@astrofoundry/pi-astro 0.26.1 → 0.26.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrofoundry/pi-astro",
-  "version": "0.26.1",
+  "version": "0.26.3",
   "description": "Personal pi customizations (extensions, subagents, skills, prompts, themes) for the pi coding agent.",
   "keywords": [
     "pi-package"

package/skills/security/SKILL.md

@@ -19,7 +19,7 @@ The `security` tool is read-only. Every call is a fixed command on the guest; `[
 | `bouncers` | bouncers JSON (`name`, `last_pull`, `revoked`) |
 | `metrics` | `cscli metrics -o json` |
 | `wazuh-alerts <days> <minLevel>` | summary: count, groups by rule and agent, latest 20 (log line truncated to 200 chars) |
-| `wazuh-vulns <days> [agent]` | vulnerability alerts only: `open` (latest event per agent, package and CVE that is still Active), `openWithoutFixVersion`, `active` and `solved` counts, and `items` (every event, newest first) with `cve`, `severity`, `score`, `status`, `package`, installed `version`, `condition`, `references` |
+| `wazuh-vulns <days> [agent]` | vulnerability alerts only: `open` (latest event per agent, package, installed version and CVE that is still Active), `openWithoutFixVersion`, `active` and `solved` counts, and `items` (every event, newest first) with `cve`, `severity`, `score`, `status`, `package`, installed `version`, `condition`, `references` |
 | `wazuh-log <lines>` | manager container log |
 | `remote-hosts` | `host/program.log` names in the archive |
 | `remote-log <host> <program> <lines>` | tail of one archived log, e.g. `remote-log frontdoor-1337 nginx-stream 200` |

package/specialists/AGENTS.md

@@ -41,7 +41,8 @@ Wrappers ship as TypeScript and run under Node 24 type stripping: erasable synta
 - Fixed remote commands: `DMZ_COMMANDS`, `PULSAR_COMMANDS`, `VPS_COMMANDS`, `OBS_COMMANDS`, `BACKUP_COMMANDS`, `HOST_COMMANDS`, and `INFERENCE_COMMANDS` must match the entry scripts in `entry/remote/` and their tracked copies in the homelab repository (`02-pulsar-proxmox/dmz/system/`, `02-pulsar-proxmox/pulsar/system/`, `00-frontdoor-vps/system/`, `02-pulsar-proxmox/observability/system/`, `02-pulsar-proxmox/hermes/system/`, `04-nexus-macstudio/system/`, and `host/` of the `astronaute77/arcane` repository). Pulsar's root `authorized_keys` carries one forced key per specialist (network, backup, proxmox, inference), each pinned to its own entry script. Change both sides in the same commit and redeploy the remote script. A new privileged step on the VPS also needs its exact line in `spc-edge-frontdoor-sudoers`.
 - Repository access is `lib/repo.ts` (`repoCommand`, `RepoSpec`, `trackedFile`): one clone per specialist under `~/.specialists/work/<checkoutName>` (`homelab-edge`, `homelab-identity`; never share a checkout between specialists), a write deploy key, and an optional `writeRoot` that limits `git write`. `edge` (`deploy-nginx`) and `identity` (`dmz deploy-config`) deploy only what origin has: `trackedFile` refuses a dirty, ahead, or behind checkout. The DMZ entry keeps the previous template and restores it when render or restart fails.
 - `network` firewall policy writes are `policyWrite`: JSON body from the agent, checked for the documented required fields, sent as `POST`, `PUT`, or `DELETE` through the same pinned request; UniFi validates the rest.
-- The IAP tunnel is `lib/tunnel.ts`: `gcloud compute start-iap-tunnel <instance> 22 --local-host-port=localhost:<port>` (a documented flag; the hidden `--listen-on-stdin` is not used), ready when the port accepts a connection, closed after the ssh call. `gcloud auth activate-service-account` runs before every tunnel with `CLOUDSDK_CONFIG` under `~/.specialists/work/gcloud` and `CLOUDSDK_PYTHON` from the config, because the Homebrew cask ships no interpreter.
+- Pi executes sibling tool calls in parallel, so two wrapper processes of the same specialist can run at once. `lib/lock.ts` (`withLock`, a directory lock under `~/.specialists/work/locks`, stale after 10 minutes) serialises shared resources; `edge` holds `edge-tunnel` around the fixed IAP port and the gcloud configuration directory. `repo.ts` checkouts are not locked yet.
+- `edge` retries one SSH call through the IAP tunnel when the first connection is closed during setup (`isTransientSshFailure`: exit 255 with "closed by remote host" or a reset), except `reboot`. The IAP tunnel is `lib/tunnel.ts`: `gcloud compute start-iap-tunnel <instance> 22 --local-host-port=localhost:<port>` (a documented flag; the hidden `--listen-on-stdin` is not used), ready when the port accepts a connection, closed after the ssh call. `gcloud auth activate-service-account` runs before every tunnel with `CLOUDSDK_CONFIG` under `~/.specialists/work/gcloud` and `CLOUDSDK_PYTHON` from the config, because the Homebrew cask ships no interpreter.
 - `dns` builds every Technitium call from `TECHNITIUM_READS` and `TECHNITIUM_WRITES`; `key=value` record parameters pass through by name (`token` and `node` refused) because the API documents dozens of type-specific parameters. Writes are refused on the secondary in code: the catalog zone is the only replication path.
 - `security` parses Wazuh alert lines locally (`summariseWazuh`, `summariseVulns`) so the guest never needs `jq`; `wazuh-vulns` is a local view over the same `wazuh-alerts` dump, not a guest command.
 - TLS pinning for self-signed consoles is `lib/pinned.ts` (`pinnedRequest`); `network` and `proxmox` use it with a `*CertSha256` config value obtained once through the wrapper's `fingerprint` command.

