Cutover script: quote shell lines run on the box

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

tools/cutover.sh

@@ -14,6 +14,8 @@ STAMP=$(date -u +%Y%m%d-%H%M%S)
 WORK=${ORBIT_CUTOVER_WORK:-$ROOT/../cutover-$STAMP}
 say() { echo "[$(date +%H:%M:%S)] $*"; }
 box() { $ADB shell run-as $APP "$@"; }
+# A shell line run as the app, quoted so the box's own shell doesn't split it.
+boxsh() { $ADB shell "run-as $APP sh -c '$1'"; }
 
 timeout 15 /opt/android-sdk/platform-tools/adb connect "$HOST" >/dev/null 2>&1 || true
 $ADB get-state >/dev/null || { say "box not reachable: switch wireless debugging on"; exit 1; }
@@ -21,8 +23,8 @@ $ADB get-state >/dev/null || { say "box not reachable: switch wireless debugging
 if [ "$MODE" = restore ]; then
   SNAP=${2:?snapshot dir}; NAME=$(cat "$SNAP/device-copy.txt")
   $ADB shell am force-stop $APP
-  box sh -c "cp -a no_backup/$NAME/. no_backup/schedule/"
-  box sh -c "cd no_backup/schedule && sha256sum $(cd "$SNAP/files" && ls | tr '\n' ' ')" | sort -k2 > "$SNAP/after-restore.sha256"
+  boxsh "cp -a no_backup/$NAME/. no_backup/schedule/"
+  boxsh "cd no_backup/schedule && sha256sum $(cd "$SNAP/files" && ls | tr '\n' ' ')" | sort -k2 > "$SNAP/after-restore.sha256"
   diff <(sort -k2 "$SNAP/manifest.sha256") "$SNAP/after-restore.sha256" && say "restored: every file matches the snapshot"
   $ADB shell am start -n $APP/.MainActivity >/dev/null; exit 0
 fi
@@ -41,18 +43,18 @@ mkdir -p "$WORK/snapshot/files"
 FILES=$(box ls no_backup/schedule)
 for f in $FILES; do $ADB exec-out run-as $APP cat "no_backup/schedule/$f" > "$WORK/snapshot/files/$f"; done
 (cd "$WORK/snapshot/files" && sha256sum * | sort -k2) > "$WORK/snapshot/manifest.sha256"
-box sh -c "cd no_backup/schedule && sha256sum *" | sort -k2 > "$WORK/snapshot/device.sha256"
+boxsh "cd no_backup/schedule && sha256sum *" | sort -k2 > "$WORK/snapshot/device.sha256"
 diff "$WORK/snapshot/manifest.sha256" "$WORK/snapshot/device.sha256" >/dev/null || { say "copy on this machine differs from the box: stopping"; exit 1; }
 NAME=schedule-rollback-$STAMP
 box cp -a no_backup/schedule "no_backup/$NAME"
 echo "$NAME" > "$WORK/snapshot/device-copy.txt"
-box sh -c "cd no_backup/$NAME && sha256sum *" | sort -k2 > "$WORK/snapshot/device-copy.sha256"
+boxsh "cd no_backup/$NAME && sha256sum *" | sort -k2 > "$WORK/snapshot/device-copy.sha256"
 diff "$WORK/snapshot/manifest.sha256" "$WORK/snapshot/device-copy.sha256" >/dev/null || { say "box copy differs: stopping"; exit 1; }
 say "   $(wc -l < "$WORK/snapshot/manifest.sha256") files, checksums match on both copies; box copy kept as no_backup/$NAME"
 
 say "4. rehearsing the restore on identical bytes"
-box sh -c "cp -a no_backup/$NAME/. no_backup/schedule/"
-box sh -c "cd no_backup/schedule && sha256sum *" | sort -k2 > "$WORK/snapshot/rehearsal.sha256"
+boxsh "cp -a no_backup/$NAME/. no_backup/schedule/"
+boxsh "cd no_backup/schedule && sha256sum *" | sort -k2 > "$WORK/snapshot/rehearsal.sha256"
 diff "$WORK/snapshot/manifest.sha256" "$WORK/snapshot/rehearsal.sha256" >/dev/null || { say "rehearsal changed something: stopping"; exit 1; }
 say "   restore rehearsed: every file matches"
 
@@ -74,9 +76,9 @@ fi
 say "6. writing the new schedules and checking them on the box"
 $ADB shell mkdir -p /data/local/tmp/orbit-cutover
 for f in "$WORK"/new/*; do $ADB push "$f" /data/local/tmp/orbit-cutover/ >/dev/null; done
-box sh -c "cp /data/local/tmp/orbit-cutover/* no_backup/schedule/"
+boxsh "cp /data/local/tmp/orbit-cutover/* no_backup/schedule/"
 $ADB shell rm -rf /data/local/tmp/orbit-cutover
-box sh -c "cd no_backup/schedule && sha256sum $(cd "$WORK/new" && ls | tr '\n' ' ')" | sort -k2 > "$WORK/written.sha256"
+boxsh "cd no_backup/schedule && sha256sum $(cd "$WORK/new" && ls | tr '\n' ' ')" | sort -k2 > "$WORK/written.sha256"
 diff "$WORK/new.sha256" "$WORK/written.sha256" >/dev/null || { say "written files differ: restoring the snapshot"; "$0" restore "$WORK/snapshot"; exit 1; }
 say "   every written file matches"