	"gpu-turnstile/internal/config"
 )
 
 // Name is the Windows service name.
@@ -106,10 +104,12 @@ func (h *handler) Execute(_ []string, requests <-chan svc.ChangeRequest, status
 // the service after 5s on failure — this is also what brings up a staged
 // update after the updater exits with a non-zero code. After registering,
 // the virtual account is granted modify access to the install and data
-// directories (self-updates rewrite the exe), and read access to the
+// directories (self-updates rewrite the exe), read access to the
-// config file if it lives elsewhere. The grants must come after
+// config file if it lives elsewhere, and — when the config sets COMFY_DIR —
-// CreateService: the virtual account's SID only exists once the service is
+// recursive modify access to the managed ComfyUI's install tree, which may
-// registered.
+// live inside a user profile the account otherwise cannot enter. The grants
+// must come after CreateService: the virtual account's SID only exists once
+// the service is registered.
 //
 // Re-running install on an existing service converges instead of failing:
 // the service is stopped first if running (so the binary can be replaced),
@@ -146,6 +146,7 @@ func Install(configPath string, copyBin bool, version string) error {
 		if st, qErr := s.Query(); qErr == nil &&
 			(st.State == svc.Running || st.State == svc.StartPending) {
 			wasRunning = true
+			fmt.Println("stopping the running gpu-turnstile service")
 			if err := stopAndWait(s); err != nil {
 				return err
 			}
@@ -161,6 +162,7 @@ func Install(configPath string, copyBin bool, version string) error {
 			}
 			installedExe := filepath.Join(installDir, "gpu-turnstile.exe")
 			if same, _ := sameFileContent(exe, installedExe); !same {
+				fmt.Printf("installing %s\n", installedExe)
 				if err := copyFile(exe, installedExe); err != nil {
 					return fmt.Errorf("copy binary to %s: %w", installedExe, err)
 				}
@@ -208,6 +210,7 @@ func Install(configPath string, copyBin bool, version string) error {
 		// Best effort: start now instead of waiting for the next boot. A
 		// missing config (no consumer URLs) fails the start; the service stays
 		// registered and can be started once the config exists.
+		fmt.Println("starting the gpu-turnstile service")
 		s.Start()
 		return nil
 	}
@@ -243,6 +246,7 @@ func Install(configPath string, copyBin bool, version string) error {
 		return err
 	}
 	if wasRunning {
+		fmt.Println("starting the gpu-turnstile service")
 		if err := s.Start(); err != nil {
 			return fmt.Errorf("start service: %w", err)
 		}
@@ -354,7 +358,7 @@ func grantAll(exe, configPath string) error {
 			return err
 		}
 	}
-	if logFile := configuredLogFile(configPath); logFile != "" {
+	if logFile := configuredValue(configPath, "LOG_FILE"); logFile != "" {
 		dir := filepath.Dir(logFile)
 		if err := os.MkdirAll(dir, 0o755); err == nil {
 			if err := grantAccess(dir, "(OI)(CI)(M)"); err != nil {
@@ -362,6 +366,24 @@ func grantAll(exe, configPath string) error {
 			}
 		}
 	}
+	// A managed ComfyUI whose install lives somewhere the virtual account
+	// may not go (a user profile) needs an explicit grant — recursively,
+	// since ComfyUI also writes output/temp/user data next to its code. A
+	// missing directory is skipped: the startup warning covers it.
+	if comfyDir := configuredValue(configPath, "COMFY_DIR"); comfyDir != "" {
+		if _, err := os.Stat(comfyDir); err == nil {
+			if err := grantAccessTree(comfyDir, "(OI)(CI)(M)"); err != nil {
+				return err
+			}
+			// uv venvs (Comfy-Desktop) redirect to a base interpreter that
+			// can live outside COMFY_DIR; read+execute suffices for it.
+			if home := comfyVenvHome(comfyDir); home != "" {
+				if err := grantAccessTree(home, "(OI)(CI)(RX)"); err != nil {
+					return err
+				}
+			}
+		}
+	}
 	return nil
 }
 
