From 0922b752a582fbcabaa8ece8ff648cedb13c0116 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Christopher=20M=C3=BChl?= <toki@toph.so>
Date: Fri, 10 Apr 2026 09:27:39 +0000
Subject: [PATCH] fix(04): WR-02 add stride-3 guard and safe arithmetic in
 dry-run ENV_ARGS loop

---
 claudebox.sh | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/claudebox.sh b/claudebox.sh
index 24083d1..5897f90 100644
--- a/claudebox.sh
+++ b/claudebox.sh
@@ -307,10 +307,15 @@ if [[ "$DRY_RUN" == true ]]; then
   {
     echo "bwrap \\"
     echo "  --clearenv \\"
+    # Guard: ENV_ARGS must be a multiple of 3 (--setenv NAME VALUE triplets)
+    if (( ${#ENV_ARGS[@]} % 3 != 0 )); then
+      echo "BUG: ENV_ARGS length ${#ENV_ARGS[@]} is not a multiple of 3" >&2
+      exit 1
+    fi
     dry_run_i=0
     while (( dry_run_i < ${#ENV_ARGS[@]} )); do
       printf '  %s %s %q \\\n' "${ENV_ARGS[$dry_run_i]}" "${ENV_ARGS[$((dry_run_i+1))]}" "${ENV_ARGS[$((dry_run_i+2))]}"
-      (( dry_run_i += 3 ))
+      dry_run_i=$(( dry_run_i + 3 ))
     done
     echo "  --tmpfs / \\"
     echo "  --proc /proc \\"