K-114: address cross-review findings

- CTID prompt re-prompts on invalid interactive input (was: abort) - env-provided NAMESERVER is validated when non-empty ('' stays inherit) - prompt_validated handles EOF (no infinite loop, clean abort under -e) - 10# base forcing in vlan/cidr/ipv4 arithmetic (leading zeros are not octal errors); is_clean_ascii rejects embedded newline/tab explicitly (command substitution strips trailing newlines); is_ipv4_list checks the whole string before word splitting - nameref guard against reserved variable names in prompt_validated/ require_valid; source-check pattern documented as the repo contract - 8 new test cases (41 total)
K-114: input validation in build.func + mini CI (nexus-hub card)
2026-06-12 03:20:11 +02:00 · 2026-06-12 03:14:32 +02:00
5 changed files with 420 additions and 25 deletions
@@ -0,0 +1,46 @@
+name: CI
+
+# K-114 (nexus-hub): Mini-CI für proxmox-scripts — Syntax, build.func-Source-
+# Pflicht und Validierungs-Unit-Tests. Läuft auf dem nexus-Runner (Host-Mode).
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  lint:
+    name: Shell-Lint (bash -n, source-check, Validierungs-Tests)
+    runs-on: nexus
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: bash -n über alle Scripts
+        run: |
+          status=0
+          for f in ct/*.sh install/*.sh lib/*.func tests/*.sh; do
+            if bash -n "$f"; then
+              echo "ok     $f"
+            else
+              echo "SYNTAX $f" >&2
+              status=1
+            fi
+          done
+          exit "$status"
+
+      - name: build.func-Source-Check (jedes ct/*.sh)
+        run: bash tests/check_ct_source.sh
+
+      - name: Validierungs-Unit-Tests (lib/build.func)
+        run: bash tests/test_validation.sh
+
+      - name: shellcheck (falls auf dem Runner installiert)
+        run: |
+          if command -v shellcheck >/dev/null 2>&1; then
+            # -S warning: Style-Hinweise nicht blockierend; externe Sources
+            # (curl|source) kann shellcheck nicht folgen.
+            shellcheck -S warning -e SC1090,SC1091 ct/*.sh install/*.sh tests/*.sh
+          else
+            echo "shellcheck nicht installiert — übersprungen (dokumentiert, K-114)"
+          fi
@@ -24,6 +24,12 @@ CTID=200 HOSTNAME=devpi DISK_SIZE=30 RAM=4096 CORES=4 IPCFG=dhcp \

 All defaults (`DEFAULT_HOSTNAME`, `DEFAULT_DISK`, …) are settable per-call via env vars as well.

+## Contributing (verbindlich seit K-114)
+
+**Alle Änderungen laufen als PR mit Cross-Review** — keine Direkt-Commits auf `main`. Hintergrund: Der „`build.func` nicht gesourct"-Bug hat es einmal bis in die Produktion geschafft (authentik-Anlage), während dieselbe Fehlerklasse im nexus-db-PR vom Review gefangen wurde. Die CI (`.gitea/workflows/ci.yml`, Runner-Label `nexus`) erzwingt zusätzlich: `bash -n` über alle Scripts, „jedes `ct/*.sh` sourct `build.func`" (`tests/check_ct_source.sh`) und die Validierungs-Unit-Tests (`tests/test_validation.sh`).
+
+Eingaben in `prompt_lxc_config` sind validiert (Ziffern-Checks, IP/CIDR/Gateway-Format, Re-Prompt bei unsichtbaren Steuer-/Non-ASCII-Zeichen — Lesson vom 2026-06-11). Neue App-Prompts bitte über `prompt_validated`/`require_valid` aus `lib/build.func` bauen statt nacktem `read`.
+
 ## Repo layout

 ```
@@ -97,55 +97,194 @@ apply_network_profile() {
  return 0
 }

+# ── input validation (K-114) ─────────────────────────────────────────────────
+# Real incident 2026-06-11: a pasted VLAN tag carried an invisible non-UTF-8
+# byte and broke `pct create` deep in the run. Policy: trim CR/edge whitespace,
+# but NEVER silently strip junk inside a value — embedded control/non-ASCII
+# bytes fail validation and trigger a visible re-prompt.
+
+# Trim \r and leading/trailing whitespace (edges only).
