Update twingate-connector.sh

The update path used ensure_dependencies, which only installs missing
packages and does not upgrade already installed ones. As a result, users
could see 'Updated successfully' even when a newer twingate-connector
version was available.

Switch update_script to a real package update flow:
- ensure apt is healthy
- refresh apt metadata
- install/upgrade twingate-connector via retry helper
- restart service

This aligns behavior with Twingate's documented upgrade process.

CHANGELOG.md

@@ -445,40 +445,14 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
-## 2026-04-24
-
-### 🚀 Updated Scripts
-
-  - Update wger.sh [@Soppster1029](https://github.com/Soppster1029) ([#13977](https://github.com/community-scripts/ProxmoxVE/pull/13977))
-
 ## 2026-04-23
 
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - mealie: start.sh missing after failed update [@MickLesk](https://github.com/MickLesk) ([#13958](https://github.com/community-scripts/ProxmoxVE/pull/13958))
-    - twingate-connector: perform real apt upgrade during update flow [@MickLesk](https://github.com/MickLesk) ([#13959](https://github.com/community-scripts/ProxmoxVE/pull/13959))
-
-  - #### ✨ New Features
-
-    - core: auto-size NODE_OPTIONS heap [@MickLesk](https://github.com/MickLesk) ([#13960](https://github.com/community-scripts/ProxmoxVE/pull/13960))
-
-  - #### 🔧 Refactor
-
-    - Update scripts to match standard [@tremor021](https://github.com/tremor021) ([#13956](https://github.com/community-scripts/ProxmoxVE/pull/13956))
-
 ### 💾 Core
 
   - #### 🐞 Bug Fixes
 
-    - tools.func: upgrade Node.js minor/patch on same major version [@MickLesk](https://github.com/MickLesk) ([#13957](https://github.com/community-scripts/ProxmoxVE/pull/13957))
     - core: hotfix - prefer silent mode on PHS env conflict [@MickLesk](https://github.com/MickLesk) ([#13951](https://github.com/community-scripts/ProxmoxVE/pull/13951))
 
-  - #### 🔧 Refactor
-
-    - core: improve system update information / lxc stack upgrade [@MickLesk](https://github.com/MickLesk) ([#13970](https://github.com/community-scripts/ProxmoxVE/pull/13970))
-
 ## 2026-04-22
 
 ### 🆕 New Scripts

ct/checkmate.sh

@@ -39,7 +39,7 @@ function update_script() {
     [ -f /opt/checkmate/client/.env.local ] && cp /opt/checkmate/client/.env.local /opt/checkmate_client.env.local.bak
     msg_ok "Backed up Data"
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "checkmate" "bluewave-labs/Checkmate" "tarball"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "checkmate" "bluewave-labs/Checkmate"
 
     msg_info "Updating Checkmate Server"
     cd /opt/checkmate/server

ct/flatnotes.sh

@@ -38,7 +38,7 @@ function update_script() {
     cp -r /opt/flatnotes/data /opt/flatnotes_data_backup
     msg_ok "Backed up Configuration and Data"
 
-    fetch_and_deploy_gh_release "flatnotes" "dullage/flatnotes" "tarball"
+    fetch_and_deploy_gh_release "flatnotes" "dullage/flatnotes"
 
     msg_info "Updating Flatnotes"
     cd /opt/flatnotes/client

ct/linkding.sh

@@ -39,7 +39,7 @@ function update_script() {
     cp /opt/linkding/.env /opt/linkding_env_backup
     msg_ok "Backed up Data"
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "linkding" "sissbruecker/linkding" "tarball"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "linkding" "sissbruecker/linkding"
 
     msg_info "Restoring Data"
     cp -r /opt/linkding_data_backup/. /opt/linkding/data

ct/mealie.sh

@@ -38,27 +38,10 @@ function update_script() {
 
     msg_info "Backing up Configuration"
     cp -f /opt/mealie/mealie.env /opt/mealie.env
-    [[ -f /opt/mealie/start.sh ]] && cp -f /opt/mealie/start.sh /opt/mealie.start.sh
     msg_ok "Backup completed"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "mealie" "mealie-recipes/mealie" "tarball"
 
