@astrofoundry/pi-astro 0.26.0 → 0.26.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrofoundry/pi-astro",
-  "version": "0.26.0",
+  "version": "0.26.2",
   "description": "Personal pi customizations (extensions, subagents, skills, prompts, themes) for the pi coding agent.",
   "keywords": [
     "pi-package"

package/skills/edge/SKILL.md

@@ -23,6 +23,7 @@ Fetches `https://auth.37pla.net/.well-known/openid-configuration` through the VP
 | `bouncer` | bouncer unit status and the nftables set of blocked addresses |
 | `updates` | upgradable packages from the local apt index (not refreshed, so it can lag the mirror) and the packages that need a reboot |
 | `package <name>` | refreshes the apt index, then the installed version (`dpkg-query`) and the candidate with its origin (`apt-cache policy`) |
+| `changelog <name>` | first 80 lines of the candidate's Debian changelog from the Debian servers; each security upload lists the CVEs it fixes, so this is the proof that a version fixes a CVE |
 | `auto-upgrades` | the apt timers with their next run, the last three days of `apt-daily` and `apt-daily-upgrade` journal, the unattended-upgrades log tail, and the last dpkg upgrades |
 | `deploy-nginx` | install the tracked `nginx.conf`: `nginx -t` on the staged file, install, `nginx -t`, reload |
 | `reboot --confirm` | `systemctl reboot` |
@@ -45,8 +46,8 @@ Removing a hostname is the same with a removed line; check first that no public
 
 Wazuh reports a CVE against a package (the security specialist passes `package`, installed `version`, and `condition`, the fixed version). The VPS patches itself: unattended-upgrades installs Debian security updates once a day and never reboots. Answer which of three states applies:
 
-1. `package <name>`: if the installed version already satisfies the condition, it is patched; Wazuh clears the finding on its next inventory scan.
-2. Otherwise, if the candidate satisfies the condition, it is scheduled: `auto-upgrades` shows when `apt-daily-upgrade.timer` runs next. Say so with the time.
+1. `package <name>`, then `changelog <name>`: if the installed version comes from the security origin and its changelog entry names the CVE, it is patched; say by which upload and, from `auto-upgrades` or the dpkg log, when. Wazuh may keep flagging the new version until its feed learns the fixed version; that is feed lag, not an open hole.
+2. Otherwise, if the candidate's changelog names the CVE, it is scheduled: `auto-upgrades` shows when `apt-daily-upgrade.timer` runs next. Say so with the time.
 3. Otherwise the fix is not in the index yet, or `auto-upgrades` shows a failed run: report the versions and the log lines and stop. Manual upgrades are the operator's.
 
 After the upgrade, `status` shows whether a reboot is pending; a library upgrade may also leave a running service on the old copy until it restarts.