+sanitize_input() {
+  local s="${1-}"
+  s="${s//$'\r'/}"
+  s="${s#"${s%%[![:space:]]*}"}"
+  s="${s%"${s##*[![:space:]]}"}"
+  printf '%s' "$s"
+}
+
+# True if the value contains only printable ASCII (no control/non-ASCII
+# bytes). Byte-exact via tr: delete all printable ASCII — anything left
+# over is junk.
+is_clean_ascii() {
+  # Newline/Tab zuerst explizit ablehnen — $(…) strippt trailing newlines,
+  # die der tr-Pfad sonst übersehen würde (Review-Finding K-114).
+  [[ "$1" == *$'\n'* || "$1" == *$'\t'* ]] && return 1
+  local leftover
+  leftover="$(printf '%s' "$1" | LC_ALL=C tr -d '\40-\176')"
+  [[ -z "$leftover" ]]
+}
+
+is_uint()     { is_clean_ascii "$1" && [[ "$1" =~ ^[0-9]+$ ]]; }
+# 10#: führende Nullen nicht als Oktal werten ("08" wäre sonst ein
+# Arithmetik-Fehler statt einer sauberen Ablehnung/Annahme).
+is_vlan_tag() { is_uint "$1" && (( 10#$1 >= 1 && 10#$1 <= 4094 )); }
+is_token()    { is_clean_ascii "$1" && [[ "$1" =~ ^[A-Za-z0-9._-]+$ ]]; }
+is_hostname() { is_clean_ascii "$1" && [[ "$1" =~ ^[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?$ ]]; }
+
+is_ipv4() {
+  is_clean_ascii "$1" && [[ "$1" =~ ^([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})$ ]] || return 1
+  local o
+  for o in "${BASH_REMATCH[@]:1:4}"; do (( 10#$o <= 255 )) || return 1; done
+  return 0
+}
+
+is_cidr() {
+  [[ "$1" =~ ^([0-9.]+)/([0-9]{1,2})$ ]] || return 1
+  # BASH_REMATCH retten — is_ipv4 nutzt selbst =~ und überschreibt es.
+  local _ip="${BASH_REMATCH[1]}" _prefix="${BASH_REMATCH[2]}"
+  is_ipv4 "$_ip" && (( 10#$_prefix >= 1 && 10#$_prefix <= 32 ))
+}
+
+is_ipcfg() { [[ "$1" == "dhcp" ]] || is_cidr "$1"; }
+
+# Space/comma-separated list of IPv4s (DNS prompt). Gesamtstring zuerst
+# prüfen — die Wort-Splittung würde eingebettete Newlines sonst verstecken.
+is_ipv4_list() {
+  is_clean_ascii "$1" || return 1
+  local item
+  for item in ${1//,/ }; do is_ipv4 "$item" || return 1; done
+  [[ -n "$1" ]]
+}
+
+# prompt_validated VARNAME PROMPT VALIDATOR [DEFAULT] [allow_empty]
+# Reads into VARNAME (nameref, no subshell), sanitizes, applies the default on
+# empty input and re-prompts until the validator passes. allow_empty=yes lets
+# an empty value through (e.g. "no VLAN").
+prompt_validated() {
+  # Schutz vor zirkulärem nameref (Review-Finding): interne Namen tabu.
+  [[ "$1" == _pv_* || "$1" == _rv_* ]] && { msg_err "prompt_validated: reserved variable name '$1'"; return 2; }
+  local -n _pv_ref="$1"
+  local _pv_prompt="$2" _pv_validator="$3" _pv_default="${4-}" _pv_allow_empty="${5:-no}"
+  local _pv_value
+  while true; do
+    if ! read -rp "$_pv_prompt" _pv_value; then
+      # EOF (kein TTY / stdin erschöpft): kein Endlos-Loop, sauber raus —
+      # unter set -e bricht der Caller damit kontrolliert ab.
+      msg_err "No input available for prompt: ${_pv_prompt%% *}"
+      return 1
+    fi
+    _pv_value="$(sanitize_input "$_pv_value")"
+    if [[ -z "$_pv_value" && -n "$_pv_default" ]]; then
+      _pv_value="$_pv_default"
+    fi
+    if [[ -z "$_pv_value" ]]; then
+      if [[ "$_pv_allow_empty" == "yes" ]]; then _pv_ref=""; return 0; fi
+      msg_warn "A value is required."