package/specialists/edge/run.ts

@@ -1,6 +1,7 @@
 import { join } from "node:path";
 import { readConfig } from "../lib/config.ts";
 import { ServiceError, UsageError } from "../lib/errors.ts";
+import { withLock } from "../lib/lock.ts";
 import { main } from "../lib/main.ts";
 import { printJson, printRaw } from "../lib/output.ts";
 import { specialistsHome, workDir } from "../lib/paths.ts";
@@ -85,6 +86,11 @@ ${REPO_HELP}
 
 deploy-nginx refuses when the checkout is dirty or differs from origin: commit and push first.`;
 
+/** The first connection through a fresh IAP tunnel is sometimes closed before sshd answers; that failure is safe to retry once. */
+export function isTransientSshFailure(result: { code: number; stderr: string }): boolean {
+    return result.code === 255 && /closed by remote host|connection reset|connection refused|kex_exchange_identification/i.test(result.stderr);
+}
+
 export function buildVpsRemote(args: string[]): { remote: string; stdin: boolean } {
     const [name, ...rest] = args;
     const spec = name === undefined ? undefined : VPS_COMMANDS[name];
@@ -120,7 +126,12 @@ async function activateServiceAccount(config: EdgeConfig): Promise<void> {
 }
 
 /** Opens the IAP tunnel, runs one fixed command over it, closes the tunnel. */
-async function overTunnel(config: EdgeConfig, remote: string, timeoutMs: number, input?: string): Promise<{ stdout: string; stderr: string; code: number }> {
+/** One tunnel at a time: the local port and the gcloud configuration directory are shared by every edge process. */
+function overTunnel(config: EdgeConfig, remote: string, timeoutMs: number, input?: string): Promise<{ stdout: string; stderr: string; code: number }> {
+    return withLock("edge-tunnel", () => tunnelCall(config, remote, timeoutMs, input), { timeoutMs: timeoutMs + 60_000 });
+}
+
+async function tunnelCall(config: EdgeConfig, remote: string, timeoutMs: number, input?: string): Promise<{ stdout: string; stderr: string; code: number }> {
     await activateServiceAccount(config);
     const tunnel = await openTunnel(
         config.gcloud,
@@ -138,20 +149,20 @@ async function overTunnel(config: EdgeConfig, remote: string, timeoutMs: number,
         ],
         { env: gcloudEnv(config), port: config.iapLocalPort, readyTimeoutMs: 45_000 },
     );
+    const target = {
+        host: "127.0.0.1",
+        port: config.iapLocalPort,
+        hostKeyAlias: config.instance,
+        user: config.sshUser,
+        keyFile: secretPath(SERVICE, "SSH_KEY_FRONTDOOR"),
+        knownHostsFile: join(specialistsHome(), "config", "known_hosts"),
+    };
     try {
-        return await sshFixed(
-            {
-                host: "127.0.0.1",
-                port: config.iapLocalPort,
-                hostKeyAlias: config.instance,
-                user: config.sshUser,
-                keyFile: secretPath(SERVICE, "SSH_KEY_FRONTDOOR"),
-                knownHostsFile: join(specialistsHome(), "config", "known_hosts"),
-            },
-            remote,
-            timeoutMs,
-            input,
-        );
+        const first = await sshFixed(target, remote, timeoutMs, input);
+        // A connection closed during setup never ran the command; a reboot is the one command not to repeat.
+        if (!isTransientSshFailure(first) || remote === "reboot") return first;
+        await new Promise((resolve) => setTimeout(resolve, 2000));
+        return await sshFixed(target, remote, timeoutMs, input);
     } finally {
         await tunnel.close();
     }

