Check the single root/sudo argv body rather than the obsolete duplicated command spelling. Retain credential-file, scope and cleanup assertions, and record fixed-field signal delivery and terminal facts to distinguish the observed BusyBox hangup from a missed fixture signal. Runtime commands are unchanged; the original hangup remains adverse until executed cause and cleanup evidence settle it.
Contract-Neutral: Test-only privilege dispatch assertions and bounded signal observations; no producer, API, trust or credential contract change.
Change-source: pulse-maintainer
Record the actual privileged Bash reader from the selected tool and send HUP/TERM to it while retaining the controlling terminal. Whole-session termination cannot supply the same restoration observation. Keep the adverse whole-group result, full mode/privacy assertions and every caller control.
Change-source: pulse-maintainer
Mirror the qualified Unix reader in setup, Proxmox and container producers: select one terminal tool, distinguish missing terminal/tool/mode failures, restore its complete state before installation and on cleanup, and retain silent overflow draining. Emit the isolated privileged body once without changing tokens, trust, scopes, profiles or state. Cover serialized contracts and actual consumer payloads.
Change-source: pulse-maintainer
Cover setup, Proxmox and container callers with a real PTY, isolated standalone and BusyBox tool selection, distinct fail-closed modes, private root/sudo history and one bounded command body. These controls expose the unchanged backend reader before its repair.
Change-source: pulse-maintainer
Readline itself disables terminal echo while editing, so echo-off is not enough to distinguish a streamed copied-command prompt literal. Require a control-byte marker emitted only after parsing the complete line, and split the existing prompt control at the literal while the line is incomplete. Preserve all real output/history checks and the caller-shell hand-off.
Contract-Neutral: Test protocol only; generated bootstrap and credential, transport, installation and API contracts remain unchanged.
Change-source: pulse-maintainer
The first exact proof retained a deadline in the repeated prompt control. Synchronise the initial shell prompt and the post-installer return instead of queuing exit beside credential input. A modeled installer explicitly rejects speculative shell input while it owns the terminal; history still records the copied command and subsequent exit.
Contract-Neutral: Complete the test-fixture terminal hand-off only; production bootstrap, token authority, transport and installer behaviour are unchanged.
Change-source: pulse-maintainer
A streamed echo of the copied command can end at its prompt literal before the bootstrap runs. Require terminal echo to be disabled before the fixture sends the synthetic credential, and deterministically exercise a matching early prompt while echo is still enabled. Preserve the real credential output, history, argv, complete handoff and terminal-restoration checks.
Contract-Neutral: Test-harness synchronisation only; generated bootstrap, credential scope, transport, installation and response contracts are unchanged.
Change-source: pulse-maintainer
The executable overflow regression and a bounded Bash PTY probe show canonical terminals truncate long input before the size check. Read a bounded character count with echo held off, drain an invalid line before returning to the calling shell, and restore its modes on every exit. Pin maximum-size preservation, overflow history safety and terminal restoration.
Contract-Neutral: Repair bounded private terminal entry, overflow draining and mode restoration; no issuance, scope, install transport or response-shape delta.
Change-source: pulse-maintainer
The root parser's legacy no-token alias accepted a new private-file command beside a legacy download URL. Reject every mixed alias, as the existing coherent-transport contract requires. Preserve backup-permission URL bindings. Align older secret-in-command and shared type fixtures, and exercise the actual wrong server installer parser.
Contract-Neutral: Enforce the already-declared coherent bootstrap transports and correct verification fixtures; no API, scope or documented behaviour delta.
Change-source: pulse-maintainer
Separate PVE/PBS setup and telemetry credentials from shell source and download URLs. Use silent root/sudo input, private-file handoff, complete downloads and the agent preflight; preserve scope, TLS defaults, single-line paste and coherent rolling-upgrade metadata. Reveal tokens through the existing dialog and discard late issuance after close. Pin executable shell, history, TLS/registration and browser contracts without using real credentials.
Change-source: pulse-maintainer
pulse-triage[bot]