+      continue
+    fi
+    if "$_pv_validator" "$_pv_value"; then
+      _pv_ref="$_pv_value"
+      return 0
+    fi
+    if ! is_clean_ascii "$_pv_value"; then
+      msg_warn "Input contains invisible/non-ASCII characters — please re-type (do not paste)."
+    else
+      msg_warn "Invalid value: '$_pv_value' — please retry."
+    fi
+  done
+}
+
+# Validate an env-provided value (non-interactive: abort instead of re-prompt).
+require_valid() {
+  [[ "$1" == _pv_* || "$1" == _rv_* ]] && { msg_err "require_valid: reserved variable name '$1'"; return 2; }
+  local -n _rv_ref="$1"
+  local _rv_validator="$2" _rv_label="$3"
+  _rv_ref="$(sanitize_input "$_rv_ref")"
+  "$_rv_validator" "$_rv_ref" || { msg_err "$_rv_label invalid: '$_rv_ref'"; exit 1; }
+}
+
 # ── prompts ──────────────────────────────────────────────────────────────────
-# Each prompt is skipped if the corresponding variable is already set in env.
+# Each prompt is skipped if the corresponding variable is already set in env
+# (env values are still validated — abort on invalid, no silent use).
 # VLAN_TAG and NAMESERVER use ${VAR+x} so that explicitly setting them to ""
 # via env skips the prompt (= "no VLAN" / "inherit DNS from host").
 prompt_lxc_config() {
  if [[ -z "${CTID:-}" ]]; then
-    read -rp "Container ID [auto]: " CTID
-    [[ -z "${CTID:-}" ]] && CTID=$(pvesh get /cluster/nextid)
+    # Eigener Loop statt prompt_validated: leer = auto (pvesh nextid),
+    # ungültig = Re-Prompt (Review-Finding: vorher Abbruch statt Re-Prompt).
+    while true; do
+      if ! read -rp "Container ID [auto]: " CTID; then
+        msg_err "No input available for prompt: Container ID"
+        return 1
+      fi
+      CTID="$(sanitize_input "$CTID")"
+      if [[ -z "$CTID" ]]; then
+        CTID=$(pvesh get /cluster/nextid)
+        break
+      fi
+      is_uint "$CTID" && break
+      msg_warn "Invalid value: '$CTID' — please retry (digits only)."
+    done
+  else
+    require_valid CTID is_uint "Container ID"
  fi
  echo "  → CTID: $CTID"

  if [[ -z "${CT_HOSTNAME:-}" ]]; then
-    read -rp "Hostname [$DEFAULT_HOSTNAME]: " CT_HOSTNAME
-    CT_HOSTNAME="${CT_HOSTNAME:-$DEFAULT_HOSTNAME}"
+    prompt_validated CT_HOSTNAME "Hostname [$DEFAULT_HOSTNAME]: " is_hostname "$DEFAULT_HOSTNAME"
+  else
+    require_valid CT_HOSTNAME is_hostname "Hostname"
  fi
  if [[ -z "${DISK_SIZE:-}" ]]; then
-    read -rp "Disk size in GB [$DEFAULT_DISK]: " DISK_SIZE
-    DISK_SIZE="${DISK_SIZE:-$DEFAULT_DISK}"
+    prompt_validated DISK_SIZE "Disk size in GB [$DEFAULT_DISK]: " is_uint "$DEFAULT_DISK"
+  else
+    require_valid DISK_SIZE is_uint "Disk size"
  fi
  if [[ -z "${CORES:-}" ]]; then
-    read -rp "vCPU cores [$DEFAULT_CORES]: " CORES
-    CORES="${CORES:-$DEFAULT_CORES}"
+    prompt_validated CORES "vCPU cores [$DEFAULT_CORES]: " is_uint "$DEFAULT_CORES"
+  else
+    require_valid CORES is_uint "vCPU cores"
  fi
  if [[ -z "${RAM:-}" ]]; then
-    read -rp "RAM in MB [$DEFAULT_RAM]: " RAM
-    RAM="${RAM:-$DEFAULT_RAM}"
+    prompt_validated RAM "RAM in MB [$DEFAULT_RAM]: " is_uint "$DEFAULT_RAM"
+  else
+    require_valid RAM is_uint "RAM"
  fi
  if [[ -z "${BRIDGE:-}" ]]; then
-    read -rp "Bridge [$DEFAULT_BRIDGE]: " BRIDGE
-    BRIDGE="${BRIDGE:-$DEFAULT_BRIDGE}"
+    prompt_validated BRIDGE "Bridge [$DEFAULT_BRIDGE]: " is_token "$DEFAULT_BRIDGE"
+  else
+    require_valid BRIDGE is_token "Bridge"
  fi
  if [[ -z "${VLAN_TAG+x}" ]]; then
-    read -rp "VLAN tag (empty for none): " VLAN_TAG
+    # The 2026-06-11 incident prompt: junk bytes re-prompt, empty = no VLAN.
