@astrofoundry/pi-astro 0.26.0 → 0.26.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrofoundry/pi-astro",
-  "version": "0.26.0",
+  "version": "0.26.1",
   "description": "Personal pi customizations (extensions, subagents, skills, prompts, themes) for the pi coding agent.",
   "keywords": [
     "pi-package"

package/skills/edge/SKILL.md

@@ -23,6 +23,7 @@ Fetches `https://auth.37pla.net/.well-known/openid-configuration` through the VP
 | `bouncer` | bouncer unit status and the nftables set of blocked addresses |
 | `updates` | upgradable packages from the local apt index (not refreshed, so it can lag the mirror) and the packages that need a reboot |
 | `package <name>` | refreshes the apt index, then the installed version (`dpkg-query`) and the candidate with its origin (`apt-cache policy`) |
+| `changelog <name>` | first 80 lines of the candidate's Debian changelog from the Debian servers; each security upload lists the CVEs it fixes, so this is the proof that a version fixes a CVE |
 | `auto-upgrades` | the apt timers with their next run, the last three days of `apt-daily` and `apt-daily-upgrade` journal, the unattended-upgrades log tail, and the last dpkg upgrades |
 | `deploy-nginx` | install the tracked `nginx.conf`: `nginx -t` on the staged file, install, `nginx -t`, reload |
 | `reboot --confirm` | `systemctl reboot` |
@@ -45,8 +46,8 @@ Removing a hostname is the same with a removed line; check first that no public
 
 Wazuh reports a CVE against a package (the security specialist passes `package`, installed `version`, and `condition`, the fixed version). The VPS patches itself: unattended-upgrades installs Debian security updates once a day and never reboots. Answer which of three states applies:
 
-1. `package <name>`: if the installed version already satisfies the condition, it is patched; Wazuh clears the finding on its next inventory scan.
-2. Otherwise, if the candidate satisfies the condition, it is scheduled: `auto-upgrades` shows when `apt-daily-upgrade.timer` runs next. Say so with the time.
+1. `package <name>`, then `changelog <name>`: if the installed version comes from the security origin and its changelog entry names the CVE, it is patched; say by which upload and, from `auto-upgrades` or the dpkg log, when. Wazuh may keep flagging the new version until its feed learns the fixed version; that is feed lag, not an open hole.
+2. Otherwise, if the candidate's changelog names the CVE, it is scheduled: `auto-upgrades` shows when `apt-daily-upgrade.timer` runs next. Say so with the time.
 3. Otherwise the fix is not in the index yet, or `auto-upgrades` shows a failed run: report the versions and the log lines and stop. Manual upgrades are the operator's.
 
 After the upgrade, `status` shows whether a reboot is pending; a library upgrade may also leave a running service on the old copy until it restarts.

