From 3fb4b0456ae421ab0e5ce8a9488fcd9116eba468 Mon Sep 17 00:00:00 2001
From: "pulse-triage[bot]"
 <249995291+pulse-triage[bot]@users.noreply.github.com>
Date: Thu, 1 Oct 2026 07:33:32 +0100
Subject: [PATCH] Correct private-bootstrap renderer and URL assertions

Require the exact shared artifact command, stdin PVE authorization and correctly delimited normalized URL instead of legacy pipe/header forms or an over-broad path substring. These corrections retain installer, ACL and transport assertions; no runtime change.

Change-source: pulse-maintainer
---
 internal/api/agent_install_command_shared_test.go | 5 +++--
 internal/api/contract_test.go                     | 3 ++-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/internal/api/agent_install_command_shared_test.go b/internal/api/agent_install_command_shared_test.go
index 06a15f61c..5be1d5418 100644
--- a/internal/api/agent_install_command_shared_test.go
+++ b/internal/api/agent_install_command_shared_test.go
@@ -182,7 +182,8 @@ func TestBuildProxmoxAgentInstallCommand_NormalizesTrailingSlashes(t *testing.T)
 	require.Contains(t, command, "https://pulse.example.com/base")
 	require.Contains(t, command, `--token-file "$token_file"`)
 	require.NotContains(t, command, "//install.sh")
-	require.NotContains(t, command, "https://pulse.example.com/base/")
+	require.Contains(t, command, "--url "+posixShellQuote("https://pulse.example.com/base"))
+	require.NotContains(t, command, posixShellQuote("https://pulse.example.com/base/"))
 }
 
 func TestBuildProxmoxAgentInstallCommand_IncludesCommandsWhenRequested(t *testing.T) {
@@ -332,7 +333,7 @@ fi`,
 	})
 
 	require.Contains(t, script, `SETUP_SCRIPT_URL="https://pulse.example/api/setup-script?backup_perms=true&host=https%3A%2F%2Fpve1.local%3A8006&pulse_url=https%3A%2F%2Fpulse.example&type=pve"`)
-	require.Contains(t, script, `PULSE_BOOTSTRAP_COMMAND_WITH_ENV='curl -fsSL '"'"'https://pulse.example/api/setup-script?backup_perms=true&host=https%3A%2F%2Fpve1.local%3A8006&pulse_url=https%3A%2F%2Fpulse.example&type=pve'"'"' | `)
+	require.Contains(t, script, "PULSE_BOOTSTRAP_COMMAND_WITH_ENV="+posixShellQuote(artifact.CommandWithEnv))
 	require.Contains(t, script, `PULSE_SETUP_TOKEN="${PULSE_SETUP_TOKEN:-setup-token-123}"`)
 	require.Contains(t, script, `pveum aclmod /storage -user pulse-monitor@pve -role PVEDatastoreAdmin`)
 	require.Contains(t, script, `pveum aclmod /storage -token "$PULSE_TOKEN_ID" -role PVEDatastoreAdmin`)
diff --git a/internal/api/contract_test.go b/internal/api/contract_test.go
index abc064b29..e0b98e9c2 100644
--- a/internal/api/contract_test.go
+++ b/internal/api/contract_test.go
@@ -1504,7 +1504,8 @@ fi`
 		`pveum aclmod /storage -user pulse-monitor@pve -role PVEDatastoreAdmin`,
 		`pveum aclmod /storage -token "$PULSE_TOKEN_ID" -role PVEDatastoreAdmin`,
 		`smoke_test_pve_token() {`,
-		`Authorization: PVEAPIToken=$PULSE_TOKEN_ID=$TOKEN_VALUE`,
+		`printf 'Authorization: PVEAPIToken=%s=%s\n' "$PULSE_TOKEN_ID" "$TOKEN_VALUE" | curl`,
+		`-H @-`,
 		`${HOST_URL%/}/api2/json/nodes`,
 		`if smoke_test_pve_token; then`,
 	} {