fix openobserve root password policy failure

Generate a policy-compliant ZO_ROOT_USER_PASSWORD during install so OpenObserve can start reliably on versions that require lower/upper/digit/special character complexity.

Co-authored-by: Cursor <cursoragent@cursor.com>

.github/workflows/close-new-script-prs.yml

@@ -28,6 +28,7 @@ jobs:
             const allowedBots = [
               "push-app-to-main[bot]",
               "push-app-to-main",
+              "community-scripts-pr-app"
             ];
 
             if (allowedBots.includes(author)) {

.github/workflows/delete-pocketbase-entry-on-removal.yml

@@ -27,6 +27,7 @@ jobs:
           BEFORE="${{ github.event.before }}"
           AFTER="${{ github.event.after }}"
           slugs=""
+          ct_slugs=""
 
           # Deleted JSON files: get slug from previous commit
           deleted_json=$(git diff --name-only --diff-filter=D "$BEFORE" "$AFTER" -- json/ | grep '\.json$' || true)
@@ -37,6 +38,14 @@ jobs:
           done
 
           # Deleted script files: derive slug from path
+          deleted_ct=$(git diff --name-only --diff-filter=D "$BEFORE" "$AFTER" -- ct/ | grep '\.sh$' || true)
+          for f in $deleted_ct; do
+            [[ -z "$f" ]] && continue
+            base="${f##*/}"
+            base="${base%.sh}"
+            [[ -n "$base" ]] && ct_slugs="$ct_slugs $base"
+          done
+
           deleted_sh=$(git diff --name-only --diff-filter=D "$BEFORE" "$AFTER" -- ct/ install/ tools/ turnkey/ vm/ | grep '\.sh$' || true)
           for f in $deleted_sh; do
             [[ -z "$f" ]] && continue
@@ -51,14 +60,17 @@ jobs:
           done
 
           slugs=$(echo $slugs | xargs -n1 | sort -u | tr '\n' ' ')
+          ct_slugs=$(echo $ct_slugs | xargs -n1 2>/dev/null | sort -u | tr '\n' ' ')
           if [[ -z "$slugs" ]]; then
             echo "No deleted JSON or script files to mark as deleted in PocketBase."
             echo "count=0" >> "$GITHUB_OUTPUT"
             exit 0
           fi
           echo "$slugs" > slugs_to_delete.txt
+          echo "$ct_slugs" > ct_slugs_to_stub.txt
           echo "count=$(echo $slugs | wc -w)" >> "$GITHUB_OUTPUT"
           echo "Slugs to mark as deleted: $slugs"
+          [[ -n "$ct_slugs" ]] && echo "CT stubs to generate: $ct_slugs"
 