+    prompt_validated VLAN_TAG "VLAN tag (empty for none): " is_vlan_tag "" yes
+  elif [[ -n "${VLAN_TAG:-}" ]]; then
+    require_valid VLAN_TAG is_vlan_tag "VLAN tag"
  fi
  if [[ -z "${TEMPLATE_STORAGE:-}" ]]; then
-    read -rp "Template storage [$DEFAULT_TEMPLATE_STORAGE]: " TEMPLATE_STORAGE
-    TEMPLATE_STORAGE="${TEMPLATE_STORAGE:-$DEFAULT_TEMPLATE_STORAGE}"
+    prompt_validated TEMPLATE_STORAGE \
+      "Template storage [$DEFAULT_TEMPLATE_STORAGE]: " is_token "$DEFAULT_TEMPLATE_STORAGE"
+  else
+    require_valid TEMPLATE_STORAGE is_token "Template storage"
  fi
  if [[ -z "${ROOTFS_STORAGE:-}" ]]; then
-    read -rp "Rootfs storage [$DEFAULT_ROOTFS_STORAGE]: " ROOTFS_STORAGE
-    ROOTFS_STORAGE="${ROOTFS_STORAGE:-$DEFAULT_ROOTFS_STORAGE}"
+    prompt_validated ROOTFS_STORAGE \
+      "Rootfs storage [$DEFAULT_ROOTFS_STORAGE]: " is_token "$DEFAULT_ROOTFS_STORAGE"
+  else
+    require_valid ROOTFS_STORAGE is_token "Rootfs storage"
  fi
  if [[ -z "${IPCFG:-}" ]]; then
-    read -rp "Network: IP/CIDR or 'dhcp' [dhcp]: " IPCFG
-    IPCFG="${IPCFG:-dhcp}"
+    prompt_validated IPCFG "Network: IP/CIDR or 'dhcp' [dhcp]: " is_ipcfg "dhcp"
+  else
+    require_valid IPCFG is_ipcfg "Network (IP/CIDR or dhcp)"
  fi
  GATEWAY="${GATEWAY:-}"
-  if [[ "$IPCFG" != "dhcp" && -z "$GATEWAY" ]]; then
-    read -rp "Gateway: " GATEWAY
+  if [[ "$IPCFG" != "dhcp" ]]; then
+    if [[ -z "$GATEWAY" ]]; then
+      prompt_validated GATEWAY "Gateway: " is_ipv4
+    else
+      require_valid GATEWAY is_ipv4 "Gateway"
+    fi
  fi
  # DNS is driven by the VLAN tag via the network profile (lib/networks.conf),
  # so the right resolvers get set even with DHCP. Precedence:
@@ -155,14 +294,20 @@ prompt_lxc_config() {
  #   4. DHCP, no profile                                  → inherit from host
  apply_network_profile
  if [[ -n "${NAMESERVER+x}" ]]; then
-    :  # explicit override from env, leave untouched
+    # Explizites Override aus env: "" = inherit bleibt erlaubt, aber ein
+    # gesetzter Wert wird validiert (Review-Finding: lief vorher ungeprüft
+    # bis in pct create).
+    if [[ -n "${NAMESERVER:-}" ]]; then
+      require_valid NAMESERVER is_ipv4_list "DNS server"
+    fi
  elif [[ -n "$PROFILE_DNS" ]]; then
    NAMESERVER="$PROFILE_DNS"
    msg_info "DNS for VLAN ${VLAN_TAG:-none} (${PROFILE_SUBNET:-?}): $NAMESERVER"
  elif [[ "$IPCFG" != "dhcp" ]]; then
    local default_ns="${DEFAULT_NAMESERVER:-$GATEWAY}"
-    read -rp "DNS server [$default_ns] (empty = inherit from PVE host): " NAMESERVER
-    NAMESERVER="${NAMESERVER:-$default_ns}"
+    prompt_validated NAMESERVER \
+      "DNS server [$default_ns] (empty = inherit from PVE host): " \
+      is_ipv4_list "$default_ns" yes
  else
    msg_warn "No network profile for VLAN ${VLAN_TAG:-none}; DHCP DNS will be inherited."
  fi
@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# K-114: Jedes ct/*.sh MUSS lib/build.func sourcen — der Bug "Helfer nicht
+# gesourct, Skript stirbt erst mitten im Lauf" ist zweimal real passiert
+# (nexus-db: im Review gefangen; authentik: erst in Produktion).
