v2.12.0

Security

• Configuration files are now parsed as allowlisted data instead of being executed with source.
• Log files must be private, owner-controlled regular files; unsafe paths and symlinks are rejected.
• The system-wide pman command is installed as an atomic root-owned copy instead of a symlink to a potentially user-writable checkout.
• GitHub Actions are commit-SHA pinned, remote tool downloads are checksum-verified, workflow permissions are minimized, and checkout credentials are not persisted.
• User-controlled status and message text is no longer interpreted as printf %b escape sequences.

Fixed

• Broken TUI frames (#33): header and table rows are now padded by visible width, so right borders line up;
  the table gained a closing border, the NAME column grows with long guest names (capped at the terminal
  width, then truncated), and header/data columns are aligned in --list output too.
• The header showed PVE: (running instead of the version; it now parses pveversion correctly and shows a
  compact uptime (e.g. 12d 1h 25m).
• VM IP lookup now accepts the native QEMU Guest Agent list payload from qm agent ... network-get-interfaces
  as well as the earlier wrapped shape, preventing parser errors on hosts that return a bare JSON array.
• Snapshot name validation now matches Proxmox pve-configid rules before calling pct / qm;
  numeric-only and single-letter names are rejected locally with a clearer message.
• SPICE .vv files now prefer the actual SPICE bind address/port from Proxmox instead of always
  using the host LAN IP, preventing mismatched connection targets on loopback-bound SPICE setups.
• spice_info() no longer claims success launching virt-viewer from a non-graphical shell; it
  falls back to the .vv file with a clear desktop-session hint.
• VM console guidance now tells the user to follow the escape hint printed by Proxmox instead of
  hardcoding a potentially wrong key sequence.

Added

• New IP info menu item: shows current IPv4 addresses for running VMs and CTs. VMs use the
  QEMU Guest Agent, CTs use pct exec ... ip -j addr show, with clear fallback messages when
  no address is available.