package/skills/security/SKILL.md

@@ -19,7 +19,7 @@ The `security` tool is read-only. Every call is a fixed command on the guest; `[
 | `bouncers` | bouncers JSON (`name`, `last_pull`, `revoked`) |
 | `metrics` | `cscli metrics -o json` |
 | `wazuh-alerts <days> <minLevel>` | summary: count, groups by rule and agent, latest 20 (log line truncated to 200 chars) |
-| `wazuh-vulns <days> [agent]` | vulnerability alerts only: per item `agent`, `cve`, `severity`, `score`, `status` (Active or Solved), `package`, installed `version`, `condition` (the fix, e.g. "Package less than 1.26.1-0+deb13u1"), `references`; plus `active` and `solved` counts |
+| `wazuh-vulns <days> [agent]` | vulnerability alerts only: `open` (latest event per agent, package, installed version and CVE that is still Active), `openWithoutFixVersion`, `active` and `solved` counts, and `items` (every event, newest first) with `cve`, `severity`, `score`, `status`, `package`, installed `version`, `condition`, `references` |
 | `wazuh-log <lines>` | manager container log |
 | `remote-hosts` | `host/program.log` names in the archive |
 | `remote-log <host> <program> <lines>` | tail of one archived log, e.g. `remote-log frontdoor-1337 nginx-stream 200` |
@@ -38,7 +38,10 @@ The `security` tool is read-only. Every call is a fixed command on the guest; `[
 - A CrowdSec alert without a decision means the scenario fired but the profile did not ban (whitelisted source or below threshold).
 - Front-door stream log line: `client - [time] "sni" status bytes_sent bytes_received session_time "upstream"`; upstream `-` means the SNI was rejected.
 - Wazuh rule `100010` (level 10) is a pending Debian reboot; `100011` is the RADIUS CRL threshold.
-- Wazuh rules `23503` to `23506` are vulnerability findings by severity, `23507` marks one solved. A finding is not evidence of exploitation. Read it with `wazuh-vulns`: the `condition` names the fixed version, so no external lookup is needed.
+- Wazuh rules `23503` to `23506` are vulnerability findings by severity; `23502` and `23507` mark one solved. A finding is not evidence of exploitation.
+- Read findings with `wazuh-vulns` and judge by `open`, not by the alert that reached Discord: Discord shows level 10 and above, and a Solved event is level 3, so a CVE can be closed one second after the message that announced it. If the CVE is absent from `open`, it is closed; say when it was solved.
+- `condition` "Package less than X" names the fixed version. `condition` "Package default status" means Wazuh's feed lists the source package as affected in this Debian release with no fixed version yet, so it flags every installed version, including a fresh security update. When the owner confirms the installed version equals the security-origin candidate and the package changelog names the CVE, the host is patched and the finding waits for Wazuh's content update; report it that way.
+- After a package upgrade, Wazuh re-evaluates: Solved events for the old version and Active events for the new one arrive in the same second. Pair them by CVE before concluding anything.
 
 ## Who owns each agent host
 
@@ -56,7 +59,7 @@ The `security` tool is read-only. Every call is a fixed command on the guest; `[
 
 You observe; the owning specialist acts. When a finding concerns a host in the table, call that specialist through `subagent` with the facts (`agent`, `package`, installed `version`, `condition`, `cve`) and a precise question, then report its answer with your own. Do not tell the caller to run commands on a host that has an owner.
 
-Debian guests and the VPS patch themselves through unattended-upgrades once a day and never reboot on their own. For a vulnerability alert, ask the owner whether the package is already upgraded, will be at the next run (the fix is in the index), or is stuck (the fix is not in the index or the run failed). Only the last case needs the operator; say so plainly, with the versions.
+Debian guests and the VPS patch themselves through unattended-upgrades once a day and never reboot on their own. For a vulnerability alert, ask the owner whether the package is already upgraded, will be at the next run (the fix is in the index), or is stuck (the fix is not in the index or the run failed), and to confirm from the package changelog that the installed version names the CVE. Only the stuck case needs the operator; say so plainly, with the versions. Answer with one of: patched (version, when, by what), scheduled (next run time), stuck (why), or feed lag (patched, Wazuh not updated yet).
 