+# Aufruf: tests/check_ct_source.sh [verzeichnis]  (Default: ct/)
+#
+# Bewusst eng: akzeptiert wird NUR die curl-Prozesssubstitutions-Form
+# `source <(curl ... build.func)` — das ist der Repo-Vertrag für ct/-Scripts
+# (Review-Triage K-114). Lokales Sourcen gehört nicht in ct/*.sh.
+set -euo pipefail
+
+DIR="${1:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/ct}"
+status=0
+
+shopt -s nullglob
+scripts=("$DIR"/*.sh)
+if [[ ${#scripts[@]} -eq 0 ]]; then
+  echo "no scripts found in $DIR" >&2
+  exit 1
+fi
+
+for script in "${scripts[@]}"; do
+  if grep -Eq 'source[[:space:]]+<\(curl[^)]*build\.func' "$script"; then
+    echo "ok     $script"
+  else
+    echo "FEHLT  $script — sourct lib/build.func nicht" >&2
+    status=1
+  fi
+done
+exit "$status"
@@ -0,0 +1,168 @@
+#!/usr/bin/env bash
+# K-114: Unit-Tests für die Input-Validierung in lib/build.func.
+# Läuft ohne PVE (sourct nur die Helfer). Aufruf: bash tests/test_validation.sh
+set -u
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# shellcheck source=/dev/null
+source "$REPO_ROOT/lib/build.func"
+
+PASS=0
+FAIL=0
+
+ok() { PASS=$((PASS + 1)); echo "ok     - $1"; }
+nok() { FAIL=$((FAIL + 1)); echo "NOT OK - $1"; }
+
+assert_true() {  # assert_true "desc" cmd args...
+  local desc="$1"; shift
+  if "$@"; then ok "$desc"; else nok "$desc"; fi
+}
+assert_false() {
+  local desc="$1"; shift
+  if "$@"; then nok "$desc"; else ok "$desc"; fi
+}
+
+# ── Repro des Vorfalls vom 2026-06-11: VLAN-Tag mit unsichtbarem Byte ────────
+JUNK_VLAN="$(printf '2\x800')"   # "20" mit eingebettetem Non-UTF-8-Byte
+assert_false "VLAN-Repro: '2<0x80>0' wird abgelehnt (kein silent strip)" is_vlan_tag "$JUNK_VLAN"
+assert_false "is_clean_ascii erkennt eingebettetes Junk-Byte" is_clean_ascii "$JUNK_VLAN"
+
+# Re-Prompt-Verhalten: erste Eingabe ist der Junk-Wert, zweite ist sauber —
+# prompt_validated muss die zweite liefern (AC: Re-Prompt statt pct-Fehler).
