From 8306da62236cf7dbe82b24aeb1139cb6def99728 Mon Sep 17 00:00:00 2001
From: Tai Groot <tai@taigrr.com>
Date: Sat, 28 Feb 2026 07:26:48 +0000
Subject: [PATCH] refactor(apt): build upgrade args directly instead of
 post-hoc insertion

Avoids fragile slice manipulation when injecting --only-upgrade flag.
---
 apt/apt_linux.go | 25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/apt/apt_linux.go b/apt/apt_linux.go
index e7cd8b1..c73b3f2 100644
--- a/apt/apt_linux.go
+++ b/apt/apt_linux.go
@@ -232,18 +232,23 @@ func upgradePackages(ctx context.Context, pkgs []snack.Target, opts ...snack.Opt
 		}
 	}
 	if len(toUpgrade) > 0 {
-		// Use --only-upgrade to ensure we don't install new packages.
-		args := buildArgs("install", toUpgrade, opts...)
-		idx := -1
-		for i, a := range args {
-			if a == "install" {
-				idx = i
-				break
-			}
+		// Build args manually to inject --only-upgrade after the install command.
+		o2 := snack.ApplyOptions(opts...)
+		var args []string
+		if o2.Sudo {
+			args = append(args, "sudo")
 		}
-		if idx >= 0 {
-			args = append(args[:idx+1], append([]string{"--only-upgrade"}, args[idx+1:]...)...)
+		args = append(args, "apt-get", "install", "--only-upgrade")
+		if o2.AssumeYes {
+			args = append(args, "-y")
 		}
+		if o2.DryRun {
+			args = append(args, "--dry-run")
+		}
+		if o2.FromRepo != "" {
+			args = append(args, "-t", o2.FromRepo)
+		}
+		args = append(args, formatTargets(toUpgrade)...)
 		cmd := exec.CommandContext(ctx, args[0], args[1:]...)
 		var stderr bytes.Buffer
 		cmd.Stderr = &stderr