mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-09-10 02:25:56 +00:00
rcourtman
16f791a656
The install-time auto-register path (auto_register_pve_node) parsed the API token secret out of pveum's box-drawing table output with a fragile awk column-split. The web-setup render path was already hardened to request 'pveum ... --output-format json' first and parse the value field, but this secondary install.sh path was never ported. auto_register_pve_node now requests --output-format json first (falling back to the bare --privsep 1 form only when an older pveum rejects the JSON flag, which keeps the secure-installer contract pin on that form satisfied) and extracts the secret via a new extract_pve_token_value helper: JSON value-field parse first, then a locale-independent box-drawing table fallback (normalizes the column separator to a plain pipe byte-wise before splitting, so it works regardless of host locale). This mirrors the hardened render path and removes the silent-failure / mis-parse risk when pveum table formatting drifts. Functional + contract tests in root_install_sh_test.go; deployment-installability contract documents the deterministic extraction. The host-agent path (internal/hostagent/proxmox_setup.go setupPVEToken) carries an agent-lifecycle token-permission proof obligation and is left for a governed lane.