package/skills/security/SKILL.md

@@ -19,7 +19,7 @@ The `security` tool is read-only. Every call is a fixed command on the guest; `[
 | `bouncers` | bouncers JSON (`name`, `last_pull`, `revoked`) |
 | `metrics` | `cscli metrics -o json` |
 | `wazuh-alerts <days> <minLevel>` | summary: count, groups by rule and agent, latest 20 (log line truncated to 200 chars) |
-| `wazuh-vulns <days> [agent]` | vulnerability alerts only: per item `agent`, `cve`, `severity`, `score`, `status` (Active or Solved), `package`, installed `version`, `condition` (the fix, e.g. "Package less than 1.26.1-0+deb13u1"), `references`; plus `active` and `solved` counts |
+| `wazuh-vulns <days> [agent]` | vulnerability alerts only: `open` (latest event per agent, package and CVE that is still Active), `openWithoutFixVersion`, `active` and `solved` counts, and `items` (every event, newest first) with `cve`, `severity`, `score`, `status`, `package`, installed `version`, `condition`, `references` |
 | `wazuh-log <lines>` | manager container log |
 | `remote-hosts` | `host/program.log` names in the archive |
 | `remote-log <host> <program> <lines>` | tail of one archived log, e.g. `remote-log frontdoor-1337 nginx-stream 200` |
@@ -38,7 +38,10 @@ The `security` tool is read-only. Every call is a fixed command on the guest; `[
 - A CrowdSec alert without a decision means the scenario fired but the profile did not ban (whitelisted source or below threshold).
 - Front-door stream log line: `client - [time] "sni" status bytes_sent bytes_received session_time "upstream"`; upstream `-` means the SNI was rejected.
 - Wazuh rule `100010` (level 10) is a pending Debian reboot; `100011` is the RADIUS CRL threshold.
-- Wazuh rules `23503` to `23506` are vulnerability findings by severity, `23507` marks one solved. A finding is not evidence of exploitation. Read it with `wazuh-vulns`: the `condition` names the fixed version, so no external lookup is needed.
+- Wazuh rules `23503` to `23506` are vulnerability findings by severity; `23502` and `23507` mark one solved. A finding is not evidence of exploitation.
+- Read findings with `wazuh-vulns` and judge by `open`, not by the alert that reached Discord: Discord shows level 10 and above, and a Solved event is level 3, so a CVE can be closed one second after the message that announced it. If the CVE is absent from `open`, it is closed; say when it was solved.
+- `condition` "Package less than X" names the fixed version. `condition` "Package default status" means Wazuh's feed lists the source package as affected in this Debian release with no fixed version yet, so it flags every installed version, including a fresh security update. When the owner confirms the installed version equals the security-origin candidate and the package changelog names the CVE, the host is patched and the finding waits for Wazuh's content update; report it that way.
+- After a package upgrade, Wazuh re-evaluates: Solved events for the old version and Active events for the new one arrive in the same second. Pair them by CVE before concluding anything.
 
 ## Who owns each agent host
 
@@ -56,7 +59,7 @@ The `security` tool is read-only. Every call is a fixed command on the guest; `[
 
 You observe; the owning specialist acts. When a finding concerns a host in the table, call that specialist through `subagent` with the facts (`agent`, `package`, installed `version`, `condition`, `cve`) and a precise question, then report its answer with your own. Do not tell the caller to run commands on a host that has an owner.
 
-Debian guests and the VPS patch themselves through unattended-upgrades once a day and never reboot on their own. For a vulnerability alert, ask the owner whether the package is already upgraded, will be at the next run (the fix is in the index), or is stuck (the fix is not in the index or the run failed). Only the last case needs the operator; say so plainly, with the versions.
+Debian guests and the VPS patch themselves through unattended-upgrades once a day and never reboot on their own. For a vulnerability alert, ask the owner whether the package is already upgraded, will be at the next run (the fix is in the index), or is stuck (the fix is not in the index or the run failed), and to confirm from the package changelog that the installed version names the CVE. Only the stuck case needs the operator; say so plainly, with the versions. Answer with one of: patched (version, when, by what), scheduled (next run time), stuck (why), or feed lag (patched, Wazuh not updated yet).
 
