@astrofoundry/pi-astro 0.21.0 → 0.21.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrofoundry/pi-astro",
-  "version": "0.21.0",
+  "version": "0.21.2",
   "description": "Personal pi customizations (extensions, subagents, skills, prompts, themes) for the pi coding agent.",
   "keywords": [
     "pi-package"

package/specialists/AGENTS.md

@@ -39,7 +39,7 @@ Wrappers ship as TypeScript and run under Node 24 type stripping: erasable synta
 - Exit codes: `UsageError` 2, `ServiceError` 1, success 0. Diagnostics on stderr, results on stdout, JSON where possible.
 - Output filters: Arcane responses pass `stripKeys(ARCANE_DENIED_KEYS)`; Zitadel responses pass `redactSecrets`. Add keys there rather than in a wrapper.
 - Fixed remote commands: `DMZ_COMMANDS`, `PULSAR_COMMANDS`, `VPS_COMMANDS`, `OBS_COMMANDS`, `BACKUP_COMMANDS`, `HOST_COMMANDS`, and `INFERENCE_COMMANDS` must match the entry scripts in `entry/remote/` and their tracked copies in the homelab repository (`02-pulsar-proxmox/dmz/system/`, `02-pulsar-proxmox/pulsar/system/`, `00-frontdoor-vps/system/`, `02-pulsar-proxmox/observability/system/`, `02-pulsar-proxmox/hermes/system/`, `04-nexus-macstudio/system/`, and `host/` of the `astronaute77/arcane` repository). Pulsar's root `authorized_keys` carries one forced key per specialist (network, backup, proxmox, inference), each pinned to its own entry script. Change both sides in the same commit and redeploy the remote script. A new privileged step on the VPS also needs its exact line in `spc-edge-frontdoor-sudoers`.
-- Repository access is `lib/repo.ts` (`repoCommand`, `RepoSpec`, `trackedFile`): one clone per specialist under `~/.specialists/work/<checkoutName>`, a write deploy key, and an optional `writeRoot` that limits `git write`. `edge` (`deploy-nginx`) and `identity` (`dmz deploy-config`) deploy only what origin has: `trackedFile` refuses a dirty, ahead, or behind checkout. The DMZ entry keeps the previous template and restores it when render or restart fails.
+- Repository access is `lib/repo.ts` (`repoCommand`, `RepoSpec`, `trackedFile`): one clone per specialist under `~/.specialists/work/<checkoutName>` (`homelab-edge`, `homelab-identity`; never share a checkout between specialists), a write deploy key, and an optional `writeRoot` that limits `git write`. `edge` (`deploy-nginx`) and `identity` (`dmz deploy-config`) deploy only what origin has: `trackedFile` refuses a dirty, ahead, or behind checkout. The DMZ entry keeps the previous template and restores it when render or restart fails.
 - `network` firewall policy writes are `policyWrite`: JSON body from the agent, checked for the documented required fields, sent as `POST`, `PUT`, or `DELETE` through the same pinned request; UniFi validates the rest.
 - The IAP tunnel is `lib/tunnel.ts`: `gcloud compute start-iap-tunnel <instance> 22 --local-host-port=localhost:<port>` (a documented flag; the hidden `--listen-on-stdin` is not used), ready when the port accepts a connection, closed after the ssh call. `gcloud auth activate-service-account` runs before every tunnel with `CLOUDSDK_CONFIG` under `~/.specialists/work/gcloud` and `CLOUDSDK_PYTHON` from the config, because the Homebrew cask ships no interpreter.
 - `dns` builds every Technitium call from `TECHNITIUM_READS` and `TECHNITIUM_WRITES`; `key=value` record parameters pass through by name (`token` and `node` refused) because the API documents dozens of type-specific parameters. Writes are refused on the secondary in code: the catalog zone is the only replication path.

package/specialists/edge/run.ts

@@ -154,7 +154,7 @@ async function overTunnel(config: EdgeConfig, remote: string, timeoutMs: number,
 function repoSpec(config: EdgeConfig): RepoSpec {
     return {
         service: SERVICE,
-        checkoutName: "homelab",
+        checkoutName: "homelab-edge",
         remote: config.homelabRemote,
         branch: config.homelabBranch,
         deployKeyField: "HOMELAB_DEPLOY_KEY",

package/specialists/identity/run.ts

@@ -118,7 +118,7 @@ async function zitadel(config: IdentityConfig, args: string[]): Promise<number>
 function repoSpec(config: IdentityConfig): RepoSpec {
     return {
         service: SERVICE,
-        checkoutName: "homelab",
+        checkoutName: "homelab-identity",
         remote: config.homelabRemote,
         branch: config.homelabBranch,
         deployKeyField: "HOMELAB_DEPLOY_KEY",

package/specialists/lib/repo.ts

@@ -30,7 +30,8 @@ export const REPO_HELP = `  git status                  branch, ahead/behind, ch
   git log [n]                 last n commits (default 10)
   git write <path> <content>  write a file inside the checkout (creates folders)
   git commit <message>        stage everything and commit
-  git push                    push the branch to origin`;
+  git push                    push the branch to origin
+  git key                     public key and fingerprint of the deploy key in use`;
 
 const TIMEOUT_MS = 240_000;
 
@@ -115,6 +116,16 @@ export async function trackedFile(spec: RepoSpec, rel: string): Promise<string>
 
 export async function repoCommand(spec: RepoSpec, args: string[]): Promise<number> {
     const [sub, ...rest] = args;
+    if (sub === "key") {
+        const key = secretPath(spec.service, spec.deployKeyField);
+        const [pub, fingerprint] = await Promise.all([
+            run("/usr/bin/ssh-keygen", ["-y", "-f", key], { timeoutMs: 10_000 }),
+            run("/usr/bin/ssh-keygen", ["-l", "-f", key], { timeoutMs: 10_000 }),
+        ]);
+        if (pub.code !== 0) throw new ServiceError(`deploy key unreadable: ${pub.stderr.trim()}`);
+        printJson({ publicKey: pub.stdout.trim(), fingerprint: fingerprint.stdout.trim() });
+        return 0;
+    }
     const dir = await ensureCheckout(spec);
     switch (sub) {
         case "status":