-    msg_info "Restoring Configuration"
-    mv -f /opt/mealie.env /opt/mealie/mealie.env
-    if [[ -f /opt/mealie.start.sh ]]; then
-      mv -f /opt/mealie.start.sh /opt/mealie/start.sh
-    else
-      cat <<'STARTEOF' >/opt/mealie/start.sh
-#!/bin/bash
-set -a
-source /opt/mealie/mealie.env
-set +a
-exec uv run mealie
-STARTEOF
-    fi
-    chmod +x /opt/mealie/start.sh
-    msg_ok "Configuration restored"
-
     msg_info "Installing Python Dependencies with uv"
     cd /opt/mealie
     $STD uv sync --frozen --extra pgsql
@@ -87,6 +70,18 @@ STARTEOF
     $STD uv run python -m nltk.downloader -d /nltk_data averaged_perceptron_tagger_eng
     msg_ok "Updated NLTK Data"
 
+    msg_info "Restoring Configuration"
+    mv -f /opt/mealie.env /opt/mealie/mealie.env
+    cat <<'STARTEOF' >/opt/mealie/start.sh
+#!/bin/bash
+set -a
+source /opt/mealie/mealie.env
+set +a
+exec uv run mealie
+STARTEOF
+    chmod +x /opt/mealie/start.sh
+    msg_ok "Configuration restored"
+
     msg_info "Starting Service"
     systemctl start mealie
     msg_ok "Started Service"

ct/nodecast-tv.sh

@@ -34,7 +34,7 @@ function update_script() {
     systemctl stop nodecast-tv
     msg_ok "Stopped Service"
 
-    fetch_and_deploy_gh_release "nodecast-tv" "technomancer702/nodecast-tv" "tarball"
+    fetch_and_deploy_gh_release "nodecast-tv" "technomancer702/nodecast-tv"
 
     msg_info "Updating Modules"
     cd /opt/nodecast-tv

ct/termix.sh

@@ -145,7 +145,7 @@ EOF
     cp -r /opt/termix/uploads /opt/termix_uploads_backup
     msg_ok "Backed up Data"
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "termix" "Termix-SSH/Termix" "tarball"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "termix" "Termix-SSH/Termix"
 
     msg_info "Recreating Directories"
     mkdir -p /opt/termix/html \
@@ -155,8 +155,6 @@ EOF
       /opt/termix/nginx/client_body
     msg_ok "Recreated Directories"
 
-    NODE_VERSION="24" setup_nodejs
-
     msg_info "Building Frontend"
     cd /opt/termix
     export COREPACK_ENABLE_DOWNLOAD_PROMPT=0

ct/wger.sh

@@ -53,8 +53,6 @@ function update_script() {
     set -a && source /opt/wger/.env && set +a
     export DJANGO_SETTINGS_MODULE=settings.main
     $STD uv pip install .
-    $STD npm install
-    $STD npm run build:css:sass
     $STD uv run python manage.py migrate
     $STD uv run python manage.py collectstatic --no-input
     msg_ok "Updated wger"

install/checkmate-install.sh

@@ -22,7 +22,7 @@ msg_ok "Installed Dependencies"
 
 MONGO_VERSION="8.0" setup_mongodb
 NODE_VERSION="22" setup_nodejs
-fetch_and_deploy_gh_release "checkmate" "bluewave-labs/Checkmate" "tarball"
+fetch_and_deploy_gh_release "checkmate" "bluewave-labs/Checkmate"
 
 msg_info "Configuring Checkmate"
 JWT_SECRET="$(openssl rand -hex 32)"

install/linkding-install.sh

@@ -27,7 +27,7 @@ msg_ok "Installed Dependencies"
 
 NODE_VERSION="22" setup_nodejs
 setup_uv
-fetch_and_deploy_gh_release "linkding" "sissbruecker/linkding" "tarball"
+fetch_and_deploy_gh_release "linkding" "sissbruecker/linkding"
 
 msg_info "Building Frontend"
 cd /opt/linkding

install/nodecast-tv-install.sh

@@ -13,7 +13,7 @@ setting_up_container
 network_check
 update_os
 
-fetch_and_deploy_gh_release "nodecast-tv" "technomancer702/nodecast-tv" "tarball"
+fetch_and_deploy_gh_release "nodecast-tv" "technomancer702/nodecast-tv"
 NODE_VERSION="20" setup_nodejs
 
 msg_info "Installing Dependencies"

install/romm-install.sh

@@ -120,7 +120,7 @@ fetch_and_deploy_gh_release "RAHasher" "RetroAchievements/RALibretro" "prebuild"
 cp /opt/RALibretro/RAHasher /usr/bin/RAHasher
 chmod +x /usr/bin/RAHasher
 
