[Bug]: Cannot install pulse agent on pfsense 2.9 CE

[kwat2025]

Describe the bug

Tried to install pulse agent on new pfsense 2.9 CE install but did not work

To reproduce

1. Run pkg install -y bash from via Diagnostics → Command Prompt → Execute Shell Command in pfsense
2. Copy and execute freebsd install command from pulse to Diagnostics → Command Prompt → Execute Shell Command
3. service -l | grep pulse shows no output from Diagnostics → Command Prompt → Execute Shell Command
4. Attached is pfsense screen shot after command execution:

Expected behavior

pulse agent installed on pfsense

Additional actionable topics

none

Pulse version

v6.4.1

Agent version

v6.4.1

Image tag or digest

No response

Installation type

ProxmoxVE LXC

Relevant logs or diagnostics

{
  "version": "6.4.1",
  "runtime": "go",
  "uptime": 1946.507333065,
  "nodes": [],
  "pbs": [],
  "system": {
    "os": "linux",
    "arch": "amd64",
    "goVersion": "go1.26.7",
    "numCPU": 2,
    "numGoroutine": 91,
    "memoryMB": 10
  },
  "metricsStore": {
    "enabled": true,
    "status": "empty",
    "dbSize": 36864,
    "notes": [
      "No historical metrics written yet"
    ]
  },
  "discovery": {
    "enabled": false,
    "configuredSubnet": "[REDACTED_SUBNET]",
    "environmentOverride": "[REDACTED]",
    "subnetAllowlist": [],
    "subnetBlocklist": [
      "[REDACTED_SUBNET]"
    ],
    "scanning": false,
    "history": []
  },
  "apiTokens": {
    "enabled": true,
    "tokenCount": 2,
    "recommendTokenSetup": false,
    "unusedTokenCount": 1,
    "notes": [
      "1 API token(s) have never been used. Remove unused tokens or update the corresponding agents."
    ],
    "tokens": [
      {
        "id": "token-1",
        "name": "token-1",
        "hint": "[REDACTED]",
        "createdAt": "2026-09-19T19:30:12Z",
        "source": "user"
      },
      {
        "id": "token-2",
        "name": "token-2",
        "hint": "[REDACTED]",
        "createdAt": "2026-09-19T19:15:42Z",
        "lastUsedAt": "2026-09-19T19:17:32Z",
        "source": "user"
      }
    ],
    "usage": []
  },
  "dockerAgents": {
    "agentsTotal": 0,
    "agentsOnline": 0,
    "agentsReportingVersion": 0,
    "agentsWithTokenBinding": 0,
    "agentsWithoutTokenBinding": 0,
    "agentsNeedingAttention": 0,
    "recommendedAgentVersion": "v6.4.1",
    "attention": [],
    "notes": [
      "No Docker / Podman modules have reported in yet. Use Settings → Infrastructure to install pulse-agent with Docker / Podman monitoring and unlock remote commands."
    ]
  },
  "alerts": {
    "missingCooldown": false,
    "missingGroupingWindow": false,
    "notes": []
  },
  "aiChat": {
    "enabled": false,
    "running": false,
    "healthy": false,
    "assistantRuntimeConnected": false,
    "notes": []
  },
  "errors": [],
  "nodeSnapshots": [],
  "guestSnapshots": [],
  "memorySources": [],
  "memorySourceBreakdown": []
}

Confirmations

• I verified the exact Pulse version and image reference from the running instance.
• I searched existing issues for duplicates.

[pulse-triage]

Confirmed cause: the released installer verifies the downloaded binary with sha256sum or shasum, and FreeBSD base ships neither, so the install exits before the service is created. As a workaround, give it a sha256sum built from the base sha256 tool and re-run the same install command as root:

printf '#!/bin/sh\nexec sha256 -q "$@"\n' > /usr/local/bin/sha256sum
chmod +x /usr/local/bin/sha256sum

service -l | grep pulse should then list the agent.

How Pulse handles triage

[kwat2025]

I executed the commands you said from Diagnostics → Command Prompt → Execute Shell Command as admin and re-ran install command from same. The results were the same. BTW, I had to generate a new set of install commands as I did not save the original.

[pulse-triage]

The shim only helps if the installer's shell can actually resolve sha256; if it cannot, the install still stops at Could not compute binary checksum. Build it in one line from the real path and verify before re-running:

s=$(command -v sha256); printf '#!/bin/sh\nexec %s -q "$@"\n' "$s" > /usr/local/bin/sha256sum; chmod +x /usr/local/bin/sha256sum; sha256sum /etc/hostname

That last command must print a hash. Then re-run the same install command as root and check service -l | grep pulse. If it still fails, paste the exact error line from the output. A fix that removes this dependency is already merged and queued for the next release.

How Pulse handles triage

[pulse-triage]

v6.4.5-rc.1 is published with the checksum fix that removes the coreutils dependency. Update the Pulse server to it (sudo /bin/update --version v6.4.5-rc.1, or rcourtman/pulse:6.4.5-rc.1 for Docker), generate a fresh pfSense agent install command, and re-run it as root. Post the result here.

How Pulse handles triage

[kwat2025]

Tried the install with a fresh install command from v6.4.5-rc.1 but still not working. What info/results would you like me to post to help identify the problem?

[pulse-triage]

The original screenshot has an empty output box, so my earlier claim that it confirmed a checksum failure was too strong. On the RC.1 attempt, is that box still empty, or is there an error (if so, paste the error and a few preceding lines, not the install command)? Please revoke the agent token visible in the original screenshot and redact it from the attachment.

How Pulse handles triage

[kwat2025]

The screen shot from v6.4.5-rc.1 is attached. Note This is run on a test system w/o internet connectivity and will be destroyed when this issue is resolved so no issue with token displayed earlier. No other error messages were displayed.

