Rewrite proxy allowed_nodes sanitizer

scripts/install-sensor-proxy.sh

@@ -111,45 +111,60 @@ update_allowed_nodes() {
     done
 
     # Remove any existing allowed_nodes block (including descriptive comments) to prevent duplicates
-    local tmp_config
+    if command -v python3 >/dev/null 2>&1; then
-    tmp_config=$(mktemp)
+        python3 - "$config_file" <<'PY' || true
-    if awk '
+import sys
-        BEGIN { skip=0; pending_count=0 }
+from pathlib import Path
-        function flush_pending() {
+
-            for (i=1; i<=pending_count; i++) print pending[i]
+path = Path(sys.argv[1])
-            pending_count=0
+text = path.read_text().splitlines()
-        }
+out = []
-        {
+pending = []
-            if (skip) {
+skip = False
-                if ($0 ~ /^[[:space:]]*$/ || $0 ~ /^[[:space:]]*#/ || $0 ~ /^[[:space:]]*-[[:space:]]*/) {
+
-                    next
+def flush_pending(buf, output):
-                }
+    if buf:
-                skip=0
+        output.extend(buf)
-            }
+        buf.clear()
-            if ($0 ~ /^[[:space:]]*allowed_nodes:[[:space:]]*$/) {
+
-                pending_count=0
+i = 0
-                skip=1
+while i < len(text):
-                next
+    line = text[i]
-            }
+    stripped = line.lstrip()
-            if ($0 ~ /^[[:space:]]*$/ || $0 ~ /^[[:space:]]*#/) {
+
-                pending[++pending_count]=$0
+    if skip:
-                next
+        if stripped == "" or stripped.startswith("#") or stripped.startswith("-"):
-            }
+            i += 1
-            if (pending_count > 0) {
+            continue
-                flush_pending()
+        if line.startswith(" "):
-            }
+            # still part of allowed_nodes indentation (e.g., comments), skip
-            print
+            if stripped.startswith("allowed_nodes:"):
-        }
+                # unexpected nested block; continue handling
-        END {
+                i += 1
-            if (!skip && pending_count > 0) {
+                continue
-                flush_pending()
+        skip = False
-            }
+
-        }
+    if stripped.startswith("allowed_nodes:"):
-    ' "$config_file" > "$tmp_config"; then
+        pending.clear()
-        mv "$tmp_config" "$config_file"
+        skip = True
+        i += 1
+        continue
+
+    if stripped == "" or stripped.startswith("#"):
+        pending.append(line)
+        i += 1
+        continue
+
+    flush_pending(pending, out)
+    out.append(line)
+    i += 1
+
+flush_pending(pending, out)
+path.write_text("\n".join(out) + ("\n" if text else ""))
+PY
     else
-        rm -f "$tmp_config"
+        # Fallback: truncate the file to remove duplicates if python3 is unavailable
-        print_warn "Failed to sanitize existing allowed_nodes block; duplicates may remain"
+        grep -v '^allowed_nodes:' "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file"
     fi
 
     {