       - name: Mark as deleted in PocketBase
         if: steps.slugs.outputs.count != '0'
@@ -159,3 +171,134 @@ jobs:
           })().catch(e => { console.error(e); process.exit(1); });
           ENDSCRIPT
         shell: bash
+
+      - name: Generate CT stubs for deleted scripts
+        if: steps.slugs.outputs.count != '0'
+        env:
+          POCKETBASE_URL: ${{ secrets.POCKETBASE_URL }}
+          POCKETBASE_COLLECTION: ${{ secrets.POCKETBASE_COLLECTION }}
+          POCKETBASE_ADMIN_EMAIL: ${{ secrets.POCKETBASE_ADMIN_EMAIL }}
+          POCKETBASE_ADMIN_PASSWORD: ${{ secrets.POCKETBASE_ADMIN_PASSWORD }}
+        run: |
+          if [[ ! -s ct_slugs_to_stub.txt ]]; then
+            echo "No deleted ct/*.sh files; skipping stub generation."
+            exit 0
+          fi
+          node << 'ENDSCRIPT'
+          (async function() {
+            const fs = require('fs');
+            const https = require('https');
+            const http = require('http');
+            const path = require('path');
+            const url = require('url');
+
+            function request(fullUrl, opts, redirectCount) {
+              redirectCount = redirectCount || 0;
+              return new Promise(function(resolve, reject) {
+                const u = url.parse(fullUrl);
+                const isHttps = u.protocol === 'https:';
+                const body = opts.body;
+                const options = {
+                  hostname: u.hostname,
+                  port: u.port || (isHttps ? 443 : 80),
+                  path: u.path,
+                  method: opts.method || 'GET',
+                  headers: opts.headers || {}
+                };
+                if (body) options.headers['Content-Length'] = Buffer.byteLength(body);
+                const lib = isHttps ? https : http;
+                const req = lib.request(options, function(res) {
+                  if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+                    if (redirectCount >= 5) return reject(new Error('Too many redirects from ' + fullUrl));
+                    const redirectUrl = url.resolve(fullUrl, res.headers.location);
+                    res.resume();
+                    resolve(request(redirectUrl, opts, redirectCount + 1));
+                    return;
+                  }
+                  let data = '';
+                  res.on('data', function(chunk) { data += chunk; });
+                  res.on('end', function() {
+                    resolve({ ok: res.statusCode >= 200 && res.statusCode < 300, statusCode: res.statusCode, body: data });
+                  });
+                });
+                req.on('error', reject);
+                if (body) req.write(body);
+                req.end();
+              });
+            }
+
+            const raw = process.env.POCKETBASE_URL.replace(/\/$/, '');
+            const apiBase = /\/api$/i.test(raw) ? raw : raw + '/api';
+            const coll = process.env.POCKETBASE_COLLECTION;
+            const ctSlugs = fs.readFileSync('ct_slugs_to_stub.txt', 'utf8').trim().split(/\s+/).filter(Boolean);
+            if (!ctSlugs.length) {
+              console.log('No ct slugs to process.');
+              return;
+            }
+
+            const authRes = await request(apiBase + '/collections/users/auth-with-password', {
+              method: 'POST',
+              headers: { 'Content-Type': 'application/json' },
+              body: JSON.stringify({
+                identity: process.env.POCKETBASE_ADMIN_EMAIL,
+                password: process.env.POCKETBASE_ADMIN_PASSWORD
+              })
+            });
+            if (!authRes.ok) throw new Error('Auth failed: ' + authRes.body);
+            const token = JSON.parse(authRes.body).token;
+            const recordsUrl = apiBase + '/collections/' + encodeURIComponent(coll) + '/records';
+
+            for (const slug of ctSlugs) {
+              const filter = "(slug='" + slug + "')";
+              const listRes = await request(recordsUrl + '?filter=' + encodeURIComponent(filter) + '&perPage=1&fields=slug,name,deleted_message', {
+                headers: { 'Authorization': token }
+              });
+              if (!listRes.ok) {
+                console.warn('Failed to fetch record for slug "' + slug + '"');
+                continue;
+              }
+              const list = JSON.parse(listRes.body);
+              const rec = list.items && list.items[0];
+              const appName = (rec && rec.name) ? rec.name : slug;
+              const deletedMessage = (rec && rec.deleted_message && rec.deleted_message.trim())
+                ? rec.deleted_message.trim()
+                : 'This script was removed and cannot be installed or updated.';
+
+              const stubPath = path.join('ct', slug + '.sh');
+              const content =
+`#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+
+APP="${appName.replace(/"/g, '\\"')}"
+
+header_info "$APP"
+variables
+color
+
+msg_error "This script is no longer available in community-scripts."
+msg_error "${deletedMessage.replace(/"/g, '\\"')}"
+msg_warn "More info: https://community-scripts.org/scripts/${slug}"
+exit 1
+`;
+              fs.writeFileSync(stubPath, content);
+              console.log('Generated stub: ' + stubPath);
+            }
+          })().catch(e => { console.error(e); process.exit(1); });
+          ENDSCRIPT
+        shell: bash
+
+      - name: Commit generated stubs
+        if: steps.slugs.outputs.count != '0'
+        run: |
+          if git diff --quiet -- ct; then
+            echo "No generated ct stubs to commit."
+            exit 0
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add ct/*.sh
+          git commit -m "chore: add deleted script stubs"
+          git push
+        shell: bash

