fix update

update

@@ -23,18 +23,28 @@ print_logo
 COREDESKTOP="$HOME/.local/share/coredesktop"
 
 echo "Updating CoreDesktop..."
-git -C "$COREDESKTOP" pull
+if [[ -z "$UPDATE_REEXECED" ]] && ! git -C "$COREDESKTOP" pull; then
+    echo "WARNING: could not pull the latest CoreDesktop; running the update hooks already on disk."
+    export UPDATE_PULL_FAILED=1
+fi
 mkdir -p "$COREDESKTOP/updates.d"
-sudo cp "$COREDESKTOP/update" ~/.local/bin/update
-sudo cp "$COREDESKTOP/refresh" ~/.local/bin/refresh
+# --remove-destination replaces copies left root-owned by older versions of this script
+cp --remove-destination "$COREDESKTOP/update" ~/.local/bin/update
+cp --remove-destination "$COREDESKTOP/refresh" ~/.local/bin/refresh
 
 if [[ -z "$UPDATE_REEXECED" ]]; then
     export UPDATE_REEXECED=1
     exec ~/.local/bin/update
 fi
 
+FAILED=()
+[[ -n "$UPDATE_PULL_FAILED" ]] && FAILED+=("git pull")
+
+# Each hook runs in its own subshell so a cd, set -e, exit, or stray variable
+# in one hook can't leak into or abort the hooks after it.
 for plugin in "$COREDESKTOP/updates.d/"*.sh; do
-    if [ -f "$plugin" ]; then
+    [ -f "$plugin" ] || continue
+    (
         unset -f is_installed run_update
         source "$plugin"
         if declare -f run_update > /dev/null; then
@@ -42,7 +52,14 @@ for plugin in "$COREDESKTOP/updates.d/"*.sh; do
                 run_update
             fi
         fi
-    fi
+    )
+    # Checked separately: under `( ... ) ||`, bash would ignore set -e inside the hook
+    [ $? -eq 0 ] || FAILED+=("$(basename "$plugin")")
 done
 
+if (( ${#FAILED[@]} > 0 )); then
+    echo "Done, with errors in: ${FAILED[*]}"
+    exit 1
+fi
+
 echo "Done."