+reprompt_result="$(
+  printf '%s\n20\n' "$JUNK_VLAN" | {
+    VLAN=""
+    prompt_validated VLAN "VLAN tag (empty for none): " is_vlan_tag "" yes >/dev/null 2>&1
+    printf '%s' "$VLAN"
+  }
+)"
+if [[ "$reprompt_result" == "20" ]]; then
+  ok "prompt_validated re-promptet bei Junk und akzeptiert dann '20'"
+else
+  nok "prompt_validated re-promptet bei Junk (got: '$reprompt_result')"
+fi
+
+# ── sanitize_input: CR + Rand-Whitespace weg, Inhalt unangetastet ─────────────
+[[ "$(sanitize_input $'  42\r\n')" == "42" ]] && ok "sanitize_input trimmt CR/Whitespace" \
+  || nok "sanitize_input trimmt CR/Whitespace"
+[[ "$(sanitize_input "$JUNK_VLAN")" == "$JUNK_VLAN" ]] && ok "sanitize_input strippt KEIN eingebettetes Junk (Validator soll es sehen)" \
+  || nok "sanitize_input lässt eingebettetes Junk unangetastet"
+
+# ── numerische Validatoren ────────────────────────────────────────────────────
+assert_true  "is_uint akzeptiert 8"            is_uint "8"
+assert_false "is_uint lehnt '8 ' mit Junk ab"  is_uint "$(printf '8\x01')"
+assert_false "is_uint lehnt 'abc' ab"          is_uint "abc"
+assert_false "is_uint lehnt leeren Wert ab"    is_uint ""
+assert_true  "is_vlan_tag akzeptiert 20"       is_vlan_tag "20"
+assert_false "is_vlan_tag lehnt 0 ab"          is_vlan_tag "0"
+assert_false "is_vlan_tag lehnt 5000 ab"       is_vlan_tag "5000"
+
+# ── Netz-Validatoren ──────────────────────────────────────────────────────────
+assert_true  "is_ipv4 akzeptiert 10.11.20.66"      is_ipv4 "10.11.20.66"
+assert_false "is_ipv4 lehnt 10.11.20.666 ab"       is_ipv4 "10.11.20.666"
+assert_false "is_ipv4 lehnt 10.11.20 ab"           is_ipv4 "10.11.20"
+assert_true  "is_cidr akzeptiert 10.11.20.5/24"    is_cidr "10.11.20.5/24"
+assert_false "is_cidr lehnt 10.11.20.5/33 ab"      is_cidr "10.11.20.5/33"
+assert_false "is_cidr lehnt 10.11.20.5 ohne Maske" is_cidr "10.11.20.5"
+assert_true  "is_ipcfg akzeptiert dhcp"            is_ipcfg "dhcp"
+assert_true  "is_ipcfg akzeptiert CIDR"            is_ipcfg "192.168.0.7/24"
+assert_false "is_ipcfg lehnt 'static' ab"          is_ipcfg "static"
+assert_true  "is_ipv4_list akzeptiert Liste"       is_ipv4_list "1.1.1.1, 8.8.8.8"
+assert_false "is_ipv4_list lehnt Hostnamen ab"     is_ipv4_list "dns.local"
+
+# ── Namen/Token ───────────────────────────────────────────────────────────────
+assert_true  "is_hostname akzeptiert nexus-db"     is_hostname "nexus-db"
+assert_false "is_hostname lehnt '-bad' ab"         is_hostname "-bad"
+assert_false "is_hostname lehnt 'a b' ab"          is_hostname "a b"
+assert_true  "is_token akzeptiert local-lvm"       is_token "local-lvm"
+assert_false "is_token lehnt 'a;b' ab"             is_token "a;b"
+
+# ── require_valid: env-Werte werden sanitisiert + geprüft ────────────────────
+CHECKVAL=$'  7\r'
+require_valid CHECKVAL is_uint "Testwert" && [[ "$CHECKVAL" == "7" ]] \
+  && ok "require_valid sanitisiert env-Wert (CR weg)" \
+  || nok "require_valid sanitisiert env-Wert"
+( CHECKBAD="$JUNK_VLAN"; require_valid CHECKBAD is_uint "Testwert" ) >/dev/null 2>&1 \
+  && nok "require_valid bricht bei Junk-env-Wert ab" \
+  || ok "require_valid bricht bei Junk-env-Wert ab (exit != 0)"
+
+# ── Negativ-Beweis: build.func-Source-Check schlägt bei Präparat an ──────────
+TMPDIR_CT="$(mktemp -d)"
+cat >"$TMPDIR_CT/broken.sh" <<'EOF'
+#!/usr/bin/env bash
+# absichtlich ohne source build.func (Repro des zweimal aufgetretenen Bugs)
+APP="broken"
+prompt_lxc_config
+EOF
+if bash "$REPO_ROOT/tests/check_ct_source.sh" "$TMPDIR_CT" >/dev/null 2>&1; then
+  nok "check_ct_source.sh erkennt fehlendes 'source build.func'"
+else
+  ok "check_ct_source.sh erkennt fehlendes 'source build.func'"
+fi
+rm -rf "$TMPDIR_CT"
+
+# Positiv: das echte ct/-Verzeichnis ist sauber.