CHANGELOG.md

@@ -483,6 +483,36 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-06-16
+
+### 🆕 New Scripts
+
+  - Add runtime status guard and deleted script stubs [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15125](https://github.com/community-scripts/ProxmoxVE/pull/15125))
+
+## 2026-06-15
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Watcharr: Clean install on update [@tremor021](https://github.com/tremor021) ([#15119](https://github.com/community-scripts/ProxmoxVE/pull/15119))
+    - Vaultwarden: extend version check for VaultWarden update [@MickLesk](https://github.com/MickLesk) ([#15105](https://github.com/community-scripts/ProxmoxVE/pull/15105))
+
+  - #### ✨ New Features
+
+    - degoog: add curl-impersonate to script [@MickLesk](https://github.com/MickLesk) ([#15117](https://github.com/community-scripts/ProxmoxVE/pull/15117))
+
+### 💾 Core
+
+  - #### ✨ New Features
+
+    - tools.func: extend mesa-vulkan-drivers and vulkan-tools to installation for ARC GPU's [@MickLesk](https://github.com/MickLesk) ([#15106](https://github.com/community-scripts/ProxmoxVE/pull/15106))
+
+  - #### 🔧 Refactor
+
+    - core: improve mirror selection and error handling [@MickLesk](https://github.com/MickLesk) ([#15108](https://github.com/community-scripts/ProxmoxVE/pull/15108))
+    - core: implement gateway validation for DHCP and static networks [@MickLesk](https://github.com/MickLesk) ([#15107](https://github.com/community-scripts/ProxmoxVE/pull/15107))
+
 ## 2026-06-14
 
 ### 🚀 Updated Scripts

ct/booklore.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+
+APP="BookLore"
+
+header_info "$APP"
+variables
+color
+
+msg_error "This script is no longer available in community-scripts."
+msg_error "The Booklore or the Grimmory Fork will for now not return to community-scripts. Due to the unstable nature of these projects we decided to remove them and will decide at later point if they come back, which will most likley not happen. Plese do not create Issues for this."
+msg_warn "More info: https://community-scripts.org/scripts/booklore"
+exit 1

ct/degoog.sh

@@ -52,6 +52,7 @@ function update_script() {
     msg_ok "Updated Valkey"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "degoog" "fccview/degoog" "prebuild" "latest" "/opt/degoog" "degoog_*_prebuild.tar.gz"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "curl-impersonate" "lexiforest/curl-impersonate" "prebuild" "latest" "/usr/local/bin" "curl-impersonate-v*.$(uname -m)-linux-gnu.tar.gz"
 
     restore_backup
 

ct/litellm.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+
+APP="LiteLLM"
+
+header_info "$APP"
+variables
+color
+
+msg_error "This script is no longer available in community-scripts."
+msg_error "This script was removed and cannot be installed or updated."
+msg_warn "More info: https://community-scripts.org/scripts/litellm"
+exit 1

ct/minio.sh

@@ -1,80 +1,15 @@
 #!/usr/bin/env bash
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
 # Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/minio/minio
 
 APP="MinIO"
-var_tags="${var_tags:-object-storage}"
-var_cpu="${var_cpu:-1}"
-var_ram="${var_ram:-1024}"
-var_disk="${var_disk:-5}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-no}"
-var_unprivileged="${var_unprivileged:-1}"
 
 header_info "$APP"
 variables
 color
-catch_errors
 
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-  if [[ ! -f /usr/local/bin/minio ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-  FEATURE_RICH_VERSION="2025-04-22T22-12-26Z"
-  RELEASE=$(curl -fsSL https://api.github.com/repos/minio/minio/releases/latest | grep '"tag_name"' | awk -F '"' '{print $4}')
-  CURRENT_VERSION=""
-  [[ -f /opt/${APP}_version.txt ]] && CURRENT_VERSION=$(cat /opt/${APP}_version.txt)
-  RELEASE=$(curl -fsSL https://api.github.com/repos/minio/minio/releases/latest | grep '"tag_name"' | awk -F '"' '{print $4}')
-
-  if [[ "${CURRENT_VERSION}" == "${FEATURE_RICH_VERSION}" && "${RELEASE}" != "${FEATURE_RICH_VERSION}" ]]; then
-    echo
-    echo "You are currently running the last feature-rich community version: ${FEATURE_RICH_VERSION}"
-    echo "WARNING: Updating to the latest version will REMOVE most management features from the Console UI."
-    echo "Do you still want to upgrade to the latest version? [y/N]: "
-    read -n 1 -r
-    echo
-    if [[ ! $REPLY =~ ^[Yy]$ ]]; then
-      msg_ok "No update performed. Staying on the feature-rich version."
-      exit
-    fi
-  fi
-
-  if [[ "${CURRENT_VERSION}" != "${RELEASE}" ]]; then
-    msg_info "Stopping Service"
-    systemctl stop minio
-    msg_ok "Stopped Service"
-
-    msg_info "Updating ${APP} to ${RELEASE}"
-    mv /usr/local/bin/minio /usr/local/bin/minio_bak
-    curl -fsSL "https://dl.min.io/server/minio/release/linux-amd64/minio" -o /usr/local/bin/minio
-    chmod +x /usr/local/bin/minio
-    rm -f /usr/local/bin/minio_bak
-    echo "${RELEASE}" >/opt/${APP}_version.txt
-    msg_ok "Updated ${APP}"
-
-    msg_info "Starting Service"
-    systemctl start minio
-    msg_ok "Started Service"
-    msg_ok "Updated successfully!"
-  else
-    msg_ok "No update required. ${APP} is already at ${RELEASE}"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:9000${CL}"
+msg_error "This script is no longer available in community-scripts."
+msg_error "Repository is archived. Minio is gone"
+msg_warn "More info: https://community-scripts.org/scripts/minio"
+exit 1

