From 083c73103ce2e42f6cb762441e28b7159b892641 Mon Sep 17 00:00:00 2001
From: "pulse-triage[bot]"
 <249995291+pulse-triage[bot]@users.noreply.github.com>
Date: Thu, 1 Oct 2026 05:51:09 +0100
Subject: [PATCH] Align routed and hosted Proxmox private-input contracts

Keep fresh token issuance, scope, persistence, normalized product and origin checks while requiring the minted credential outside copied shell text. Dynamic executable coverage already pins decoded quoted arguments. No runtime or frontend content changes.

Change-source: pulse-maintainer
---
 internal/api/contract_test.go                     | 10 +++++-----
 internal/api/hosted_agent_install_command_test.go |  4 ++--
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/internal/api/contract_test.go b/internal/api/contract_test.go
index f0ad503610..5625301458 100644
--- a/internal/api/contract_test.go
+++ b/internal/api/contract_test.go
@@ -23275,8 +23275,8 @@ func TestContract_RequestOriginCannotRetargetTokenBearingCommands(t *testing.T)
 				if err := json.Unmarshal(rec.Body.Bytes(), &response); err != nil {
 					t.Fatalf("decode response: %v", err)
 				}
-				if response.Token == "" || !strings.Contains(response.Command, response.Token) {
-					t.Fatalf("fresh token was not carried by install command: %#v", response)
+				if response.Token == "" || strings.Contains(response.Command, response.Token) || !strings.Contains(response.Command, `--token-file "$token_file"`) {
+					t.Fatal("fresh credential must be returned separately and entered privately")
 				}
 				if !strings.Contains(response.Command, tc.wantBaseURL+"/install.sh") ||
 					!strings.Contains(response.Command, "--url "+posixShellQuote(tc.wantBaseURL)) {
@@ -24090,7 +24090,7 @@ func TestContract_HostedInstallerOriginsFailClosedAtRouter(t *testing.T) {
 					if err := json.Unmarshal(rec.Body.Bytes(), &response); err != nil {
 						t.Fatalf("decode install response: %v", err)
 					}
-					if response.Token == "" || !strings.Contains(response.Command, response.Token) || !strings.Contains(response.Command, wantBaseURL+"/install.sh") {
+					if response.Token == "" || strings.Contains(response.Command, response.Token) || !strings.Contains(response.Command, `--token-file "$token_file"`) || !strings.Contains(response.Command, wantBaseURL+"/install.sh") {
 						t.Fatalf("install response did not bind fresh token to configured URL %q: %#v", wantBaseURL, response)
 					}
 					if strings.Contains(response.Command, "attacker") || len(cfg.APITokens) != 2 {
@@ -25075,8 +25075,8 @@ func TestContract_HostedRuntimeAgentInstallCommandCarriesToken(t *testing.T) {
 		if strings.TrimSpace(token) == "" {
 			t.Fatalf("%s: hosted install payload has no token: %s", body, rec.Body.String())
 		}
-		if command, _ := payload["command"].(string); command != "" && !strings.Contains(command, token) {
-			t.Fatalf("%s: install command does not carry the minted token", body)
+		if command, _ := payload["command"].(string); command != "" && (strings.Contains(command, token) || !strings.Contains(command, `--token-file "$token_file"`)) {
+			t.Fatalf("%s: minted credential must be entered privately, not embedded", body)
 		}
 	}
 }
diff --git a/internal/api/hosted_agent_install_command_test.go b/internal/api/hosted_agent_install_command_test.go
index e212d923cf..ce3c24ce33 100644
--- a/internal/api/hosted_agent_install_command_test.go
+++ b/internal/api/hosted_agent_install_command_test.go
@@ -63,7 +63,7 @@ func TestHostedTenantAgentInstallCommand_GeneratesOrgBoundTokenAndCommand(t *tes
 	require.Contains(t, resp.Command, "https://cloud.example.com/install.sh")
 	require.NotContains(t, resp.Command, resp.Token)
 	require.Contains(t, resp.Command, `--token-file "$token_file"`)
-	require.Contains(t, resp.Command, "--proxmox-type "+posixShellQuote("pbs"))
+	require.Contains(t, resp.Command, "--proxmox-type "+strings.ReplaceAll(posixShellQuote("pbs"), "'", `'"'"'`))
 
 	require.Regexp(t, regexp.MustCompile(`^[a-f0-9]{64}$`), resp.Token)
 
@@ -146,7 +146,7 @@ func TestGenerateHostedTenantAgentInstallCommandEnforcesHostedOrgBoundary(t *tes
 	require.NotEmpty(t, result.Token)
 	require.NotEmpty(t, result.TokenID)
 	require.Contains(t, result.Command, "https://acme.cloud.example.com/install.sh")
-	require.Contains(t, result.Command, "--proxmox-type "+posixShellQuote("pbs"))
+	require.Contains(t, result.Command, "--proxmox-type "+strings.ReplaceAll(posixShellQuote("pbs"), "'", `'"'"'`))
 
 	tokens, err := persistence.LoadAPITokens()
 	require.NoError(t, err)