-fetch_and_deploy_gh_release "romm" "rommapp/romm" "tarball"
+fetch_and_deploy_gh_release "romm" "rommapp/romm"
 
 msg_info "Creating environment file"
 sed -i 's/^supervised no/supervised systemd/' /etc/redis/redis.conf

install/termix-install.sh

@@ -55,7 +55,7 @@ rm -rf /opt/guacamole-server
 msg_ok "Built Guacamole Server (guacd)"
 
 NODE_VERSION="22" setup_nodejs
-fetch_and_deploy_gh_release "termix" "Termix-SSH/Termix" "tarball"
+fetch_and_deploy_gh_release "termix" "Termix-SSH/Termix"
 
 msg_info "Building Frontend"
 cd /opt/termix

misc/build.func

@@ -2702,16 +2702,21 @@ advanced_settings() {
     # STEP 28: Verbose Mode & Confirmation
     # ═══════════════════════════════════════════════════════════════════════════
     28)
-      local verbose_default_flag="--defaultno"
-      [[ "$_verbose" == "yes" ]] && verbose_default_flag=""
-
-      if whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
-        --title "VERBOSE MODE" \
-        $verbose_default_flag \
-        --yesno "\nEnable Verbose Mode?\n\nShows detailed output during installation." 12 58; then
+      # PHS_VERBOSE forces verbose mode and skips the prompt
+      if [[ "$PHS_MODE" == "verbose" ]]; then
         _verbose="yes"
       else
-        _verbose="no"
+        local verbose_default_flag="--defaultno"
+        [[ "$_verbose" == "yes" ]] && verbose_default_flag=""
+
+        if whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
+          --title "VERBOSE MODE" \
+          $verbose_default_flag \
+          --yesno "\nEnable Verbose Mode?\n\nShows detailed output during installation." 12 58; then
+          _verbose="yes"
+        else
+          _verbose="no"
+        fi
       fi
       # Build summary
       local ct_type_desc="Unprivileged"
@@ -3444,7 +3449,7 @@ configure_ssh_settings() {
 # msg_menu()
 #
 # - Displays a numbered menu for update_script() functions
-# - In silent mode (PHS_SILENT=1): auto-selects the default option
+# - In silent mode (PHS_MODE=silent): auto-selects the default option
 # - In interactive mode: shows menu via read with 10s timeout + default fallback
 # - Usage: CHOICE=$(msg_menu "Title" "tag1" "Description 1" "tag2" "Desc 2" ...)
 # - The first item is always the default
@@ -3468,7 +3473,7 @@ msg_menu() {
   local count=${#tags[@]}
 
   # Silent mode: return default immediately
-  if [[ -n "${PHS_SILENT+x}" ]] && [[ "${PHS_SILENT}" == "1" ]]; then
+  if [[ "$PHS_MODE" == "silent" ]]; then
     echo "$default_tag"
     return 0
   fi
@@ -3504,6 +3509,34 @@ msg_menu() {
   return 0
 }
 
