From f121cd8a065f4174adab69b8ccc056b0c41748b7 Mon Sep 17 00:00:00 2001
From: Brooklyn Nicholson <brooklyn.bb.nicholson@gmail.com>
Date: Tue, 11 Aug 2026 00:41:59 -0500
Subject: [PATCH] fix(update): run hermes update from the install root +
 unbreak fresh repro

The posix orchestrator inherited the Desktop's cwd, and parts of the
update pipeline resolve the tree they mutate from the working directory
-- the sandboxed behind-repro caught it updating the DEVELOPER'S primary
checkout (cwd at spawn time) while reporting success against the
sandbox. cd "$INSTALL_ROOT" before running hermes update, matching the
cwd:updateRoot contract of the deleted in-app path. Verified: rerun
leaves the outside checkout untouched (reflog clean).

repro.sh fresh used a --no-interactive flag install.sh doesn't have;
non-TTY stdin (</dev/null) + --skip-setup is the real non-interactive
contract.
---
 scripts/desktop-update/posix.sh | 5 +++++
 scripts/desktop-update/repro.sh | 4 +++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/scripts/desktop-update/posix.sh b/scripts/desktop-update/posix.sh
index a611626438..c2e2169385 100755
--- a/scripts/desktop-update/posix.sh
+++ b/scripts/desktop-update/posix.sh
@@ -314,6 +314,11 @@ fi
 HERMES_BIN="$INSTALL_ROOT/venv/bin/hermes"
 [ -x "$HERMES_BIN" ] || { FINAL_CODE=3 FINAL_MSG="Update aborted: $HERMES_BIN is missing. The install needs repair (run the Hermes installer or hermes doctor)."; log "$FINAL_MSG"; exit 3; }
 
+# Run FROM the install root: `hermes update` resolves the tree it mutates
+# from the working directory, and we inherit the Desktop's cwd (which can be
+# an unrelated repo — updating THAT instead of the install is the failure
+# the sandbox repro caught). The in-app path always passed cwd:updateRoot.
+cd "$INSTALL_ROOT"
 export PYTHONUNBUFFERED=1
 log "running: hermes update --yes --gateway --branch $BRANCH"
 OUT="$("$HERMES_BIN" update --yes --gateway --branch "$BRANCH" 2>&1)"; CODE=$?
diff --git a/scripts/desktop-update/repro.sh b/scripts/desktop-update/repro.sh
index 1560d98191..114888f135 100755
--- a/scripts/desktop-update/repro.sh
+++ b/scripts/desktop-update/repro.sh
@@ -46,8 +46,10 @@ ensure_sandbox_install() {
   mkdir -p "$SANDBOX"
   # The literal user path: install.sh against a clone of THIS checkout, so
   # the repro reproduces what you're about to ship, not origin/main.
+  # </dev/null = non-TTY stdin, which install.sh treats as non-interactive
+  # (it has no --no-interactive flag); --skip-setup skips the config wizard.
   git clone --quiet "$REPO_ROOT" "$SANDBOX_ROOT"
-  HERMES_HOME="$SANDBOX" bash "$SANDBOX_ROOT/scripts/install.sh" --no-interactive
+  HERMES_HOME="$SANDBOX" bash "$SANDBOX_ROOT/scripts/install.sh" --skip-setup --hermes-home "$SANDBOX" < /dev/null
 }
 
 case "$MODE" in