 ## Operator actions (describe, do not perform)
 

package/specialists/AGENTS.md

@@ -41,7 +41,7 @@ Wrappers ship as TypeScript and run under Node 24 type stripping: erasable synta
 - Fixed remote commands: `DMZ_COMMANDS`, `PULSAR_COMMANDS`, `VPS_COMMANDS`, `OBS_COMMANDS`, `BACKUP_COMMANDS`, `HOST_COMMANDS`, and `INFERENCE_COMMANDS` must match the entry scripts in `entry/remote/` and their tracked copies in the homelab repository (`02-pulsar-proxmox/dmz/system/`, `02-pulsar-proxmox/pulsar/system/`, `00-frontdoor-vps/system/`, `02-pulsar-proxmox/observability/system/`, `02-pulsar-proxmox/hermes/system/`, `04-nexus-macstudio/system/`, and `host/` of the `astronaute77/arcane` repository). Pulsar's root `authorized_keys` carries one forced key per specialist (network, backup, proxmox, inference), each pinned to its own entry script. Change both sides in the same commit and redeploy the remote script. A new privileged step on the VPS also needs its exact line in `spc-edge-frontdoor-sudoers`.
 - Repository access is `lib/repo.ts` (`repoCommand`, `RepoSpec`, `trackedFile`): one clone per specialist under `~/.specialists/work/<checkoutName>` (`homelab-edge`, `homelab-identity`; never share a checkout between specialists), a write deploy key, and an optional `writeRoot` that limits `git write`. `edge` (`deploy-nginx`) and `identity` (`dmz deploy-config`) deploy only what origin has: `trackedFile` refuses a dirty, ahead, or behind checkout. The DMZ entry keeps the previous template and restores it when render or restart fails.
 - `network` firewall policy writes are `policyWrite`: JSON body from the agent, checked for the documented required fields, sent as `POST`, `PUT`, or `DELETE` through the same pinned request; UniFi validates the rest.
-- The IAP tunnel is `lib/tunnel.ts`: `gcloud compute start-iap-tunnel <instance> 22 --local-host-port=localhost:<port>` (a documented flag; the hidden `--listen-on-stdin` is not used), ready when the port accepts a connection, closed after the ssh call. `gcloud auth activate-service-account` runs before every tunnel with `CLOUDSDK_CONFIG` under `~/.specialists/work/gcloud` and `CLOUDSDK_PYTHON` from the config, because the Homebrew cask ships no interpreter.
+- `edge` retries one SSH call through the IAP tunnel when the first connection is closed during setup (`isTransientSshFailure`: exit 255 with "closed by remote host" or a reset), except `reboot`. The IAP tunnel is `lib/tunnel.ts`: `gcloud compute start-iap-tunnel <instance> 22 --local-host-port=localhost:<port>` (a documented flag; the hidden `--listen-on-stdin` is not used), ready when the port accepts a connection, closed after the ssh call. `gcloud auth activate-service-account` runs before every tunnel with `CLOUDSDK_CONFIG` under `~/.specialists/work/gcloud` and `CLOUDSDK_PYTHON` from the config, because the Homebrew cask ships no interpreter.
 - `dns` builds every Technitium call from `TECHNITIUM_READS` and `TECHNITIUM_WRITES`; `key=value` record parameters pass through by name (`token` and `node` refused) because the API documents dozens of type-specific parameters. Writes are refused on the secondary in code: the catalog zone is the only replication path.
 - `security` parses Wazuh alert lines locally (`summariseWazuh`, `summariseVulns`) so the guest never needs `jq`; `wazuh-vulns` is a local view over the same `wazuh-alerts` dump, not a guest command.
 - TLS pinning for self-signed consoles is `lib/pinned.ts` (`pinnedRequest`); `network` and `proxmox` use it with a `*CertSha256` config value obtained once through the wrapper's `fingerprint` command.

package/specialists/README.md

@@ -8,7 +8,7 @@ A specialist is a Pi subagent that is the only way to operate one area of the ho
 | `astro.identity` | Zitadel; Pomerium, nginx, lego on VM 104; `02-pulsar-proxmox/dmz/` in the homelab repository | Any Zitadel API call (v2, management, admin, auth) with responses redacted; `dmz status|journal|config-template|render|pomerium-restart|nginx-reload|lego-renew|deploy-config`; `git` on the homelab checkout, writes limited to `02-pulsar-proxmox/dmz/` |
 | `astro.network` | UniFi, FreeRADIUS (LXC 108), Tailscale (LXC 105) | Read UniFi sites, devices, clients, networks, zones, firewall policies, WANs; create, update, delete firewall policies; RADIUS and Tailscale checks on Pulsar |
 | `astro.dns` | Technitium primary (Synapse) and secondary (LXC 107); Cloudflare zones `37pla.net`, `monadeo.com` | Read zones and records on both resolvers, resolve, stats; create and delete zones, add, update, delete records on the primary; Cloudflare zones and record add, update, delete |
-| `astro.edge` | Frontdoor VPS (`frontdoor-1337`) over an IAP tunnel; `00-frontdoor-vps/` in the homelab repository | `probe` the public path; `vps status|nginx-conf|nginx-test|journal|wg|bouncer|updates|package|auto-upgrades|deploy-nginx|reboot --confirm`; `git` on the homelab checkout, writes limited to `00-frontdoor-vps/` |
+| `astro.edge` | Frontdoor VPS (`frontdoor-1337`) over an IAP tunnel; `00-frontdoor-vps/` in the homelab repository | `probe` the public path; `vps status|nginx-conf|nginx-test|journal|wg|bouncer|updates|package|changelog|auto-upgrades|deploy-nginx|reboot --confirm`; `git` on the homelab checkout, writes limited to `00-frontdoor-vps/` |
 | `astro.security` | Wazuh, CrowdSec, rsyslog archive on VM 106 | Read-only: `status`, `attention`, `agents`, `alerts`, `decisions`, `bouncers`, `metrics`, `wazuh-alerts`, `wazuh-vulns`, `wazuh-log`, `remote-hosts`, `remote-log`, `journal` |
 | `astro.backup` | vzdump, the shared Restic repository (Pulsar host config, Arcane app backups), GCS offsite from LXC 102 | Status, journals, and manual runs of every layer; `restic-snapshots|stats|ls`, `restic-restore` into `/var/tmp/spc-restore` on Pulsar, `restore-clean` |
 | `astro.proxmox` | Proxmox VE on Pulsar | API token: `guests`, `guest`, `get <path>`, `tasks`; `start`, `shutdown|reboot|stop --confirm`; snapshots create, delete, rollback; `set` of CPU, memory, options, network. Pulsar key: `host-status`, `host-journal`, `updates`, `guest-exec <vmid> <status|journal|df|updates>` |

