fix(cli): fix nil map panic and SSH command quoting

C1: Add nil check for env.Labels before writing provisioned label
in update --reprovision. Previously panicked when no --label flags
were provided and the cached environment had no labels.

C2: Replace incorrect containsSpace+fmt.Sprintf("%q") quoting with
simple strings.Join. SSH session.Run always passes through the
remote shell, so Go-style quoting was wrong. Document this behavior.

Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>

Author: ArangoGutierrez

cmd/cli/ssh/ssh.go

@@ -20,6 +20,7 @@ import (
 	"fmt"
 	"os"
 	"os/exec"
+	"strings"
 	"time"
 
 	"golang.org/x/crypto/ssh"
@@ -229,27 +230,17 @@ func (m command) runCommand(client *ssh.Client, cmd []string) error {
 	session.Stdout = os.Stdout
 	session.Stderr = os.Stderr
 
-	// Build command string
-	cmdStr := ""
-	for i, c := range cmd {
-		if i > 0 {
-			cmdStr += " "
-		}
-		// Quote arguments with spaces
-		if containsSpace(c) {
-			cmdStr += fmt.Sprintf("%q", c)
-		} else {
-			cmdStr += c
-		}
-	}
+	// SSH remote execution always passes the command through the remote shell,
+	// so we join arguments with spaces. Users who need literal quoting should
+	// wrap arguments in shell quotes themselves (e.g., -- 'echo "hello"').
+	cmdStr := strings.Join(cmd, " ")
 
 	return session.Run(cmdStr)
 }
 
 // runInteractiveSystemSSH uses the system's ssh command for interactive sessions
 // This provides better terminal support (colors, window resize, etc.)
 func (m command) runInteractiveSystemSSH(keyPath, userName, hostUrl string) error {
-	// Build SSH command arguments
 	args := []string{
 		"-i", keyPath,
 		"-o", "StrictHostKeyChecking=no",
@@ -258,20 +249,10 @@ func (m command) runInteractiveSystemSSH(keyPath, userName, hostUrl string) erro
 		fmt.Sprintf("%s@%s", userName, hostUrl),
 	}
 
-	// Execute system SSH
 	cmd := exec.Command("ssh", args...)
 	cmd.Stdin = os.Stdin
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
 
 	return cmd.Run()
 }
-
-func containsSpace(s string) bool {
-	for _, c := range s {
-		if c == ' ' || c == '\t' {
-			return true
-		}
-	}
-	return false
-}

cmd/cli/ssh/ssh_test.go

@@ -134,23 +134,3 @@ func TestGetHostURL_NoProperties(t *testing.T) {
 	}
 }
 
-func TestContainsSpace(t *testing.T) {
-	tests := []struct {
-		input    string
-		expected bool
-	}{
-		{"hello", false},
-		{"hello world", true},
-		{"hello\tworld", true},
-		{"", false},
-		{"nospaces", false},
-		{" leading", true},
-		{"trailing ", true},
-	}
-
-	for _, tt := range tests {
-		if got := containsSpace(tt.input); got != tt.expected {
-			t.Errorf("containsSpace(%q) = %v, want %v", tt.input, got, tt.expected)
-		}
-	}
-}

cmd/cli/update/update.go

@@ -324,6 +324,9 @@ func (m *command) run(instanceID string) error {
 		}
 
 		// Mark as provisioned
+		if env.Labels == nil {
+			env.Labels = make(map[string]string)
+		}
 		env.Labels[instances.InstanceProvisionedLabelKey] = "true"
 		data, err := jyaml.MarshalYAML(env)
 		if err != nil {

cmd/cli/update/update_test.go

@@ -169,3 +169,18 @@ func TestLabelApplication(t *testing.T) {
 		t.Errorf("expected env=test, got %s", env.Labels["env"])
 	}
 }
+
+func TestProvisionedLabel_NilLabelsMap(t *testing.T) {
+	// Regression test for C1: writing to nil Labels map should not panic
+	env := &v1alpha1.Environment{}
+
+	// Simulate what update.go does after provisioning
+	if env.Labels == nil {
+		env.Labels = make(map[string]string)
+	}
+	env.Labels["holodeck-instance-provisioned"] = "true"
+
+	if env.Labels["holodeck-instance-provisioned"] != "true" {
+		t.Error("expected provisioned label to be set")
+	}
+}