[pulse-triage]

You already tried installing Bash and confirmed that the RC.1 attempt leaves the output empty on this offline test system; please run this single line in Diagnostics → Command Prompt → Execute Shell Command, without the agent install command:

printf 'PULSE_GUI_OK\n'; command -v bash || printf 'BASH_MISSING\n'; command -v curl || printf 'CURL_MISSING\n'

This checks whether the GUI displays shell output and can find the two programs the installer needs, without downloading or changing anything. Paste only the marker and paths or MISSING lines—no token, address or screenshot is needed.

How Pulse handles triage

[kwat2025]

Here are the results you asked for. Note, I have been logged into an admin account and using Diagnostics → Command Prompt → Execute Shell Command to execute ALL shell commands through and NOT using SSH

[pulse-triage]

Your check shows the GUI runs shell commands and both bash and curl are present at /usr/local/bin, so the pfSense side is fine. The install command the UI copies is multi-line, and pfSense's single-line command field joins the line breaks, so the pasted script never executes and the output stays empty. That is fixed by 097e3386e0 and queued for the next preview; until then paste this single-line form, replacing PASTE_AGENT_TOKEN_HERE with the token from the install dialog:

( set -e; tmp_dir=$(mktemp -d); token_dir=""; install_script="$tmp_dir/install.sh"; cleanup() { rm -rf -- "$tmp_dir"; if [ -n "${token_dir:-}" ]; then if [ "$(id -u)" -eq 0 ]; then rm -rf -- "$token_dir"; elif command -v sudo >/dev/null 2>&1; then sudo rm -rf -- "$token_dir" >/dev/null 2>&1 || true; fi; fi; }; trap cleanup EXIT HUP INT TERM; curl -fsSL 'http://192.168.10.101:7655/install.sh' -o "$install_script"; chmod +x "$install_script"; bash "$install_script" --url 'http://192.168.10.101:7655' --preflight-only --output json --non-interactive --insecure; if [ "$(id -u)" -eq 0 ]; then token_dir=$(mktemp -d /tmp/pulse-agent-bootstrap.XXXXXX); token_file="$token_dir/token"; umask 077; printf %s 'PASTE_AGENT_TOKEN_HERE' > "$token_file"; bash "$install_script" --url 'http://192.168.10.101:7655' --token-file "$token_file" --non-interactive --insecure; elif command -v sudo >/dev/null 2>&1; then token_dir=$(sudo mktemp -d /tmp/pulse-agent-bootstrap.XXXXXX); token_file="$token_dir/token"; printf %s 'PASTE_AGENT_TOKEN_HERE' | sudo tee "$token_file" >/dev/null; sudo chmod 0600 "$token_file"; sudo bash "$install_script" --url 'http://192.168.10.101:7655' --token-file "$token_file" --non-interactive --insecure; else echo "Root privileges required. Run as root (su -) and retry." >&2; exit 1; fi; )

How Pulse handles triage

[kwat2025]

Install works with new install command. However, last line of GUI output says To view logs: tail -f /var/log/messages,
when I enter that command the response is:
tail: /var/log/messages: No such file or directory

Here are messages from the pfsense GUI:

[INFO] Detecting available platforms...
[INFO] Monitoring configuration:
[INFO] Agent metrics: true
[INFO] Docker/Podman: false
[INFO] Kubernetes: false
[INFO] Proxmox: false
[INFO] Pulse command execution: false
[INFO] Command execution is off; enable only when Patrol actions or Proxmox LXC Docker inventory are needed.
{"phase":"preflight","code":"checking","message":"Running preflight checks","exitCode":0}
{"phase":"preflight","code":"arch_ok","message":"Architecture: freebsd-arm64","exitCode":0}
{"phase":"preflight","code":"not_installed","message":"Agent status: not_installed","exitCode":0}
{"phase":"preflight","code":"disk_ok","message":"Sufficient disk space for agent install","exitCode":0}
{"phase":"preflight","code":"pulse_reachable","message":"Pulse URL reachable","exitCode":0}
{"phase":"preflight","code":"agent_download_available","message":"Agent binary available for freebsd-arm64","exitCode":0}
{"phase":"preflight_complete","code":"ok","message":"Preflight checks passed","exitCode":0,"data":{"arch":"freebsd-arm64","agent_status":"not_installed"}}
[INFO] Detecting available platforms...
[INFO] Monitoring configuration:
[INFO] Agent metrics: true
[INFO] Docker/Podman: false
[INFO] Kubernetes: false
[INFO] Proxmox: false
[INFO] Pulse command execution: false
[INFO] Command execution is off; enable only when Patrol actions or Proxmox LXC Docker inventory are needed.
[INFO] Pulse server version: 6.4.5-rc.1
[INFO] Downloading agent from http://192.168.10.101:7655/download/pulse-agent?arch=freebsd-arm64&serverVersion=6.4.5-rc.1...
[INFO] Binary checksum verified
[INFO] Installing binary to /usr/local/bin/pulse-agent...
[INFO] Configuring FreeBSD rc.d service at /usr/local/etc/rc.d/pulse-agent...
[INFO] Token stored securely at /var/lib/pulse-agent/token (mode 600)
[INFO] Detected pfSense — creating boot wrapper at /usr/local/etc/rc.d/pulse_agent.sh...
pulse_agent is not running.
Starting pulse_agent.
[INFO] Verifying agent started successfully...
[WARN] Agent local health is ready, but server registration was not confirmed yet.
[INFO] Installation complete! Agent is running.
[INFO] To uninstall later: sudo bash /var/lib/pulse-agent/install.sh --uninstall
[INFO] To check status: /usr/local/etc/rc.d/pulse-agent status
[INFO] To view logs: tail -f /var/log/messages