ct/vaultwarden.sh

@@ -37,6 +37,11 @@ function update_script() {
     "2" "Set Admin Token")
 
   if [ "$UPD" == "1" ]; then
+    INSTALLED_VERSION="$(/opt/vaultwarden/bin/vaultwarden --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -n1)"
+    if [[ -n "$INSTALLED_VERSION" ]] &&
+      ! grep -qxF "$INSTALLED_VERSION" "$HOME/.vaultwarden" 2>/dev/null; then
+      printf '%s\n' "$INSTALLED_VERSION" >"$HOME/.vaultwarden"
+    fi
     if check_for_gh_release "vaultwarden" "dani-garcia/vaultwarden"; then
       msg_info "Stopping Service"
       systemctl stop vaultwarden

ct/watcharr.sh

@@ -34,9 +34,9 @@ function update_script() {
     systemctl stop watcharr
     msg_ok "Stopped Service"
 
-    rm -f /opt/watcharr/server/watcharr
-    rm -rf /opt/watcharr/server/ui
-    fetch_and_deploy_gh_release "watcharr" "sbondCo/Watcharr" "tarball"
+    create_backup /opt/watcharr/server/data
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "watcharr" "sbondCo/Watcharr" "tarball"
+    restore_backup
 
     msg_info "Updating Watcharr"
     cd /opt/watcharr

install/degoog-install.sh

@@ -27,6 +27,7 @@ ln -sf /root/.bun/bin/bun /usr/local/bin/bun
 ln -sf /root/.bun/bin/bunx /usr/local/bin/bunx
 msg_ok "Installed Bun"
 
+fetch_and_deploy_gh_release "curl-impersonate" "lexiforest/curl-impersonate" "prebuild" "latest" "/usr/local/bin" "curl-impersonate-v*.$(uname -m)-linux-gnu.tar.gz"
 fetch_and_deploy_gh_release "degoog" "fccview/degoog" "prebuild" "latest" "/opt/degoog" "degoog_*_prebuild.tar.gz"
 
 msg_info "Setting up degoog"

