From e09e4b62ee37b305f155747ebb8ad0b30a748b94 Mon Sep 17 00:00:00 2001
From: claude-hdb <claude-hdb@users.noreply.github.com>
Date: Tue, 14 Jul 2026 19:10:48 +0000
Subject: [PATCH] =?UTF-8?q?fix:=20assert=20the=20install=20landed=20the=20?=
 =?UTF-8?q?ref=20we=20asked=20for=20=E2=80=94=20a=20silent=20wrong-install?=
 =?UTF-8?q?=20is=20worse=20than=20a=20failure?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 0.5.0 env-var rename (CLAUDEBOX_* -> BOX_*) created a silent trap:
a STALE local drill.sh passes CLAUDEBOX_REPO/REF, today's install.sh
reads BOX_REPO/REF, the vars are ignored, main gets installed — and the
drill runs to a green summary having drilled the wrong tree entirely.
The same class already cost an hour once via a lagged CDN tarball.

install.sh now records what it installed (/INSTALLED_FROM), and the
drill ASSERTS it matches the requested repo@ref before touching the
host — failing loudly, and naming the stale-checkout cause, instead of
drilling a lie.
---
 drill/drill.sh | 17 +++++++++++++++++
 install.sh     |  8 +++++++-
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/drill/drill.sh b/drill/drill.sh
index 7e67661..4b227c5 100755
--- a/drill/drill.sh
+++ b/drill/drill.sh
@@ -175,6 +175,23 @@ EOF
     || { echo "install failed"; exit 1; }
   export PATH="$HOME/.local/bin:$PATH"
 
+  # ASSERT WHAT LANDED — never trust that the install obeyed us.
+  # This has bitten twice: once on a lagged CDN tarball, once when a STALE local
+  # drill.sh passed the retired CLAUDEBOX_* env vars to a 0.5.0 install.sh that
+  # reads BOX_* — the vars were ignored, main was installed, and the run drilled
+  # the wrong tree while reporting success. A drill that silently drills the
+  # wrong code is worse than one that fails.
+  got="$(cat "$HOME/.local/share/box/INSTALLED_FROM" 2>/dev/null || echo '<unknown>')"
+  if [ "$got" != "$REPO@$REF" ]; then
+    echo "drill: FATAL — asked to install $REPO@$REF, but the tree says '$got'." >&2
+    echo "  Your local drill.sh is probably STALE (pre-0.5.0 it passed CLAUDEBOX_*," >&2
+    echo "  which today's install.sh ignores, so it fell back to main). Fix:" >&2
+    echo "    git fetch origin && git checkout <the branch you mean> && git pull" >&2
+    echo "  then re-run this drill." >&2
+    exit 1
+  fi
+  inf "installed tree confirms: $got"
+
   phase "Host setup (Incus, boxnet, ACL, profile, firewall)"
   # setup-host.sh installs nftables itself when neither nft nor UFW exists
   # (a stock Debian 13 cloud image ships neither). This guard is a tripwire:
diff --git a/install.sh b/install.sh
index c4c770c..99b42e6 100755
--- a/install.sh
+++ b/install.sh
@@ -85,4 +85,10 @@ if ! command -v incus >/dev/null 2>&1; then
   warn "  run the one-time host setup: $DEST/host/setup-host.sh"
 fi
 
-log "done — try: box new --name test"
+# Record WHAT was installed, so a caller can assert it got what it asked for.
+# Without this, an installer invoked with stale env vars (the CLAUDEBOX_* names
+# retired in 0.5.0) silently falls back to the defaults and installs main —
+# and the caller drills the wrong tree, believing it drilled its branch.
+printf '%s@%s\n' "$REPO" "$REF" > "$DEST/INSTALLED_FROM"
+
+log "done ($REPO@$REF) — try: box new --name test"