From 1ae56cfb1233aab34ce9aa5cb30b618b724a9ddb Mon Sep 17 00:00:00 2001
From: gnacho <hnacho@proton.me>
Date: Wed, 23 Sep 2026 23:13:53 +0200
Subject: [PATCH] feat(agent): register the executor token with NetPulse at
 startup

---
 internal/modules/executor_register.go | 39 +++++++++++++++++++++++++++
 internal/modules/netpulse_agent.go    |  1 +
 2 files changed, 40 insertions(+)
 create mode 100644 internal/modules/executor_register.go

diff --git a/internal/modules/executor_register.go b/internal/modules/executor_register.go
new file mode 100644
index 0000000..971d13b
--- /dev/null
+++ b/internal/modules/executor_register.go
@@ -0,0 +1,39 @@
+package modules
+
+import (
+	"bytes"
+	"encoding/json"
+	"log"
+	"net/http"
+	"strings"
+	"time"
+)
+
+// registerExecutorToken comparte el token del executor con NetPulse (#411):
+// lo necesita para delegar ops (p. ej. la propagación de MQTT) sin depender
+// de que el router haya subido un backup de configuración antes. Fail-silent:
+// si el servidor no está, el agente lo reintenta en su próximo arranque.
+func registerExecutorToken(server, slug, agentToken string) {
+	body, err := json.Marshal(map[string]string{"token": GetExecutorToken()})
+	if err != nil {
+		return
+	}
+	req, err := http.NewRequest("POST",
+		strings.TrimRight(server, "/")+"/api/agents/executor-token", bytes.NewReader(body))
+	if err != nil {
+		return
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Authorization", "Bearer "+agentToken)
+	req.Header.Set("X-Router-ID", slug)
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		log.Printf("netpulse: no se pudo registrar el executor token: %v", err)
+		return
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		log.Printf("netpulse: registro del executor token respondió %d", resp.StatusCode)
+	}
+}
diff --git a/internal/modules/netpulse_agent.go b/internal/modules/netpulse_agent.go
index 589747b..9b80c95 100644
--- a/internal/modules/netpulse_agent.go
+++ b/internal/modules/netpulse_agent.go
@@ -526,6 +526,7 @@ func applyNetPulseAgent(p netpulsePaths) {
 		interval = runtime.DefaultInterval
 	}
 	log.Printf("netpulse: embedded agent starting (slug=%s server=%s interval=%s)", opts.Slug, opts.Server, interval)
+	go registerExecutorToken(cfg.Server, cfg.Slug, cfg.Token)
 	go func() {
 		if err := runtime.Run(ctx, opts); err != nil {
 			log.Printf("netpulse: agent stopped: %v", err)