fix: rewrite cmd_diagnose to use script upload instead of nested SSH quoting

scripts/test-vm.sh

@@ -301,42 +301,71 @@ cmd_diagnose() {
 
     log "Connecting to VM..."
 
-    # System services
+    # Build and run a diagnostic script on the server (avoids nested quoting issues)
-    echo -e "\n${BOLD}── System Services ──${NC}"
+    local diag_script
-    vm_ssh "systemctl list-units --type=service --state=running --no-pager | grep -E 'NetworkManager|sshd|seatd|getty|cage|systemd-logind' || true" 2>/dev/null || warn "Could not query system services"
+    diag_script="$(mktemp)"
+    cat > "$diag_script" << 'DIAGEOF'
+#!/usr/bin/env bash
+set -uo pipefail
 
-    # User services (PipeWire stack)
+run_in_vm() {
-    echo -e "\n${BOLD}── User Services (PipeWire) ──${NC}"
+    sshpass -p kiosk ssh \
-    vm_ssh "systemctl --user list-units --type=service --state=running --no-pager 2>/dev/null | grep -E 'pipewire|wireplumber|pulse' || echo 'No user services running'" 2>/dev/null || warn "Could not query user services"
+        -o StrictHostKeyChecking=no \
+        -o UserKnownHostsFile=/dev/null \
+        -o ConnectTimeout=5 \
+        -p 2222 kiosk@localhost "$@"
+}
 
-    # Audio devices via wpctl
+echo "── System Services ──"
-    echo -e "\n${BOLD}── PipeWire Devices (wpctl status) ──${NC}"
+run_in_vm systemctl list-units --type=service --state=running --no-pager | \
-    vm_ssh "wpctl status 2>/dev/null || echo 'wpctl not available'" 2>/dev/null || warn "Could not query wpctl"
+    grep -E 'NetworkManager|sshd|seatd|getty|cage|systemd-logind' || true
 
-    # ALSA devices
+echo ""
-    echo -e "\n${BOLD}── ALSA Devices (aplay -l) ──${NC}"
+echo "── User Services (PipeWire) ──"
-    vm_ssh "aplay -l 2>/dev/null || echo 'No ALSA devices'" 2>/dev/null || warn "Could not query ALSA"
+run_in_vm systemctl --user list-units --type=service --state=running --no-pager | \
+    grep -E 'pipewire|wireplumber|pulse' || echo "No user services running"
 
-    # PulseAudio sinks
+echo ""
-    echo -e "\n${BOLD}── PulseAudio Sinks (pactl) ──${NC}"
+echo "── PipeWire Devices (wpctl status) ──"
-    vm_ssh "pactl list sinks short 2>/dev/null || echo 'pactl not available'" 2>/dev/null || warn "Could not query PulseAudio"
+run_in_vm wpctl status 2>/dev/null || echo "wpctl not available"
 
-    # Network devices
+echo ""
-    echo -e "\n${BOLD}── Network Devices ──${NC}"
+echo "── ALSA Devices (aplay -l) ──"
-    vm_ssh "nmcli device status 2>/dev/null || echo 'nmcli not available'" 2>/dev/null || warn "Could not query network"
+run_in_vm aplay -l 2>/dev/null || echo "No ALSA devices"
 
-    # Running processes
+echo ""
-    echo -e "\n${BOLD}── Key Processes ──${NC}"
+echo "── PulseAudio Sinks (pactl) ──"
-    vm_ssh "ps aux | grep -E 'rhemawave|cage|pipewire|wireplumber|NetworkManager' | grep -v grep || echo 'No matching processes'" 2>/dev/null || warn "Could not query processes"
+run_in_vm pactl list sinks short 2>/dev/null || echo "pactl not available"
 
-    # Kiosk session
+echo ""
-    echo -e "\n${BOLD}── Login Sessions ──${NC}"
+echo "── Network Devices ──"
-    vm_ssh "loginctl list-sessions --no-pager 2>/dev/null || echo 'loginctl not available'" 2>/dev/null || warn "Could not query sessions"
+run_in_vm nmcli device status 2>/dev/null || echo "nmcli not available"
 
-    # App log (last 30 lines)
+echo ""
-    echo -e "\n${BOLD}── App Log (/tmp/kiosk.log, last 30 lines) ──${NC}"
+echo "── Key Processes ──"
-    vm_ssh "tail -30 /tmp/kiosk.log 2>/dev/null || echo 'No log file yet'" 2>/dev/null || warn "Could not read app log"
+run_in_vm ps aux | \
+    grep -E 'rhemawave|cage|pipewire|wireplumber|NetworkManager' | \
+    grep -v grep || echo "No matching processes"
 
+echo ""
+echo "── Login Sessions ──"
+run_in_vm loginctl list-sessions --no-pager 2>/dev/null || echo "loginctl not available"
+
+echo ""
+echo "── App Log (last 30 lines) ──"
+run_in_vm tail -30 /tmp/kiosk.log 2>/dev/null || echo "No log file yet"
+DIAGEOF
+
+    if [[ "$PLATFORM" == "linux" ]]; then
+        bash "$diag_script"
+    else
+        # Upload and run on remote server
+        local remote_diag="/tmp/radiantwave-diagnose-$$.sh"
+        scp -q "$diag_script" "$REMOTE:$remote_diag"
+        ssh "$REMOTE" "nix-shell -p sshpass --run 'bash $remote_diag'; rm -f $remote_diag"
+    fi
+
+    rm -f "$diag_script"
     hr
 }