+# ------------------------------------------------------------------------------
+# resolve_phs_mode()
+#
+# - Resolves PHS_SILENT/PHS_VERBOSE env vars into a single PHS_MODE enum
+# - Values: "silent", "verbose", "interactive"
+# - If both PHS_SILENT=1 and PHS_VERBOSE=1, shows a conflict warning
+#   and defaults to "interactive"
+# - Should be called once early, before any mode-dependent logic
+# ------------------------------------------------------------------------------
+resolve_phs_mode() {
+  if [[ -n "${PHS_SILENT+x}" ]] && [[ "${PHS_SILENT}" == "1" ]] && [[ -n "${PHS_VERBOSE+x}" ]] && [[ "${PHS_VERBOSE}" == "1" ]]; then
+    # Conflict handling must never block unattended/non-TTY updates.
+    # Prefer silent mode to keep automation safe.
+    if [[ -t 0 ]] && [[ -t 1 ]] && command -v whiptail >/dev/null 2>&1; then
+      whiptail --backtitle "Proxmox VE Helper Scripts" \
+        --title "Configuration Conflict Warning" \
+        --msgbox "PHS_SILENT and PHS_VERBOSE are both set.\n\nFalling back to silent mode." 10 58 || true
+    fi
+    PHS_MODE="silent"
+  elif [[ -n "${PHS_SILENT+x}" ]] && [[ "${PHS_SILENT}" == "1" ]]; then
+    PHS_MODE="silent"
+  elif [[ -n "${PHS_VERBOSE+x}" ]] && [[ "${PHS_VERBOSE}" == "1" ]]; then
+    PHS_MODE="verbose"
+  else
+    PHS_MODE="interactive"
+  fi
+}
+
 # ------------------------------------------------------------------------------
 # start()
 #
@@ -3514,17 +3547,16 @@ msg_menu() {
 # ------------------------------------------------------------------------------
 start() {
   source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/tools.func)
+  resolve_phs_mode
   if command -v pveversion >/dev/null 2>&1; then
     install_script || return 0
     return 0
-  elif [ ! -z ${PHS_SILENT+x} ] && [[ "${PHS_SILENT}" == "1" ]]; then
+  elif [[ "$PHS_MODE" == "silent" ]]; then
     VERBOSE="no"
     set_std_mode
-    ensure_profile_loaded
-    get_lxc_ip
-    update_script
-    update_motd_ip
-    cleanup_lxc
+  elif [[ "$PHS_MODE" == "verbose" ]]; then
+    VERBOSE="yes"
+    set_std_mode
   else
     CHOICE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "${APP} LXC Update/Setting" --menu \
       "Support/Update functions for ${APP} LXC. Choose an option:" \
@@ -3548,12 +3580,12 @@ start() {
       exit 0
       ;;
     esac
-    ensure_profile_loaded
-    get_lxc_ip
-    update_script
-    update_motd_ip
-    cleanup_lxc
   fi
+  ensure_profile_loaded
+  get_lxc_ip
+  update_script
+  update_motd_ip
+  cleanup_lxc
 }
 
 # ==============================================================================
@@ -5376,59 +5408,13 @@ create_lxc_container() {
 
   # Offer upgrade for pve-container/lxc-pve if candidate > installed; optional auto-retry pct create
   # Returns:
-  #   0 = no upgrade needed / container created after upgrade or explicit fallback
+  #   0 = no upgrade needed / container created after upgrade or fallback
   #   1 = upgraded (and if do_retry=yes and retry succeeded, creation done)
-  #   2 = user chose ignore
+  #   2 = user declined
   #   3 = upgrade attempted but failed OR retry failed
-  #   4 = user cancelled
   offer_lxc_stack_upgrade_and_maybe_retry() {
     local do_retry="${1:-no}" # yes|no
     local _pvec_i _pvec_c _lxcp_i _lxcp_c need=0
-    local _ans
-
-    has_previous_os_version_template() {
-      local os_type="${PCT_OSTYPE:-}"
-      local current_ver="${PCT_OSVERSION:-}"
-      local tpl_pattern="${TEMPLATE_PATTERN:-${TEMPLATE:-}}"
-      local -a all_versions=()
-
-      [[ -n "$os_type" && -n "$current_ver" ]] || return 1
-
-      mapfile -t _local_vers < <(
-        pveam list "$TEMPLATE_STORAGE" 2>/dev/null |
-          awk '{print $1}' |
-          sed 's|.*/||' |
-          grep -E "^${os_type}-[0-9]" |
-          { [[ -n "$tpl_pattern" ]] && grep "$tpl_pattern" || cat; } |
-          sed -E "s/^${os_type}-([0-9]+(\.[0-9]+)?).*/\1/" |
-          sort -u -V
-      )
-      all_versions+=("${_local_vers[@]}")
-
-      if command -v timeout &>/dev/null; then
-        timeout 30 pveam update >/dev/null 2>&1 || true
-      else
-        pveam update >/dev/null 2>&1 || true
-      fi
-      mapfile -t _online_vers < <(
-        pveam available -section system 2>/dev/null |
-          awk '{print $2}' |
-          grep -E "^${os_type}-[0-9]" |
-          { [[ -n "$tpl_pattern" ]] && grep "$tpl_pattern" || cat; } |
-          sed -E "s/^${os_type}-([0-9]+(\.[0-9]+)?).*/\1/" |
-          sort -u -V 2>/dev/null || true
-      )
-      all_versions+=("${_online_vers[@]}")
-
-      printf '%s\n' "${all_versions[@]}" | sort -u -V | awk -v cur="$current_ver" '
-        {
-          split($0, a, ".")
-          split(cur, b, ".")
-          if (a[1]+0 < b[1]+0) found=1
-        }
-        END { exit found ? 0 : 1 }
-      '
-    }
 