@@ -466,28 +488,35 @@ func RelaunchElevated(args []string) (int, error) {
 // grantAccess gives the virtual account the icacls permission set (e.g.
 // "(OI)(CI)(M)") on path.
 func grantAccess(path, perms string) error {
-	out, err := exec.Command("icacls", path, "/grant", virtualAccount+":"+perms).CombinedOutput()
+	return runIcacls(path, perms, false)
+}
+
+// grantAccessTree is grantAccess with /T: the ACE is applied to the
+// existing tree, not just inherited by children created later. Needed when
+// the tree already exists, e.g. a ComfyUI install in a user profile. On a
+// large tree (a venv has tens of thousands of files) this takes minutes,
+// so it says what it is doing instead of looking hung.
+func grantAccessTree(path, perms string) error {
+	return runIcacls(path, perms, true)
+}
+
+func runIcacls(path, perms string, recursive bool) error {
+	args := []string{path, "/grant", virtualAccount + ":" + perms}
+	if recursive {
+		fmt.Printf("granting %s %s access to %s (large trees can take minutes)\n", virtualAccount, perms, path)
+		args = append(args, "/T")
+	}
+	start := time.Now()
+	out, err := exec.Command("icacls", args...).CombinedOutput()
 	if err != nil {
 		return fmt.Errorf("grant %s access to %s: %w (%s)", virtualAccount, path, err, strings.TrimSpace(string(out)))
 	}
+	if recursive {
+		fmt.Printf("access granted in %s\n", time.Since(start).Round(time.Second))
+	}
 	return nil
 }
 
-// configuredLogFile reads LOG_FILE from the config file so the installer
-// can pre-create and ACL the log directory. "" when unset or unreadable.
-func configuredLogFile(configPath string) string {
-	f, err := os.Open(configPath)
-	if err != nil {
-		return ""
-	}
-	defer f.Close()
-	values, err := config.ParseEnvFile(f)
-	if err != nil {
-		return ""
-	}
-	return values["LOG_FILE"]
-}
-
 // RestartIfRunning restarts the service when it is installed and running
 // (used after a forced update staged a new binary). Reports whether a
 // restart happened. A service that is not installed or not running is not

internal/service/venv.go

@@ -0,0 +1,38 @@
+package service
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// comfyVenvHome returns the base interpreter directory of the Python venv at
+// <comfyDir>/.venv when that directory lives outside comfyDir, "" otherwise.
+// uv-created venvs (Comfy-Desktop) ship a redirector python.exe whose real
+// interpreter is the pyvenv.cfg "home" tree — typically a sibling of
+// COMFY_DIR, which a sandbox/ACL covering COMFY_DIR alone does not reach.
+func comfyVenvHome(comfyDir string) string {
+	data, err := os.ReadFile(filepath.Join(comfyDir, ".venv", "pyvenv.cfg"))
+	if err != nil {
+		return ""
+	}
+	for _, line := range strings.Split(string(data), "\n") {
+		k, v, ok := strings.Cut(line, "=")
+		if !ok || strings.TrimSpace(k) != "home" {
+			continue
+		}
+		home := strings.TrimSpace(v)
+		if home == "" {
+			return ""
+		}
+		if st, err := os.Stat(home); err != nil || !st.IsDir() {
+			return ""
+		}
+		rel, err := filepath.Rel(comfyDir, home)
+		if err != nil || rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) {
+			return home
+		}
+		return "" // inside comfyDir: already covered by the COMFY_DIR grant
+	}
+	return ""
+}

internal/service/venv_test.go

@@ -0,0 +1,45 @@
+package service
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestComfyVenvHome(t *testing.T) {
+	root := t.TempDir()
+	comfy := filepath.Join(root, "ComfyUI")
+	outside := filepath.Join(root, "standalone-env")
+	inside := filepath.Join(comfy, "runtime")
+	for _, d := range []string{filepath.Join(comfy, ".venv"), outside, inside} {
+		if err := os.MkdirAll(d, 0o755); err != nil {
+			t.Fatal(err)
+		}
+	}
+	cfg := filepath.Join(comfy, ".venv", "pyvenv.cfg")
+
+	write := func(home string) {
+		if err := os.WriteFile(cfg, []byte("home = "+home+"\nversion_info = 3.13.0\n"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	write(outside)
+	if got := comfyVenvHome(comfy); got != outside {
+		t.Fatalf("outside home: got %q, want %q", got, outside)
+	}
+
+	write(inside)
+	if got := comfyVenvHome(comfy); got != "" {
+		t.Fatalf("inside home: got %q, want empty", got)
+	}
+
+	write(filepath.Join(root, "does-not-exist"))
+	if got := comfyVenvHome(comfy); got != "" {
+		t.Fatalf("missing home: got %q, want empty", got)
+	}
+
+	if got := comfyVenvHome(filepath.Join(root, "no-venv")); got != "" {
+		t.Fatalf("no pyvenv.cfg: got %q, want empty", got)
+	}
+}