install/minio-install.sh

@@ -1,95 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/minio/minio
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-FEATURE_RICH_VERSION="2025-04-22T22-12-26Z"
-
-echo
-echo "MinIO recently removed many management features from the Console UI."
-echo "The last feature-complete version is: $FEATURE_RICH_VERSION"
-echo "Latest versions require the paid edition for full UI functionality."
-echo
-echo "Choose which version to install:"
-echo "  [N] Feature-rich community version ($FEATURE_RICH_VERSION) [Recommended]"
-echo "  [Y] Latest version (may lack UI features)"
-echo
-read -p "Install latest MinIO version? [y/N]: " -n 1 -r
-echo
-if [[ $REPLY =~ ^[Yy]$ ]]; then
-  USE_LATEST=true
-else
-  USE_LATEST=false
-fi
-
-msg_info "Setting up MinIO"
-if [[ "$USE_LATEST" == "true" ]]; then
-  RELEASE=$(curl -fsSL https://api.github.com/repos/minio/minio/releases/latest | grep '"tag_name"' | awk -F '"' '{print $4}')
-  DOWNLOAD_URL="https://dl.min.io/server/minio/release/linux-amd64/minio"
-else
-  RELEASE="$FEATURE_RICH_VERSION"
-  DOWNLOAD_URL="https://dl.min.io/server/minio/release/linux-amd64/archive/minio.RELEASE.${FEATURE_RICH_VERSION}"
-fi
-
-curl -fsSL "$DOWNLOAD_URL" -o /usr/local/bin/minio
-chmod +x /usr/local/bin/minio
-useradd -r minio-user -s /sbin/nologin
-mkdir -p /home/minio-user
-chown minio-user:minio-user /home/minio-user
-mkdir -p /data
-chown minio-user:minio-user /data
-
-MINIO_ADMIN_USER="minioadmin"
-MINIO_ADMIN_PASSWORD="$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-13)"
-
-cat <<EOF >/etc/default/minio
-MINIO_ROOT_USER=${MINIO_ADMIN_USER}
-MINIO_ROOT_PASSWORD=${MINIO_ADMIN_PASSWORD}
-EOF
-
-{
-  echo ""
-  echo "MinIO Credentials"
-  echo "MinIO Admin User: $MINIO_ADMIN_USER"
-  echo "MinIO Admin Password: $MINIO_ADMIN_PASSWORD"
-} >>~/minio.creds
-echo "${RELEASE}" >/opt/${APPLICATION,,}_version.txt
-msg_ok "Setup MinIO"
-
-msg_info "Creating service"
-cat <<EOF >/etc/systemd/system/minio.service
-[Unit]
-Description=MinIO
-Documentation=https://docs.min.io
-Wants=network-online.target
-After=network-online.target
-
-[Service]
-User=minio-user
-Group=minio-user
-EnvironmentFile=-/etc/default/minio
-ExecStart=/usr/local/bin/minio server --console-address ":9001" /data
-Restart=always
-RestartSec=5
-LimitNOFILE=65536
-
-[Install]
-WantedBy=multi-user.target
-EOF
-
-systemctl enable -q --now minio
-msg_ok "Service created"
-
-motd_ssh
-customize
-cleanup_lxc

install/openobserve-install.sh

@@ -17,7 +17,7 @@ msg_info "Installing OpenObserve"
 mkdir -p /opt/openobserve/data
 RELEASE=$(get_latest_github_release "openobserve/openobserve")
 tar zxf <(curl -fsSL https://downloads.openobserve.ai/releases/openobserve/v$RELEASE/openobserve-v$RELEASE-linux-amd64.tar.gz) -C /opt/openobserve
-ROOT_PASS=$(openssl rand -base64 18 | cut -c1-13)
+ROOT_PASS="$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c9)Aa1!"
 
 cat <<EOF >/opt/openobserve/data/.env
 ZO_ROOT_USER_EMAIL = "admin@example.com"

misc/build.func

@@ -979,6 +979,20 @@ base_settings() {
 
   IPV6_METHOD=${var_ipv6_method:-"none"}
   GATE=${var_gateway:-""}
+
+  # Guard against invalid gateway combinations from defaults/app vars:
+  # - DHCP must not force a static gateway
+  # - Static IPv4 must use a gateway in the same subnet
+  if [[ "$NET" == "dhcp" && -n "$GATE" ]]; then
+    msg_warn "Ignoring var_gateway '$GATE' because var_net is 'dhcp'"
+    GATE=""
+  elif [[ "$NET" != "dhcp" && -n "$GATE" ]]; then
+    if ! validate_gateway_in_subnet "$NET" "$GATE"; then
+      msg_warn "Ignoring var_gateway '$GATE' because it is not in subnet of var_net '$NET'"
+      GATE=""
+    fi
+  fi
+
   APT_CACHER=${var_apt_cacher:-""}
   APT_CACHER_IP=${var_apt_cacher_ip:-""}
 