     _pvec_i="$(pkg_ver pve-container)"
     _lxcp_i="$(pkg_ver lxc-pve)"
@@ -5449,25 +5435,19 @@ create_lxc_container() {
     msg_warn "An update for the Proxmox LXC stack is available"
     echo "  pve-container: installed=${_pvec_i:-n/a}  candidate=${_pvec_c:-n/a}"
     echo "  lxc-pve     : installed=${_lxcp_i:-n/a}  candidate=${_lxcp_c:-n/a}"
-    echo "  note        : option 1 runs host apt update + apt upgrade"
     echo
 
     # Offer older OS version fallback when template version might be too new for LXC stack
     local _has_fallback_option=false
-    if [[ "$do_retry" == "yes" ]] && has_previous_os_version_template; then
+    if [[ -n "${PCT_OSTYPE:-}" && -n "${PCT_OSVERSION:-}" ]]; then
       _has_fallback_option=true
-      echo "  [1] Run host upgrade now (recommended). WARNING: this runs apt upgrade and updates all Packeages on your host!"
+      echo "  [1] Upgrade LXC stack now (recommended)"
       echo "  [2] Use an older ${PCT_OSTYPE} template instead (may not work with all scripts)"
-      echo "  [3] Ignore"
-      echo "  [4] Cancel"
-      echo
-      read -rp "Select option [1/2/3/4]: " _ans </dev/tty
-    else
-      echo "  [1] Run host upgrade now (recommended). WARNING: this runs apt upgrade and updates all Packeages on your host!"
-      echo "  [2] Ignore"
       echo "  [3] Cancel"
       echo
       read -rp "Select option [1/2/3]: " _ans </dev/tty
+    else
+      read -rp "Do you want to upgrade now? [y/N] " _ans </dev/tty
     fi
 
     if [[ "$_has_fallback_option" == true ]]; then
@@ -5476,48 +5456,35 @@ create_lxc_container() {
         _ans="y"
         ;;
       2)
-        if fallback_to_previous_os_version; then
-          return 0
+        if [[ "$do_retry" == "yes" ]]; then
+          if fallback_to_previous_os_version; then
+            return 0
+          else
+            return 3
+          fi
         else
-          return 3
+          msg_custom "ℹ️" "${YW}" "OS version fallback is only available during container creation."
+          return 2
         fi
         ;;
-      3)
-        return 2
-        ;;
-      4)
-        return 4
-        ;;
       *)
-        return 4
-        ;;
-      esac
-    else
-      case "$_ans" in
-      1)
-        _ans="y"
-        ;;
-      2)
         return 2
         ;;
-      *)
-        return 4
-        ;;
       esac
     fi
 