 ## Operator actions (describe, do not perform)
 

package/specialists/README.md

@@ -8,7 +8,7 @@ A specialist is a Pi subagent that is the only way to operate one area of the ho
 | `astro.identity` | Zitadel; Pomerium, nginx, lego on VM 104; `02-pulsar-proxmox/dmz/` in the homelab repository | Any Zitadel API call (v2, management, admin, auth) with responses redacted; `dmz status|journal|config-template|render|pomerium-restart|nginx-reload|lego-renew|deploy-config`; `git` on the homelab checkout, writes limited to `02-pulsar-proxmox/dmz/` |
 | `astro.network` | UniFi, FreeRADIUS (LXC 108), Tailscale (LXC 105) | Read UniFi sites, devices, clients, networks, zones, firewall policies, WANs; create, update, delete firewall policies; RADIUS and Tailscale checks on Pulsar |
 | `astro.dns` | Technitium primary (Synapse) and secondary (LXC 107); Cloudflare zones `37pla.net`, `monadeo.com` | Read zones and records on both resolvers, resolve, stats; create and delete zones, add, update, delete records on the primary; Cloudflare zones and record add, update, delete |
-| `astro.edge` | Frontdoor VPS (`frontdoor-1337`) over an IAP tunnel; `00-frontdoor-vps/` in the homelab repository | `probe` the public path; `vps status|nginx-conf|nginx-test|journal|wg|bouncer|updates|package|auto-upgrades|deploy-nginx|reboot --confirm`; `git` on the homelab checkout, writes limited to `00-frontdoor-vps/` |
+| `astro.edge` | Frontdoor VPS (`frontdoor-1337`) over an IAP tunnel; `00-frontdoor-vps/` in the homelab repository | `probe` the public path; `vps status|nginx-conf|nginx-test|journal|wg|bouncer|updates|package|changelog|auto-upgrades|deploy-nginx|reboot --confirm`; `git` on the homelab checkout, writes limited to `00-frontdoor-vps/` |
 | `astro.security` | Wazuh, CrowdSec, rsyslog archive on VM 106 | Read-only: `status`, `attention`, `agents`, `alerts`, `decisions`, `bouncers`, `metrics`, `wazuh-alerts`, `wazuh-vulns`, `wazuh-log`, `remote-hosts`, `remote-log`, `journal` |
 | `astro.backup` | vzdump, the shared Restic repository (Pulsar host config, Arcane app backups), GCS offsite from LXC 102 | Status, journals, and manual runs of every layer; `restic-snapshots|stats|ls`, `restic-restore` into `/var/tmp/spc-restore` on Pulsar, `restore-clean` |
 | `astro.proxmox` | Proxmox VE on Pulsar | API token: `guests`, `guest`, `get <path>`, `tasks`; `start`, `shutdown|reboot|stop --confirm`; snapshots create, delete, rollback; `set` of CPU, memory, options, network. Pulsar key: `host-status`, `host-journal`, `updates`, `guest-exec <vmid> <status|journal|df|updates>` |

package/specialists/edge/run.ts

@@ -61,6 +61,7 @@ export const VPS_COMMANDS: Readonly<Record<string, { args: number; help: string;
     bouncer: { args: 0, help: "crowdsec-firewall-bouncer status and the nftables block set" },
     updates: { args: 0, help: "upgradable packages (local index, not refreshed) and the packages that need a reboot" },
     package: { args: 1, help: "package <name>    refresh the apt index, then installed and candidate versions of one package" },
+    changelog: { args: 1, help: "changelog <name>  Debian changelog of the candidate version, first 80 lines; it names the CVEs each upload fixes" },
     "auto-upgrades": { args: 0, help: "unattended-upgrades: apt timers, last daily runs, recent log, dpkg upgrades" },
     "deploy-nginx": { args: 0, help: "install the tracked nginx.conf from the pushed homelab checkout (nginx -t, install, reload)", stdin: true },
     reboot: { args: 0, help: "systemctl reboot (needs --confirm)" },
@@ -97,7 +98,7 @@ export function buildVpsRemote(args: string[]): { remote: string; stdin: boolean
         if (!VPS_UNITS.includes(rest[0])) throw new UsageError(`unit must be one of ${VPS_UNITS.join(", ")}`);
         if (!SINCE.test(rest[1])) throw new UsageError("since: letters, digits, spaces, colon, plus, minus only");
     }
-    if (name === "package" && !PACKAGE.test(rest[0])) throw new UsageError("package: a Debian package name (lower-case letters, digits, + - .)");
+    if ((name === "package" || name === "changelog") && !PACKAGE.test(rest[0])) throw new UsageError(`${name}: a Debian package name (lower-case letters, digits, + - .)`);
     return { remote: [name, ...rest].join(" "), stdin: spec.stdin === true };
 }
 

package/specialists/entry/remote/spc-edge-frontdoor-entry.sh

@@ -42,6 +42,10 @@ case "$name" in
     dpkg-query -W -f='${Package} ${Version} ${db:Status-Abbrev}\n' "$pkg" 2>&1 || true
     echo "policy:"
     apt-cache policy "$pkg" ;;
+  changelog)
+    pkg="$rest"
+    printf '%s' "$pkg" | grep -Eq '^[a-z0-9][a-z0-9+.-]{0,63}$' || { echo "bad package name" >&2; exit 2; }
+    apt-get changelog "$pkg" 2>&1 | head -n 80 ;;
   auto-upgrades)
     systemctl list-timers apt-daily.timer apt-daily-upgrade.timer --all --no-pager
     echo "--- apt-daily and apt-daily-upgrade journal, 3 days:"

package/specialists/security/run.ts

@@ -265,6 +265,10 @@ export interface VulnerabilitySummary {
     count: number;
     active: number;
     solved: number;
+    /** Latest event per agent, package and CVE whose status is still Active: the findings that are open now. */
+    open: VulnerabilityItem[];
+    /** Open findings whose condition is "Package default status": the feed knows no fixed version, so no version clears them. */
+    openWithoutFixVersion: number;
     items: VulnerabilityItem[];
 }
 