package/specialists/edge/run.ts

@@ -61,6 +61,7 @@ export const VPS_COMMANDS: Readonly<Record<string, { args: number; help: string;
     bouncer: { args: 0, help: "crowdsec-firewall-bouncer status and the nftables block set" },
     updates: { args: 0, help: "upgradable packages (local index, not refreshed) and the packages that need a reboot" },
     package: { args: 1, help: "package <name>    refresh the apt index, then installed and candidate versions of one package" },
+    changelog: { args: 1, help: "changelog <name>  Debian changelog of the candidate version, first 80 lines; it names the CVEs each upload fixes" },
     "auto-upgrades": { args: 0, help: "unattended-upgrades: apt timers, last daily runs, recent log, dpkg upgrades" },
     "deploy-nginx": { args: 0, help: "install the tracked nginx.conf from the pushed homelab checkout (nginx -t, install, reload)", stdin: true },
     reboot: { args: 0, help: "systemctl reboot (needs --confirm)" },
@@ -84,6 +85,11 @@ ${REPO_HELP}
 
 deploy-nginx refuses when the checkout is dirty or differs from origin: commit and push first.`;
 
+/** The first connection through a fresh IAP tunnel is sometimes closed before sshd answers; that failure is safe to retry once. */
+export function isTransientSshFailure(result: { code: number; stderr: string }): boolean {
+    return result.code === 255 && /closed by remote host|connection reset|connection refused|kex_exchange_identification/i.test(result.stderr);
+}
+
 export function buildVpsRemote(args: string[]): { remote: string; stdin: boolean } {
     const [name, ...rest] = args;
     const spec = name === undefined ? undefined : VPS_COMMANDS[name];
@@ -97,7 +103,7 @@ export function buildVpsRemote(args: string[]): { remote: string; stdin: boolean
         if (!VPS_UNITS.includes(rest[0])) throw new UsageError(`unit must be one of ${VPS_UNITS.join(", ")}`);
         if (!SINCE.test(rest[1])) throw new UsageError("since: letters, digits, spaces, colon, plus, minus only");
     }
-    if (name === "package" && !PACKAGE.test(rest[0])) throw new UsageError("package: a Debian package name (lower-case letters, digits, + - .)");
+    if ((name === "package" || name === "changelog") && !PACKAGE.test(rest[0])) throw new UsageError(`${name}: a Debian package name (lower-case letters, digits, + - .)`);
     return { remote: [name, ...rest].join(" "), stdin: spec.stdin === true };
 }
 