package/specialists/lib/lock.test.ts

@@ -0,0 +1,42 @@
+import { existsSync, mkdirSync, mkdtempSync, rmSync, utimesSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { withLock } from "./lock.ts";
+
+describe("withLock", () => {
+    let dir: string;
+    beforeEach(() => {
+        dir = mkdtempSync(join(tmpdir(), "astro-lock-"));
+    });
+    afterEach(() => rmSync(dir, { recursive: true, force: true }));
+
+    it("serialises concurrent holders and releases the lock afterwards", async () => {
+        const order: string[] = [];
+        const hold = (tag: string, ms: number) =>
+            withLock("edge", async () => {
+                order.push(`${tag} start`);
+                await new Promise((r) => setTimeout(r, ms));
+                order.push(`${tag} end`);
+            }, { dir });
+        await Promise.all([hold("a", 120), hold("b", 10)]);
+        expect(order).toEqual(["a start", "a end", "b start", "b end"]);
+        expect(existsSync(join(dir, "edge.lock"))).toBe(false);
+    });
+
+    it("removes a stale lock and reports a busy one", async () => {
+        const lock = join(dir, "edge.lock");
+        mkdirSync(lock);
+        const old = new Date(Date.now() - 20 * 60_000);
+        utimesSync(lock, old, old);
+        expect(await withLock("edge", async () => "ran", { dir })).toBe("ran");
+        mkdirSync(lock);
+        await expect(withLock("edge", async () => "never", { dir, timeoutMs: 300 })).rejects.toThrow(/busy/);
+        expect(existsSync(lock)).toBe(true);
+    });
+
+    it("releases the lock when the work throws", async () => {
+        await expect(withLock("edge", async () => { throw new Error("boom"); }, { dir })).rejects.toThrow("boom");
+        expect(existsSync(join(dir, "edge.lock"))).toBe(false);
+    });
+});

package/specialists/lib/lock.ts

@@ -0,0 +1,49 @@
+import { mkdirSync, rmSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { ServiceError } from "./errors.ts";
+import { workDir } from "./paths.ts";
+
+/** A lock older than this belongs to a process that died without releasing it. */
+const STALE_MS = 10 * 60_000;
+
+function sleep(ms: number): Promise<void> {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+/**
+ * Runs `fn` while holding an exclusive directory lock, so concurrent wrapper
+ * processes (Pi runs sibling tool calls in parallel) take turns on a shared
+ * resource such as a fixed tunnel port or a gcloud configuration directory.
+ */
+export async function withLock<T>(name: string, fn: () => Promise<T>, options: { dir?: string; timeoutMs?: number; staleMs?: number } = {}): Promise<T> {
+    const root = options.dir ?? workDir("locks");
+    const lock = join(root, `${name}.lock`);
+    const deadline = Date.now() + (options.timeoutMs ?? 120_000);
+    mkdirSync(root, { recursive: true, mode: 0o700 });
+    for (;;) {
+        try {
+            mkdirSync(lock);
+            break;
+        } catch (err) {
+            if ((err as NodeJS.ErrnoException).code !== "EEXIST") throw err;
+        }
+        let age: number;
+        try {
+            age = Date.now() - statSync(lock).mtimeMs;
+        } catch {
+            // The holder released it between our attempt and the check; try again at once.
+            continue;
+        }
+        if (age > (options.staleMs ?? STALE_MS)) {
+            rmSync(lock, { recursive: true, force: true });
+            continue;
+        }
+        if (Date.now() > deadline) throw new ServiceError(`${name} is busy: another call has held it for ${Math.round(age / 1000)} s`);
+        await sleep(200);
+    }
+    try {
+        return await fn();
+    } finally {
+        rmSync(lock, { recursive: true, force: true });
+    }
+}

package/specialists/security/run.ts

@@ -265,7 +265,7 @@ export interface VulnerabilitySummary {
     count: number;
     active: number;
     solved: number;
-    /** Latest event per agent, package and CVE whose status is still Active: the findings that are open now. */
+    /** Latest event per agent, package, installed version and CVE whose status is still Active: the findings that are open now. */
     open: VulnerabilityItem[];
     /** Open findings whose condition is "Package default status": the feed knows no fixed version, so no version clears them. */
     openWithoutFixVersion: number;
@@ -381,7 +381,7 @@ export function summariseVulns(text: string, days: number, agent: string | null,
     items.sort((x, y) => y.timestamp.localeCompare(x.timestamp));
     const latest = new Map<string, VulnerabilityItem>();
     for (const item of items) {
-        const key = `${item.agent}|${item.package}|${item.cve}`;
+        const key = `${item.agent}|${item.package}|${item.version}|${item.cve}`;
         if (!latest.has(key)) latest.set(key, item);
     }
     const open = [...latest.values()].filter((i) => i.status.toLowerCase() === "active");