     case "${_ans,,}" in
     y | yes)
-      msg_info "Running host upgrade for LXC stack compatibility"
+      msg_info "Upgrading Proxmox LXC stack (pve-container, lxc-pve)"
       apt_update_safe
-      if $STD apt-get upgrade -y; then
+      if $STD apt-get install -y --only-upgrade pve-container lxc-pve; then
         msg_ok "LXC stack upgraded."
         # Verify pct binary still works after upgrade (partial upgrades can break Perl modules)
         if ! pct list &>/dev/null; then
           msg_error "LXC stack upgrade caused PVE tool breakage (likely Perl module incompatibility)."
           msg_custom "⚠️" "${YW}" "A partial package upgrade has left the PVE stack in an inconsistent state."
           msg_custom "🔧" "${YW}" "Please run the following on the Proxmox host, then retry:"
-          echo -e "${TAB}  apt update && apt upgrade -y"
+          echo -e "${TAB}  apt update && apt dist-upgrade -y"
           echo -e "${TAB}  reboot"
           return 3
         fi
@@ -6126,20 +6093,16 @@ create_lxc_container() {
               rc=$?
               case $rc in
               0) : ;; # success - container created, continue
-              2)
-                msg_error "LXC stack upgrade ignored. Please inspect: $LOGFILE"
-                _flush_pct_log
-                exit 231
-                ;;
-              3)
-                msg_error "LXC stack upgrade failed. Please inspect: $LOGFILE"
-                _flush_pct_log
-                exit 231
-                ;;
-              4)
-                msg_error "Cancelled by user."
-                _flush_pct_log
-                exit 231
+              2 | 3)
+                # Upgrade declined or failed — try older OS version as last resort
+                msg_warn "Attempting older ${PCT_OSTYPE:-} version as last resort"
+                if fallback_to_previous_os_version; then
+                  : # success
+                else
+                  msg_error "All recovery options exhausted. Please inspect: $LOGFILE"
+                  _flush_pct_log
+                  exit 231
+                fi
                 ;;
               esac
             else
@@ -6163,20 +6126,16 @@ create_lxc_container() {
             rc=$?
             case $rc in
             0) : ;; # success - container created, continue
-            2)
-              msg_error "LXC stack upgrade ignored. Please inspect: $LOGFILE"
-              _flush_pct_log
-              exit 231
-              ;;
-            3)
-              msg_error "LXC stack upgrade failed. Please inspect: $LOGFILE"
-              _flush_pct_log
-              exit 231
-              ;;
-            4)
-              msg_error "Cancelled by user."
-              _flush_pct_log
-              exit 231
+            2 | 3)
+              # Upgrade declined or failed — try older OS version as last resort
+              msg_warn "Attempting older ${PCT_OSTYPE:-} version as last resort"
+              if fallback_to_previous_os_version; then
+                : # success
+              else
+                msg_error "All recovery options exhausted. Please inspect: $LOGFILE"
+                _flush_pct_log
+                exit 231
+              fi
               ;;
             esac
           else

misc/core.func

@@ -940,7 +940,7 @@ is_verbose_mode() {
 #
 # - Detects if script is running in unattended/non-interactive mode
 # - Checks MODE variable first (primary method)
-# - Falls back to legacy flags (PHS_SILENT, var_unattended)
+# - Falls back to legacy flags (PHS_MODE, var_unattended)
 # - Returns 0 (true) if unattended, 1 (false) otherwise
 # - Used by prompt functions to auto-apply defaults
 #
@@ -984,7 +984,7 @@ is_unattended() {
   esac
 
   # Legacy fallbacks for compatibility
-  [[ "${PHS_SILENT:-0}" == "1" ]] && return 0
+  [[ "${PHS_MODE:-}" == "silent" ]] && return 0
   [[ "${var_unattended:-}" =~ ^(yes|true|1)$ ]] && return 0
   [[ "${UNATTENDED:-}" =~ ^(yes|true|1)$ ]] && return 0
 

misc/error_handler.func

@@ -313,51 +313,6 @@ error_handler() {
     echo -e "${TAB}-----------------------------------\n"
   fi
 
-  # Detect probable Node.js heap OOM and print actionable guidance.
-  # This avoids generic SIGABRT/SIGKILL confusion for frontend build failures.
-  local node_oom_detected="false"
-  local node_build_context="false"
-  if [[ "$command" =~ (npm|pnpm|yarn|node|vite|turbo) ]]; then
-    node_build_context="true"
-  fi
-  if [[ "$exit_code" == "243" ]]; then
-    node_oom_detected="true"
-  elif [[ -n "$active_log" && -s "$active_log" ]]; then
-    if tail -n 200 "$active_log" 2>/dev/null | grep -Eqi 'Reached heap limit|JavaScript heap out of memory|Allocation failed - JavaScript heap out of memory|FATAL ERROR: Reached heap limit'; then
-      node_oom_detected="true"
-    fi
-  fi
-
-  if [[ "$node_oom_detected" == "true" ]] || { [[ "$node_build_context" == "true" ]] && [[ "$exit_code" =~ ^(134|137)$ ]]; }; then
-    local heap_hint_mb=""
-
-    # If explicitly configured, prefer the current value for troubleshooting output.
-    if [[ -n "${NODE_OPTIONS:-}" ]] && [[ "${NODE_OPTIONS}" =~ max-old-space-size=([0-9]+) ]]; then
-      heap_hint_mb="${BASH_REMATCH[1]}"
-    elif [[ -n "${var_ram:-}" ]] && [[ "${var_ram}" =~ ^[0-9]+$ ]]; then
-      heap_hint_mb=$((var_ram * 75 / 100))
-    else
-      local mem_kb=""
-      mem_kb=$(awk '/^MemTotal:/ {print $2; exit}' /proc/meminfo 2>/dev/null || echo "")
-      if [[ "$mem_kb" =~ ^[0-9]+$ ]]; then
-        local mem_mb=$((mem_kb / 1024))
-        heap_hint_mb=$((mem_mb * 75 / 100))
-      fi
-    fi
-
-    if [[ -z "$heap_hint_mb" ]] || ((heap_hint_mb < 1024)); then
-      heap_hint_mb=1024
-    elif ((heap_hint_mb > 12288)); then
-      heap_hint_mb=12288
-    fi
-
-    if declare -f msg_warn >/dev/null 2>&1; then
-      msg_warn "Possible Node.js heap OOM. Try: export NODE_OPTIONS=\"--max-old-space-size=${heap_hint_mb}\" and rerun the build."
-    else
-      echo -e "${YW}Possible Node.js heap OOM. Try: export NODE_OPTIONS=\"--max-old-space-size=${heap_hint_mb}\" and rerun the build.${CL}"
-    fi
-  fi
-
   # Detect context: Container (INSTALL_LOG set + inside container /root) vs Host
   if [[ -n "${INSTALL_LOG:-}" && -f "${INSTALL_LOG:-}" && -d /root ]]; then
     # CONTAINER CONTEXT: Copy log and create flag file for host