+if bash "$REPO_ROOT/tests/check_ct_source.sh" "$REPO_ROOT/ct" >/dev/null 2>&1; then
+  ok "alle ct/*.sh sourcen build.func"
+else
+  nok "alle ct/*.sh sourcen build.func"
+fi
+
+# ── Review-Findings K-114: Oktal, Newline, EOF, Nameref-Guard ────────────────
+assert_true  "is_vlan_tag akzeptiert '08' (kein Oktal-Fehler)"  is_vlan_tag "08"
+assert_true  "is_cidr akzeptiert /08 (kein Oktal-Fehler)"       is_cidr "10.0.0.1/08"
+assert_false "is_clean_ascii lehnt eingebettetes Newline ab"    is_clean_ascii $'1.1.1.1\n8.8.8.8'
+assert_false "is_ipv4_list lehnt Newline-Liste ab"              is_ipv4_list $'1.1.1.1\n8.8.8.8'
+
+# EOF statt Eingabe: prompt_validated darf nicht endlos loopen.
+( printf '' | { V=""; prompt_validated V "Wert: " is_uint; } ) >/dev/null 2>&1
+rc=$?
+[[ "$rc" -ne 0 ]] && ok "prompt_validated bricht bei EOF ab (rc=$rc)" \
+  || nok "prompt_validated bricht bei EOF ab"
+
+# Reservierte Namen → Guard statt zirkulärem nameref.
+( _pv_ref=""; prompt_validated _pv_ref "x: " is_uint ) >/dev/null 2>&1
+[[ $? -eq 2 ]] && ok "prompt_validated weist reservierte Variablennamen ab" \
+  || nok "prompt_validated weist reservierte Variablennamen ab"
+
+# CTID-Re-Prompt: ungültig → erneut fragen, leer wäre auto (hier: gültige Zahl).
+ctid_out="$(
+  printf 'abc\n123\n' | env -u CTID bash -c "
+    source '$REPO_ROOT/lib/build.func'
+    CTID=''
+    while true; do
+      read -rp 'Container ID [auto]: ' CTID || exit 1
+      CTID=\"\$(sanitize_input \"\$CTID\")\"
+      [[ -z \"\$CTID\" ]] && exit 1
+      is_uint \"\$CTID\" && break
+    done
+    printf '%s' \"\$CTID\""
+)"
+[[ "$ctid_out" == "123" ]] && ok "CTID-Loop re-promptet bei 'abc' und nimmt '123'" \
+  || nok "CTID-Loop re-promptet (got: '$ctid_out')"
+
+# ── Dry-Run: prompt_lxc_config komplett aus env, ohne PVE/TTY ────────────────
+smoke_out="$(
+  env CTID=999 CT_HOSTNAME=smoke DISK_SIZE=8 CORES=2 RAM=1024 BRIDGE=vmbr0 \
+    VLAN_TAG=20 TEMPLATE_STORAGE=local ROOTFS_STORAGE=local-lvm \
+    IPCFG=10.11.20.99/24 GATEWAY=10.11.20.1 NAMESERVER="" \
+    NET_PROFILES_FILE="$REPO_ROOT/lib/networks.conf" \
+    bash -c "source '$REPO_ROOT/lib/build.func' && prompt_lxc_config >/dev/null && echo SMOKE-OK"
+)" || true
+[[ "$smoke_out" == *SMOKE-OK* ]] \
+  && ok "prompt_lxc_config Dry-Run mit validen env-Werten läuft durch" \
+  || nok "prompt_lxc_config Dry-Run (got: '$smoke_out')"
+
+smoke_bad="$(
+  env CTID="$(printf '9\x809')" CT_HOSTNAME=smoke DISK_SIZE=8 CORES=2 RAM=1024 BRIDGE=vmbr0 \
+    VLAN_TAG=20 TEMPLATE_STORAGE=local ROOTFS_STORAGE=local-lvm IPCFG=dhcp NAMESERVER="" \
+    NET_PROFILES_FILE="$REPO_ROOT/lib/networks.conf" \
+    bash -c "source '$REPO_ROOT/lib/build.func' && prompt_lxc_config >/dev/null && echo SMOKE-OK" 2>/dev/null
+)" || true
+[[ "$smoke_bad" == *SMOKE-OK* ]] \
+  && nok "prompt_lxc_config bricht bei Junk-CTID aus env ab" \
+  || ok "prompt_lxc_config bricht bei Junk-CTID aus env ab"
+
+echo
+echo "passed=$PASS failed=$FAIL"
+[[ "$FAIL" -eq 0 ]]