@@ -137,20 +143,20 @@ async function overTunnel(config: EdgeConfig, remote: string, timeoutMs: number,
         ],
         { env: gcloudEnv(config), port: config.iapLocalPort, readyTimeoutMs: 45_000 },
     );
+    const target = {
+        host: "127.0.0.1",
+        port: config.iapLocalPort,
+        hostKeyAlias: config.instance,
+        user: config.sshUser,
+        keyFile: secretPath(SERVICE, "SSH_KEY_FRONTDOOR"),
+        knownHostsFile: join(specialistsHome(), "config", "known_hosts"),
+    };
     try {
-        return await sshFixed(
-            {
-                host: "127.0.0.1",
-                port: config.iapLocalPort,
-                hostKeyAlias: config.instance,
-                user: config.sshUser,
-                keyFile: secretPath(SERVICE, "SSH_KEY_FRONTDOOR"),
-                knownHostsFile: join(specialistsHome(), "config", "known_hosts"),
-            },
-            remote,
-            timeoutMs,
-            input,
-        );
+        const first = await sshFixed(target, remote, timeoutMs, input);
+        // A connection closed during setup never ran the command; a reboot is the one command not to repeat.
+        if (!isTransientSshFailure(first) || remote === "reboot") return first;
+        await new Promise((resolve) => setTimeout(resolve, 2000));
+        return await sshFixed(target, remote, timeoutMs, input);
     } finally {
         await tunnel.close();
     }

package/specialists/entry/remote/spc-edge-frontdoor-entry.sh

@@ -42,6 +42,10 @@ case "$name" in
     dpkg-query -W -f='${Package} ${Version} ${db:Status-Abbrev}\n' "$pkg" 2>&1 || true
     echo "policy:"
     apt-cache policy "$pkg" ;;
+  changelog)
+    pkg="$rest"
+    printf '%s' "$pkg" | grep -Eq '^[a-z0-9][a-z0-9+.-]{0,63}$' || { echo "bad package name" >&2; exit 2; }
+    apt-get changelog "$pkg" 2>&1 | head -n 80 ;;
   auto-upgrades)
     systemctl list-timers apt-daily.timer apt-daily-upgrade.timer --all --no-pager
     echo "--- apt-daily and apt-daily-upgrade journal, 3 days:"

package/specialists/security/run.ts

@@ -265,6 +265,10 @@ export interface VulnerabilitySummary {
     count: number;
     active: number;
     solved: number;
+    /** Latest event per agent, package, installed version and CVE whose status is still Active: the findings that are open now. */
+    open: VulnerabilityItem[];
+    /** Open findings whose condition is "Package default status": the feed knows no fixed version, so no version clears them. */
+    openWithoutFixVersion: number;
     items: VulnerabilityItem[];
 }
 
@@ -375,12 +379,20 @@ export function summariseVulns(text: string, days: number, agent: string | null,
         });
     }
     items.sort((x, y) => y.timestamp.localeCompare(x.timestamp));
+    const latest = new Map<string, VulnerabilityItem>();
+    for (const item of items) {
+        const key = `${item.agent}|${item.package}|${item.version}|${item.cve}`;
+        if (!latest.has(key)) latest.set(key, item);
+    }
+    const open = [...latest.values()].filter((i) => i.status.toLowerCase() === "active");
     return {
         days,
         agent,
         count: items.length,
         active: items.filter((i) => i.status.toLowerCase() === "active").length,
         solved: items.filter((i) => i.status.toLowerCase() === "solved").length,
+        open: open.slice(0, 50),
+        openWithoutFixVersion: open.filter((i) => i.condition === "Package default status").length,
         items: items.slice(0, 50),
     };
 }