package/specialists/wrappers.test.ts

@@ -5,7 +5,7 @@ import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { refusedPrefix, command as arcaneCommand } from "./arcane/run.ts";
 import { buildBackupRemote, command as backupCommand } from "./backup/run.ts";
 import { parseParams, parseRecordFilters, technitiumRequest, command as dnsCommand } from "./dns/run.ts";
-import { buildVpsRemote, command as edgeCommand } from "./edge/run.ts";
+import { buildVpsRemote, command as edgeCommand, isTransientSshFailure } from "./edge/run.ts";
 import { API_PREFIXES, buildDmzRemote, validateApiPath, command as identityCommand } from "./identity/run.ts";
 import { buildInferenceRemote, compactReleases, command as inferenceCommand } from "./inference/run.ts";
 import { UsageError } from "./lib/errors.ts";
@@ -196,6 +196,9 @@ describe("edge wrapper", () => {
         expect(buildVpsRemote(["auto-upgrades"])).toEqual({ remote: "auto-upgrades", stdin: false });
         expect(buildVpsRemote(["changelog", "unbound"])).toEqual({ remote: "changelog unbound", stdin: false });
         expect(() => buildVpsRemote(["changelog", "../x"])).toThrow(/changelog/);
+        expect(isTransientSshFailure({ code: 255, stderr: "Connection to 127.0.0.1 closed by remote host.\r\n" })).toBe(true);
+        expect(isTransientSshFailure({ code: 255, stderr: "Permission denied (publickey)." })).toBe(false);
+        expect(isTransientSshFailure({ code: 2, stderr: "refused: shell" })).toBe(false);
         expect(() => buildVpsRemote(["package", "Lib;rm"])).toThrow(/package/);
         expect(() => buildVpsRemote(["package"])).toThrow(/1 argument/);
         expect(() => buildVpsRemote(["shell"])).toThrow(/unknown vps command/);
@@ -277,10 +280,24 @@ describe("security wrapper", () => {
             agent: { name: "frontdoor-1337" },
             data: { vulnerability: { cve: "CVE-2026-55990", severity: "Medium", status: "Active", package: { name: "libunbound8", version: "1.26.1-0+deb13u1", condition: "Package default status" } } },
         });
-        const paired = summariseVulns([modern, solvedLater, unfixed].join("\n"), 3, null, now);
-        expect(paired.open.map((i) => i.cve)).toEqual(["CVE-2026-55990"]);
-        expect(paired.openWithoutFixVersion).toBe(1);
-        expect(paired.active).toBe(2);
+        // After an upgrade Wazuh closes the CVE on the old version and may reopen it on the new one; the version keeps them apart.
+        const activeNew = JSON.stringify({
+            timestamp: "2026-09-20T07:07:47.889+0000",
+            rule: { id: "23506", level: 13, description: "CVE-2026-50252 affects libunbound8" },
+            agent: { name: "frontdoor-1337" },
+            data: { vulnerability: { cve: "CVE-2026-50252", severity: "Critical", status: "Active", package: { name: "libunbound8", version: "1.26.1-0+deb13u1", condition: "Package default status" }, score: { base: 9.3 } } },
+        });
+        const solvedOld = JSON.stringify({
+            timestamp: "2026-09-20T07:07:48.433+0000",
+            rule: { id: "23502", level: 3, description: "CVE-2026-50252 affecting libunbound8 was solved" },
+            agent: { name: "frontdoor-1337" },
+            data: { vulnerability: { cve: "CVE-2026-50252", status: "Solved", package: { name: "libunbound8", version: "1.22.0-2+deb13u3" } } },
+        });
+        const paired = summariseVulns([modern, solvedLater, unfixed, activeNew, solvedOld].join("\n"), 3, null, now);
+        expect(paired.open.map((i) => `${i.cve}@${i.version}`)).toEqual(["CVE-2026-50252@1.26.1-0+deb13u1", "CVE-2026-55990@1.26.1-0+deb13u1"]);
+        expect(paired.openWithoutFixVersion).toBe(2);
+        expect(paired.active).toBe(3);
+        expect(paired.solved).toBe(2);
         expect(summariseVulns(modern, 1, null, now + 3 * 86_400_000).count).toBe(0);
     });