@astrofoundry/pi-astro 0.26.3 → 0.26.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrofoundry/pi-astro",
-  "version": "0.26.3",
+  "version": "0.26.4",
   "description": "Personal pi customizations (extensions, subagents, skills, prompts, themes) for the pi coding agent.",
   "keywords": [
     "pi-package"

package/skills/edge/SKILL.md

@@ -23,7 +23,7 @@ Fetches `https://auth.37pla.net/.well-known/openid-configuration` through the VP
 | `bouncer` | bouncer unit status and the nftables set of blocked addresses |
 | `updates` | upgradable packages from the local apt index (not refreshed, so it can lag the mirror) and the packages that need a reboot |
 | `package <name>` | refreshes the apt index, then the installed version (`dpkg-query`) and the candidate with its origin (`apt-cache policy`) |
-| `changelog <name>` | first 80 lines of the candidate's Debian changelog from the Debian servers; each security upload lists the CVEs it fixes, so this is the proof that a version fixes a CVE |
+| `changelog <name>` | first 80 lines of the Debian changelog: the installed package's own copy from `/usr/share/doc`, or the candidate's from the Debian servers when nothing is installed; each security upload lists the CVEs it fixes, so this is the proof that a version fixes a CVE. The servers answer 404 for many fresh security uploads; the installed copy does not have that problem |
 | `auto-upgrades` | the apt timers with their next run, the last three days of `apt-daily` and `apt-daily-upgrade` journal, the unattended-upgrades log tail, and the last dpkg upgrades |
 | `deploy-nginx` | install the tracked `nginx.conf`: `nginx -t` on the staged file, install, `nginx -t`, reload |
 | `reboot --confirm` | `systemctl reboot` |

package/specialists/edge/run.ts

@@ -62,7 +62,7 @@ export const VPS_COMMANDS: Readonly<Record<string, { args: number; help: string;
     bouncer: { args: 0, help: "crowdsec-firewall-bouncer status and the nftables block set" },
     updates: { args: 0, help: "upgradable packages (local index, not refreshed) and the packages that need a reboot" },
     package: { args: 1, help: "package <name>    refresh the apt index, then installed and candidate versions of one package" },
-    changelog: { args: 1, help: "changelog <name>  Debian changelog of the candidate version, first 80 lines; it names the CVEs each upload fixes" },
+    changelog: { args: 1, help: "changelog <name>  Debian changelog, first 80 lines: the installed package's own copy, else the candidate's from the Debian servers; it names the CVEs each upload fixes" },
     "auto-upgrades": { args: 0, help: "unattended-upgrades: apt timers, last daily runs, recent log, dpkg upgrades" },
     "deploy-nginx": { args: 0, help: "install the tracked nginx.conf from the pushed homelab checkout (nginx -t, install, reload)", stdin: true },
     reboot: { args: 0, help: "systemctl reboot (needs --confirm)" },

package/specialists/entry/remote/spc-edge-frontdoor-entry.sh

@@ -45,7 +45,13 @@ case "$name" in
   changelog)
     pkg="$rest"
     printf '%s' "$pkg" | grep -Eq '^[a-z0-9][a-z0-9+.-]{0,63}$' || { echo "bad package name" >&2; exit 2; }
-    apt-get changelog "$pkg" 2>&1 | head -n 80 ;;
+    if [ -r "/usr/share/doc/$pkg/changelog.Debian.gz" ]; then
+      echo "installed changelog (/usr/share/doc/$pkg/changelog.Debian.gz):"
+      zcat "/usr/share/doc/$pkg/changelog.Debian.gz" | head -n 80
+    else
+      echo "no installed changelog under /usr/share/doc/$pkg; candidate changelog from the Debian servers:"
+      apt-get changelog "$pkg" 2>&1 | head -n 80
+    fi ;;
   auto-upgrades)
     systemctl list-timers apt-daily.timer apt-daily-upgrade.timer --all --no-pager
     echo "--- apt-daily and apt-daily-upgrade journal, 3 days:"