@@ -3631,6 +3645,53 @@ run_addon_updates() {
   done
 }
 
+
+runtime_script_status_guard() {
+  local script_slug="${SCRIPT_SLUG:-${NSAPP:-}}"
+  script_slug="$(echo "$script_slug" | tr '[:upper:]' '[:lower:]' | tr ' ' '-')"
+  [[ -z "$script_slug" ]] && return 0
+
+  local api_url="https://db.community-scripts.org/api/collections/script_scripts/records?filter=(slug='${script_slug}')&perPage=1&fields=slug,is_disabled,is_deleted,disable_message,deleted_message"
+  local response
+  if ! response=$(curl -fsSL --connect-timeout 2 --max-time 3 "$api_url" 2>/dev/null); then
+    msg_warn "Script status check is unavailable. Continuing without status verification."
+    return 0
+  fi
+
+  if ! command -v jq >/dev/null 2>&1; then
+    msg_warn "Missing jq for script status check. Continuing without status verification."
+    return 0
+  fi
+
+  local has_record is_deleted is_disabled deleted_message disable_message info_url
+  has_record=$(printf '%s' "$response" | jq -r '.items | length')
+  [[ "$has_record" == "0" ]] && return 0
+
+  is_deleted=$(printf '%s' "$response" | jq -r '.items[0].is_deleted // false')
+  is_disabled=$(printf '%s' "$response" | jq -r '.items[0].is_disabled // false')
+  deleted_message=$(printf '%s' "$response" | jq -r '.items[0].deleted_message // ""')
+  disable_message=$(printf '%s' "$response" | jq -r '.items[0].disable_message // ""')
+  info_url="https://community-scripts.org/scripts/${script_slug}"
+
+  if [[ "$is_deleted" == "true" ]]; then
+    msg_error "This script is no longer available in community-scripts."
+    [[ -n "$deleted_message" ]] && msg_error "$deleted_message"
+    [[ -z "$deleted_message" ]] && msg_error "This script was removed and cannot be installed or updated."
+    msg_warn "More info: ${info_url}"
+    return 1
+  fi
+
+  if [[ "$is_disabled" == "true" ]]; then
+    msg_error "This script is currently disabled in community-scripts."
+    [[ -n "$disable_message" ]] && msg_error "$disable_message"
+    [[ -z "$disable_message" ]] && msg_error "Updates and installs are temporarily disabled for this script."
+    msg_warn "More info: ${info_url}"
+    return 1
+  fi
+
+  return 0
+}
+
 # ------------------------------------------------------------------------------
 # start()
 #
@@ -3639,9 +3700,11 @@ run_addon_updates() {
 # - In silent mode: runs update_script with automatic cleanup
 # - Otherwise: shows update/setting menu and runs update_script with cleanup
 # ------------------------------------------------------------------------------
+
 start() {
   source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/tools.func)
   if command -v pveversion >/dev/null 2>&1; then
+    runtime_script_status_guard || return 0
     install_script || return 0
     return 0
   elif [ ! -z ${PHS_SILENT+x} ] && [[ "${PHS_SILENT}" == "1" ]]; then
@@ -3649,6 +3712,7 @@ start() {
     set_std_mode
     ensure_profile_loaded
     get_lxc_ip
+    runtime_script_status_guard || return 0
     update_script
     run_addon_updates
     update_motd_ip
@@ -3659,6 +3723,7 @@ start() {
     set_std_mode
     ensure_profile_loaded
     get_lxc_ip
+    runtime_script_status_guard || return 0
     update_script
     run_addon_updates
     update_motd_ip
@@ -3688,6 +3753,7 @@ start() {
     esac
     ensure_profile_loaded
     get_lxc_ip
+    runtime_script_status_guard || return 0
     update_script
     run_addon_updates
     update_motd_ip
@@ -4379,10 +4445,12 @@ EOF
     pct exec "$CTID" -- bash -c "apt-get update 2>&1 && apt-get install -y ${_base_pkgs} 2>&1" >>"$BUILD_LOG" 2>&1 || {
       local failed_mirror
       failed_mirror=$(pct exec "$CTID" -- bash -c "grep -m1 -oP '(?<=URIs: https?://)[^/]+' /etc/apt/sources.list.d/debian.sources 2>/dev/null || grep -m1 -oP '(?<=deb https?://)[^/]+' /etc/apt/sources.list 2>/dev/null" 2>/dev/null || echo "unknown")
-      msg_warn "apt-get update failed (${failed_mirror}), trying alternate mirrors..."
+      msg_warn "apt-get update failed (${failed_mirror})."
+      msg_custom "ℹ️" "${YW}" "Probing alternate mirrors (this can take 1-2 minutes on network issues)"
       local mirror_exit=0
       pct exec "$CTID" -- env APT_BASE="$_base_pkgs" bash -c '
         DISTRO=$(. /etc/os-release 2>/dev/null && echo "$ID" || echo "debian")
+        echo "  Mirror fallback for distro: $DISTRO"
 
         if [ "$DISTRO" = "ubuntu" ]; then
           EU_MIRRORS="de.archive.ubuntu.com fr.archive.ubuntu.com se.archive.ubuntu.com nl.archive.ubuntu.com it.archive.ubuntu.com ch.archive.ubuntu.com mirrors.xtom.de"
@@ -4440,15 +4508,21 @@ EOF
         }
 