package/specialists/wrappers.test.ts

@@ -5,7 +5,7 @@ import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { refusedPrefix, command as arcaneCommand } from "./arcane/run.ts";
 import { buildBackupRemote, command as backupCommand } from "./backup/run.ts";
 import { parseParams, parseRecordFilters, technitiumRequest, command as dnsCommand } from "./dns/run.ts";
-import { buildVpsRemote, command as edgeCommand } from "./edge/run.ts";
+import { buildVpsRemote, command as edgeCommand, isTransientSshFailure } from "./edge/run.ts";
 import { API_PREFIXES, buildDmzRemote, validateApiPath, command as identityCommand } from "./identity/run.ts";
 import { buildInferenceRemote, compactReleases, command as inferenceCommand } from "./inference/run.ts";
 import { UsageError } from "./lib/errors.ts";
@@ -194,6 +194,11 @@ describe("edge wrapper", () => {
         expect(() => buildVpsRemote(["wg", "extra"])).toThrow(/0 argument/);
         expect(buildVpsRemote(["package", "libunbound8"])).toEqual({ remote: "package libunbound8", stdin: false });
         expect(buildVpsRemote(["auto-upgrades"])).toEqual({ remote: "auto-upgrades", stdin: false });
+        expect(buildVpsRemote(["changelog", "unbound"])).toEqual({ remote: "changelog unbound", stdin: false });
+        expect(() => buildVpsRemote(["changelog", "../x"])).toThrow(/changelog/);
+        expect(isTransientSshFailure({ code: 255, stderr: "Connection to 127.0.0.1 closed by remote host.\r\n" })).toBe(true);
+        expect(isTransientSshFailure({ code: 255, stderr: "Permission denied (publickey)." })).toBe(false);
+        expect(isTransientSshFailure({ code: 2, stderr: "refused: shell" })).toBe(false);
         expect(() => buildVpsRemote(["package", "Lib;rm"])).toThrow(/package/);
         expect(() => buildVpsRemote(["package"])).toThrow(/1 argument/);
         expect(() => buildVpsRemote(["shell"])).toThrow(/unknown vps command/);
@@ -263,6 +268,36 @@ describe("security wrapper", () => {
         expect(summary.items[0]).toMatchObject({ agent: "frontdoor-1337", cve: "CVE-2026-50252", score: 9.8, status: "Active", package: "libunbound8", version: "1.26.0-1", condition: "Package less than 1.26.1-0+deb13u1", references: ["https://a", "https://b"], level: 13 });
         expect(summary.items[1]).toMatchObject({ cve: "CVE-2016-4484", score: 6.8, status: "Fixed", references: ["https://x", "https://y"] });
         expect(summariseVulns([modern, legacy].join("\n"), 3, "dmz", now).items.map((i) => i.agent)).toEqual(["dmz"]);
+        const solvedLater = JSON.stringify({
+            timestamp: "2026-09-20T07:07:48.433+0000",
+            rule: { id: "23502", level: 3, description: "CVE-2026-50252 affecting libunbound8 was solved" },
+            agent: { name: "frontdoor-1337" },
+            data: { vulnerability: { cve: "CVE-2026-50252", status: "Solved", package: { name: "libunbound8", version: "1.26.0-1" } } },
+        });
+        const unfixed = JSON.stringify({
+            timestamp: "2026-09-20T07:07:47.672+0000",
+            rule: { id: "23504", level: 7, description: "CVE-2026-55990 affects libunbound8" },
+            agent: { name: "frontdoor-1337" },
+            data: { vulnerability: { cve: "CVE-2026-55990", severity: "Medium", status: "Active", package: { name: "libunbound8", version: "1.26.1-0+deb13u1", condition: "Package default status" } } },
+        });
+        // After an upgrade Wazuh closes the CVE on the old version and may reopen it on the new one; the version keeps them apart.
+        const activeNew = JSON.stringify({
+            timestamp: "2026-09-20T07:07:47.889+0000",
+            rule: { id: "23506", level: 13, description: "CVE-2026-50252 affects libunbound8" },
+            agent: { name: "frontdoor-1337" },
+            data: { vulnerability: { cve: "CVE-2026-50252", severity: "Critical", status: "Active", package: { name: "libunbound8", version: "1.26.1-0+deb13u1", condition: "Package default status" }, score: { base: 9.3 } } },
+        });
+        const solvedOld = JSON.stringify({
+            timestamp: "2026-09-20T07:07:48.433+0000",
+            rule: { id: "23502", level: 3, description: "CVE-2026-50252 affecting libunbound8 was solved" },
+            agent: { name: "frontdoor-1337" },
+            data: { vulnerability: { cve: "CVE-2026-50252", status: "Solved", package: { name: "libunbound8", version: "1.22.0-2+deb13u3" } } },
+        });
+        const paired = summariseVulns([modern, solvedLater, unfixed, activeNew, solvedOld].join("\n"), 3, null, now);
+        expect(paired.open.map((i) => `${i.cve}@${i.version}`)).toEqual(["CVE-2026-50252@1.26.1-0+deb13u1", "CVE-2026-55990@1.26.1-0+deb13u1"]);
+        expect(paired.openWithoutFixVersion).toBe(2);
+        expect(paired.active).toBe(3);
+        expect(paired.solved).toBe(2);
         expect(summariseVulns(modern, 1, null, now + 3 * 86_400_000).count).toBe(0);
     });