Normalize nested PatchMon agent installer URL

patchmon-enroll.sh

@@ -131,6 +131,32 @@ s = s.replace(
     '        error "Failed to install agent (exit: $install_exit_code)"',
     '        printf "%s\\n" "$install_output" >&2\n        error "Failed to install agent (exit: $install_exit_code)"',
 )
+# The auto-enrollment script pipes a second, nested agent installer directly to
+# sh. That nested installer can still contain PatchMon's internal/raw-IP URL, so
+# intercept it, rewrite it to the canonical FQDN, then execute it.
+old_nested = '''    # Download and execute installation script
+    install_exit_code=0
+    install_output=$(curl $CURL_FLAGS \\
+        -H "X-API-ID: $api_id" \\
+        -H "X-API-KEY: $api_key" \\
+        "$install_url" | sh 2>&1) || install_exit_code=$?
+'''
+new_nested = '''    # Download, normalize, and execute installation script
+    install_exit_code=0
+    nested_install_script=$(mktemp /tmp/patchmon-agent-install.XXXXXX.sh)
+    if curl $CURL_FLAGS \\
+        -H "X-API-ID: $api_id" \\
+        -H "X-API-KEY: $api_key" \\
+        "$install_url" > "$nested_install_script"; then
+        sed -i "s#http://192.168.20.232:3000#$PATCHMON_URL#g" "$nested_install_script"
+        install_output=$(sh "$nested_install_script" 2>&1) || install_exit_code=$?
+    else
+        install_exit_code=1
+        install_output="Failed to download nested PatchMon agent installer from $install_url"
+    fi
+    rm -f "$nested_install_script"
+'''
+s = s.replace(old_nested, new_nested)
 p.write_text(s)
 PY
 }