internal/update/update.go

@@ -173,11 +173,13 @@ func CleanupOld(exePath string) {
 
 // Check performs a single update check. staged is true when a
 // signature-verified binary has been swapped into place at exePath; the
-// caller should then restart the process. A nil error with staged=false
+// caller should then restart the process. to is the release tag the check
-// means "no action" (up to date, APP_VER=dev, or no embedded public key);
+// resolved (the latest release or the pinned tag), set once the release
-// a non-nil error means the check failed and the running binary is
+// fetch succeeded — even when staging afterwards fails. A nil error with
-// untouched.
+// staged=false means "no action" (up to date, APP_VER=dev, or no embedded
-func (u *Updater) Check(ctx context.Context, exePath string) (staged bool, err error) {
+// public key); a non-nil error means the check failed and the running
+// binary is untouched.
+func (u *Updater) Check(ctx context.Context, exePath string) (staged bool, to string, err error) {
 	log := u.logger()
 	desired := u.Desired
 	if desired == "" {
@@ -185,15 +187,15 @@ func (u *Updater) Check(ctx context.Context, exePath string) (staged bool, err e
 	}
 	if desired == "dev" {
 		log.Debug("auto-update: APP_VER=dev, skipping")
-		return false, nil
+		return false, "", nil
 	}
 	if publicKeyPEM == "" {
 		log.Debug("auto-update: no public key embedded, skipping")
-		return false, nil
+		return false, "", nil
 	}
 	api, err := u.apiURL()
 	if err != nil {
-		return false, err
+		return false, "", err
 	}
 
 	pinned := desired != "stable"
@@ -203,29 +205,30 @@ func (u *Updater) Check(ctx context.Context, exePath string) (staged bool, err e
 	}
 	body, err := u.get(ctx, endpoint)
 	if err != nil {
-		return false, fmt.Errorf("fetch release: %w", err)
+		return false, "", fmt.Errorf("fetch release: %w", err)
 	}
 	var rel release
 	if err := json.Unmarshal(body, &rel); err != nil {
-		return false, fmt.Errorf("parse release: %w", err)
+		return false, "", fmt.Errorf("parse release: %w", err)
 	}
+	to = rel.TagName
 	if pinned {
 		// Pin mode: any difference from the target tag means stage it —
 		// including downgrades and replacing a dev binary.
 		if u.Version == rel.TagName {
 			log.Debug("auto-update: already on pinned version", "version", u.Version)
-			return false, nil
+			return false, to, nil
 		}
 	} else if u.Version != "" && u.Version != "dev" {
 		// Stable mode: only strictly newer releases count; a dev binary
 		// cannot be compared and is always replaced by the latest release.
 		newer, err := newerVersion(u.Version, rel.TagName)
 		if err != nil {
-			return false, err
+			return false, to, err
 		}
 		if !newer {
 			log.Debug("auto-update: up to date", "version", u.Version, "latest", rel.TagName)
-			return false, nil
+			return false, to, nil
 		}
 	}
 
@@ -235,42 +238,42 @@ func (u *Updater) Check(ctx context.Context, exePath string) (staged bool, err e
 	}
 	assetURL, ok := urls[u.Asset]
 	if !ok {
-		return false, fmt.Errorf("release %s has no asset %q", rel.TagName, u.Asset)
+		return false, to, fmt.Errorf("release %s has no asset %q", rel.TagName, u.Asset)
 	}
 	sigURL, ok := urls[u.Asset+".sig"]
 	if !ok {
-		return false, fmt.Errorf("release %s has no signature asset %q", rel.TagName, u.Asset+".sig")
+		return false, to, fmt.Errorf("release %s has no signature asset %q", rel.TagName, u.Asset+".sig")
 	}
 
 	data, err := u.get(ctx, assetURL)
 	if err != nil {
-		return false, fmt.Errorf("download %s: %w", u.Asset, err)
+		return false, to, fmt.Errorf("download %s: %w", u.Asset, err)
 	}
 	sig, err := u.get(ctx, sigURL)
 	if err != nil {
-		return false, fmt.Errorf("download signature: %w", err)
+		return false, to, fmt.Errorf("download signature: %w", err)
 	}
 
 	if sumURL, ok := urls[u.Asset+".sha256"]; ok {
 		sumText, err := u.get(ctx, sumURL)
 		if err != nil {
-			return false, fmt.Errorf("download checksum: %w", err)
+			return false, to, fmt.Errorf("download checksum: %w", err)
 		}
 		want := strings.Fields(string(sumText))[0]
 		got := hex.EncodeToString(sha256Bytes(data))
 		if !strings.EqualFold(want, got) {
-			return false, fmt.Errorf("sha256 mismatch: got %s, want %s", got, want)
+			return false, to, fmt.Errorf("sha256 mismatch: got %s, want %s", got, want)
 		}
 	}
 	if err := verifySignature(publicKeyPEM, data, sig); err != nil {
-		return false, err
+		return false, to, err
 	}
 
 	if err := stage(exePath, data); err != nil {
-		return false, fmt.Errorf("stage update: %w", err)
+		return false, to, fmt.Errorf("stage update: %w", err)
 	}
 	log.Info("auto-update: new version staged", "from", u.Version, "to", rel.TagName)
-	return true, nil
+	return true, to, nil
 }
 
 func sha256Bytes(data []byte) []byte {

internal/update/update_test.go

@@ -102,13 +102,16 @@ func TestCheckStagesUpdate(t *testing.T) {
 	withPublicKey(t, f.pubPEM)
 	exe := fakeExe(t)
 