@@ -375,12 +379,20 @@ export function summariseVulns(text: string, days: number, agent: string | null,
         });
     }
     items.sort((x, y) => y.timestamp.localeCompare(x.timestamp));
+    const latest = new Map<string, VulnerabilityItem>();
+    for (const item of items) {
+        const key = `${item.agent}|${item.package}|${item.cve}`;
+        if (!latest.has(key)) latest.set(key, item);
+    }
+    const open = [...latest.values()].filter((i) => i.status.toLowerCase() === "active");
     return {
         days,
         agent,
         count: items.length,
         active: items.filter((i) => i.status.toLowerCase() === "active").length,
         solved: items.filter((i) => i.status.toLowerCase() === "solved").length,
+        open: open.slice(0, 50),
+        openWithoutFixVersion: open.filter((i) => i.condition === "Package default status").length,
         items: items.slice(0, 50),
     };
 }

package/specialists/wrappers.test.ts

@@ -194,6 +194,8 @@ describe("edge wrapper", () => {
         expect(() => buildVpsRemote(["wg", "extra"])).toThrow(/0 argument/);
         expect(buildVpsRemote(["package", "libunbound8"])).toEqual({ remote: "package libunbound8", stdin: false });
         expect(buildVpsRemote(["auto-upgrades"])).toEqual({ remote: "auto-upgrades", stdin: false });
+        expect(buildVpsRemote(["changelog", "unbound"])).toEqual({ remote: "changelog unbound", stdin: false });
+        expect(() => buildVpsRemote(["changelog", "../x"])).toThrow(/changelog/);
         expect(() => buildVpsRemote(["package", "Lib;rm"])).toThrow(/package/);
         expect(() => buildVpsRemote(["package"])).toThrow(/1 argument/);
         expect(() => buildVpsRemote(["shell"])).toThrow(/unknown vps command/);
@@ -263,6 +265,22 @@ describe("security wrapper", () => {
         expect(summary.items[0]).toMatchObject({ agent: "frontdoor-1337", cve: "CVE-2026-50252", score: 9.8, status: "Active", package: "libunbound8", version: "1.26.0-1", condition: "Package less than 1.26.1-0+deb13u1", references: ["https://a", "https://b"], level: 13 });
         expect(summary.items[1]).toMatchObject({ cve: "CVE-2016-4484", score: 6.8, status: "Fixed", references: ["https://x", "https://y"] });
         expect(summariseVulns([modern, legacy].join("\n"), 3, "dmz", now).items.map((i) => i.agent)).toEqual(["dmz"]);
+        const solvedLater = JSON.stringify({
+            timestamp: "2026-09-20T07:07:48.433+0000",
+            rule: { id: "23502", level: 3, description: "CVE-2026-50252 affecting libunbound8 was solved" },
+            agent: { name: "frontdoor-1337" },
+            data: { vulnerability: { cve: "CVE-2026-50252", status: "Solved", package: { name: "libunbound8", version: "1.26.0-1" } } },
+        });
+        const unfixed = JSON.stringify({
+            timestamp: "2026-09-20T07:07:47.672+0000",
+            rule: { id: "23504", level: 7, description: "CVE-2026-55990 affects libunbound8" },
+            agent: { name: "frontdoor-1337" },
+            data: { vulnerability: { cve: "CVE-2026-55990", severity: "Medium", status: "Active", package: { name: "libunbound8", version: "1.26.1-0+deb13u1", condition: "Package default status" } } },
+        });
+        const paired = summariseVulns([modern, solvedLater, unfixed].join("\n"), 3, null, now);
+        expect(paired.open.map((i) => i.cve)).toEqual(["CVE-2026-55990"]);
+        expect(paired.openWithoutFixVersion).toBe(1);
+        expect(paired.active).toBe(2);
         expect(summariseVulns(modern, 1, null, now + 3 * 86_400_000).count).toBe(0);
     });