         # Phase 1: Scan global mirrors first (independent of local CDN issues)
+        echo "  Phase 1/3: Scanning global mirrors for reachability..."
         OTHERS_OK=$(scan_reachable "$OTHERS")
         OTHERS_PICK=$(printf "%s\n" $OTHERS_OK | shuf | head -3 | xargs)
 
+        if [ -z "$OTHERS_PICK" ]; then
+          echo "  No reachable global mirrors found"
+        fi
+
         for mirror in $OTHERS_PICK; do
           echo "  Attempting mirror: $mirror"
           try_mirrors "$mirror" && exit 0
         done
 
         # Phase 2: Try primary mirror
+        echo "  Phase 2/3: Trying primary mirror..."
         if [ "$DISTRO" = "ubuntu" ]; then
           PRIMARY="archive.ubuntu.com"
         else
@@ -4460,9 +4534,14 @@ EOF
         fi
 
         # Phase 3: Fall back to regional mirrors
+        echo "  Phase 3/3: Scanning regional mirrors..."
         REGIONAL_OK=$(scan_reachable "$REGIONAL")
         REGIONAL_PICK=$(printf "%s\n" $REGIONAL_OK | shuf | head -3 | xargs)
 
+        if [ -z "$REGIONAL_PICK" ]; then
+          echo "  No reachable regional mirrors found"
+        fi
+
         for mirror in $REGIONAL_PICK; do
           echo "  Attempting mirror: $mirror"
           try_mirrors "$mirror" && exit 0
@@ -4496,12 +4575,14 @@ EOF
           msg_warn "Mirror '${custom_mirror}' also failed. Try another or type 'skip'."
         done
         if [[ "$custom_mirror" == "skip" ]]; then
-          msg_error "apt-get base packages installation failed"
-          install_exit_code=1
+          msg_warn "Mirror selection aborted by user ('skip')"
+          msg_warn "Aborting installation before base package bootstrap"
+          post_update_to_api "aborted" "130" "force"
+          install_exit_code=130
         fi
       elif [[ $mirror_exit -ne 0 ]]; then
         msg_error "apt-get base packages installation failed"
-        install_exit_code=1
+        install_exit_code=100
       fi
     }
   fi

misc/tools.func

@@ -5267,6 +5267,8 @@ _setup_intel_arc() {
       intel-media-va-driver-non-free \
       intel-opencl-icd \
       libmfx-gen1.2 \
+      mesa-vulkan-drivers \
+      vulkan-tools \
       vainfo \
       intel-gpu-tools 2>/dev/null || msg_warn "Some Intel Arc packages failed"
 
@@ -5301,6 +5303,8 @@ _setup_intel_arc() {
       ocl-icd-libopencl1 \
       libvpl2 \
       libmfx-gen1.2 \
+      mesa-vulkan-drivers \
+      vulkan-tools \
       vainfo \
       intel-gpu-tools 2>/dev/null || msg_warn "Some Intel Arc packages failed"
 
@@ -5324,6 +5328,8 @@ _setup_intel_modern() {
       va-driver-all \
       intel-media-va-driver \
       ocl-icd-libopencl1 \
+      mesa-vulkan-drivers \
+      vulkan-tools \
       vainfo \
       intel-gpu-tools 2>/dev/null || msg_warn "Some Intel packages failed"
 
@@ -5358,6 +5364,8 @@ _setup_intel_modern() {
     $STD apt -y install \
       intel-media-va-driver-non-free \
       ocl-icd-libopencl1 \
+      mesa-vulkan-drivers \
+      vulkan-tools \
       vainfo \
       libmfx-gen1.2 \
       intel-gpu-tools 2>/dev/null || msg_warn "Some Intel packages failed"