update pulse installer

inc/deploy-pulse-lxc.sh

@@ -491,6 +491,76 @@ raise SystemExit(0 if success is True else 1)
 	unset generated_password generated_api_token
 }
 
+TAPM_PULSE_NORMALIZE_V611_SETUP_ARTIFACT() {
+	local response="$1"
+	local pulse_url="$2"
+	local expected_host="${3:-}"
+
+	PULSE_SETUP_RESPONSE="$response" \
+	PULSE_SETUP_URL="$pulse_url" \
+	PULSE_SETUP_HOST="$expected_host" \
+		python3 -c '
+import json
+import os
+import re
+import sys
+import time
+from urllib.parse import quote
+
+try:
+    data = json.loads(os.environ["PULSE_SETUP_RESPONSE"])
+except (TypeError, ValueError):
+    raise SystemExit("Pulse returned invalid setup-token JSON")
+
+token = str(data.get("setupToken", "")).strip()
+returned_host = str(data.get("host", "")).strip()
+host = os.environ["PULSE_SETUP_HOST"].strip() or returned_host
+expires = data.get("expires", 0)
+if not re.fullmatch(r"[0-9a-fA-F]{32,128}", token):
+    raise SystemExit("Pulse returned no valid setup token")
+if data.get("type") != "pve" or not returned_host or not host:
+    raise SystemExit("Pulse returned an invalid PVE setup artifact")
+try:
+    if int(expires) <= int(time.time()):
+        raise SystemExit("Pulse returned an expired setup token")
+except (TypeError, ValueError):
+    raise SystemExit("Pulse returned an invalid setup-token expiry")
+
+pulse_url = os.environ["PULSE_SETUP_URL"].rstrip("/")
+empty = ""
+expected_url = (
+    f"{pulse_url}/api/setup-script?"
+    f"host={quote(host, safe=empty)}&"
+    f"pulse_url={quote(pulse_url, safe=empty)}&type=pve"
+)
+expected_download_url = (
+    f"{pulse_url}/api/setup-script?"
+    f"host={quote(host, safe=empty)}&"
+    f"pulse_url={quote(pulse_url, safe=empty)}&"
+    f"setup_token={quote(token, safe=empty)}&type=pve"
+)
+
+# Pulse v6.1.1 rejects its own valid artifact if the server selected a
+# different public base URL or included an optional query parameter. These
+# presentation fields are not executed by auto_register_pve_node; align them
+# with the helper contract while preserving the server-issued token.
+old_url = str(data.get("url", ""))
+if not old_url:
+    raise SystemExit("Pulse returned no setup-script URL")
+for field in ("command", "commandWithEnv", "commandWithoutEnv"):
+    value = str(data.get(field, ""))
+    if not value or old_url not in value:
+        raise SystemExit(f"Pulse returned an invalid {field} field")
+    data[field] = value.replace(old_url, expected_url)
+
+data["url"] = expected_url
+data["downloadURL"] = expected_download_url
+data["host"] = host
+data["scriptFileName"] = "pulse-setup-pve.sh"
+json.dump(data, sys.stdout, separators=(",", ":"))
+'
+}
+
 TAPM_PULSE_REGISTER_CLUSTER() {
 	local ctid="$1"
 	local container_ip="$2"
@@ -523,10 +593,15 @@ TAPM_PULSE_REGISTER_CLUSTER() {
 		# the primary token only to that request; never send it to Proxmox.
 		curl() {
 			local curl_argument
+			local setup_response
 
 			for curl_argument in "$@"; do
 				if [[ "$curl_argument" == "${pulse_url}/api/setup-script-url" ]]; then
-					command curl --config "$curl_config" "$@"
+					setup_response="$(command curl --config "$curl_config" "$@")" ||
+						return 1
+					TAPM_PULSE_NORMALIZE_V611_SETUP_ARTIFACT \
+						"$setup_response" "$pulse_url" \
+						"${normalized_host_url:-}"
 					return
 				fi
 			done