[sylvesterkaczmarek]

Problem

Resource-field lookup can panic instead of reporting a missing or unsupported field. Examples include continuing past a string (name/field), inspecting an unexported time field (createdat/wall), and resolving a promoted field through a nil embedded pointer. The CLI uses this helper for VM, worker, and service-account field queries.

Change

Check the reflection kind before field traversal, use FieldByIndexErr for promoted fields, and verify interface access before reading the result. Treat nil pointer/interface leaves as no match. Preserve case-insensitive field matching, supported nested fields, promoted fields, and Stringer values. No new map, slice-index, or pointer-traversal syntax is introduced.

The reflect documentation specifies the conditions under which these operations can panic.

Validation

• Broad Go suite excluding VM/runtime integration packages: 124 tests and 111 subtests passed.
• The affected package passes with the race detector; changed-code lint reports zero issues. The existing deprecated-linter configuration warning is unchanged.
• All 12 new invalid-path subcases fail with unchanged source. Existing behavior and four additional successful-lookup controls pass.
• git diff --check passes.

Go 1.27.1 on macOS arm64. Tests use synthetic values and local fixtures, without contacting a controller or starting a VM. Go test executables and runtime temporary files used an automatically removed native temporary directory because this machine cannot execute them from the external exFAT workspace; source and dependency/build caches stayed external. No dependencies or public interfaces changed.

Reproduced against f101ade5d8fdcad5e9c346472698649e7107a715.