misc/tools.func

@@ -6336,15 +6336,12 @@ function setup_nodejs() {
     }
   fi
 
-  # Scenario 1: Already installed at target version - upgrade to latest minor/patch + update packages/modules
+  # Scenario 1: Already installed at target version - just update packages/modules
   if [[ -n "$CURRENT_NODE_VERSION" && "$CURRENT_NODE_VERSION" == "$NODE_VERSION" ]]; then
     msg_info "Update Node.js $NODE_VERSION"
 
     ensure_apt_working || return 100
 
-    # Upgrade to the latest minor/patch release from NodeSource
-    $STD apt-get install -y --only-upgrade nodejs 2>/dev/null || true
-
     # Pin npm to 11.11.0 to work around Node.js 22.22.2 regression (nodejs/node#62425)
     $STD npm install -g npm@11.11.0 2>/dev/null || true
 
@@ -6423,37 +6420,7 @@ function setup_nodejs() {
     msg_ok "Setup Node.js $NODE_VERSION"
   fi
 
-  # Set a safe default heap limit for Node.js builds if not explicitly provided.
-  # Priority:
-  #   1) NODE_OPTIONS (caller/user override)
-  #   2) NODE_MAX_OLD_SPACE_SIZE (explicit MB override)
-  #   3) var_ram (LXC memory setting, MB)
-  #   4) /proc/meminfo (runtime memory detection)
-  # Auto value is clamped to 1024..12288 MB.
-  if [[ -z "${NODE_OPTIONS:-}" ]]; then
-    local node_heap_mb=""
-
-    if [[ -n "${NODE_MAX_OLD_SPACE_SIZE:-}" ]] && [[ "${NODE_MAX_OLD_SPACE_SIZE}" =~ ^[0-9]+$ ]]; then
-      node_heap_mb="${NODE_MAX_OLD_SPACE_SIZE}"
-    elif [[ -n "${var_ram:-}" ]] && [[ "${var_ram}" =~ ^[0-9]+$ ]]; then
-      node_heap_mb=$((var_ram * 75 / 100))
-    else
-      local total_mem_kb=""
-      total_mem_kb=$(awk '/^MemTotal:/ {print $2; exit}' /proc/meminfo 2>/dev/null || echo "")
-      if [[ "$total_mem_kb" =~ ^[0-9]+$ ]]; then
-        local total_mem_mb=$((total_mem_kb / 1024))
-        node_heap_mb=$((total_mem_mb * 75 / 100))
-      fi
-    fi
-
-    if [[ -z "$node_heap_mb" ]] || ((node_heap_mb < 1024)); then
-      node_heap_mb=1024
-    elif ((node_heap_mb > 12288)); then
-      node_heap_mb=12288
-    fi
-
-    export NODE_OPTIONS="--max-old-space-size=${node_heap_mb}"
-  fi
+  export NODE_OPTIONS="--max-old-space-size=4096"
 
   # Ensure valid working directory for npm (avoids uv_cwd error)
   if [[ ! -d /opt ]]; then