-	staged, err := f.updater("v0.1.2").Check(context.Background(), exe)
+	staged, to, err := f.updater("v0.1.2").Check(context.Background(), exe)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if !staged {
 		t.Fatal("expected staged update")
 	}
+	if to != "v9.9.9" {
+		t.Fatalf("to = %q, want v9.9.9", to)
+	}
 	content, _ := os.ReadFile(exe)
 	if string(content) != "new-binary" {
 		t.Fatalf("exe content = %q", content)
@@ -125,7 +128,7 @@ func TestCheckRejectsTamperedSignature(t *testing.T) {
 	withPublicKey(t, f.pubPEM)
 	exe := fakeExe(t)
 
-	staged, err := f.updater("v0.1.2").Check(context.Background(), exe)
+	staged, _, err := f.updater("v0.1.2").Check(context.Background(), exe)
 	if err == nil {
 		t.Fatal("expected signature error")
 	}
@@ -142,7 +145,7 @@ func TestCheckSkipsOlderOrEqual(t *testing.T) {
 	for _, tag := range []string{"v0.1.2", "v0.1.1", "v0.0.9"} {
 		f := newFakeGitea(t, tag, []byte("new-binary"))
 		withPublicKey(t, f.pubPEM)
-		staged, err := f.updater("v0.1.2").Check(context.Background(), fakeExe(t))
+		staged, _, err := f.updater("v0.1.2").Check(context.Background(), fakeExe(t))
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -155,7 +158,7 @@ func TestCheckSkipsOlderOrEqual(t *testing.T) {
 func TestCheckSkipsWithoutPublicKey(t *testing.T) {
 	f := newFakeGitea(t, "v9.9.9", []byte("new-binary"))
 	withPublicKey(t, "")
-	staged, err := f.updater("v0.1.2").Check(context.Background(), fakeExe(t))
+	staged, _, err := f.updater("v0.1.2").Check(context.Background(), fakeExe(t))
 	if err != nil || staged {
 		t.Fatalf("staged=%v err=%v, want no action without key", staged, err)
 	}
@@ -167,7 +170,7 @@ func TestCheckDevBuildGetsStable(t *testing.T) {
 	f := newFakeGitea(t, "v9.9.9", []byte("new-binary"))
 	withPublicKey(t, f.pubPEM)
 	exe := fakeExe(t)
-	staged, err := f.updater("dev").Check(context.Background(), exe)
+	staged, _, err := f.updater("dev").Check(context.Background(), exe)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -184,7 +187,7 @@ func TestCheckDesiredDevDisables(t *testing.T) {
 	f := newFakeGitea(t, "v9.9.9", []byte("new-binary"))
 	withPublicKey(t, f.pubPEM)
 	for _, version := range []string{"dev", "v0.1.2"} {
-		staged, err := f.updaterDesired(version, "dev").Check(context.Background(), fakeExe(t))
+		staged, _, err := f.updaterDesired(version, "dev").Check(context.Background(), fakeExe(t))
 		if err != nil || staged {
 			t.Fatalf("version %s: staged=%v err=%v, want no action with APP_VER=dev", version, staged, err)
 		}
@@ -198,13 +201,16 @@ func TestCheckPinned(t *testing.T) {
 		f := newFakeGitea(t, "v0.5.0", []byte("pinned-binary"))
 		withPublicKey(t, f.pubPEM)
 		exe := fakeExe(t)
-		staged, err := f.updaterDesired(version, "v0.5.0").Check(context.Background(), exe)
+		staged, to, err := f.updaterDesired(version, "v0.5.0").Check(context.Background(), exe)
 		if err != nil {
 			t.Fatalf("version %s: %v", version, err)
 		}
 		if !staged {
 			t.Fatalf("version %s: expected pinned v0.5.0 to be staged", version)
 		}
+		if to != "v0.5.0" {
+			t.Fatalf("version %s: to = %q, want v0.5.0", version, to)
+		}
 		content, _ := os.ReadFile(exe)
 		if string(content) != "pinned-binary" {
 			t.Fatalf("version %s: exe content = %q", version, content)
@@ -213,7 +219,7 @@ func TestCheckPinned(t *testing.T) {
 
 	f := newFakeGitea(t, "v0.5.0", []byte("pinned-binary"))
 	withPublicKey(t, f.pubPEM)
-	staged, err := f.updaterDesired("v0.5.0", "v0.5.0").Check(context.Background(), fakeExe(t))
+	staged, _, err := f.updaterDesired("v0.5.0", "v0.5.0").Check(context.Background(), fakeExe(t))
 	if err != nil || staged {
 		t.Fatalf("staged=%v err=%v, want no action when already on the pinned version", staged, err)
 	}