@astrofoundry/pi-astro 0.34.0 → 0.35.0

package/specialists/AGENTS.md

@@ -38,7 +38,7 @@ Wrappers ship as TypeScript and run under Node 24 type stripping: erasable synta
 - Config only through `readConfig(service, shape)`; every field required, no fallbacks, no env vars.
 - Exit codes: `UsageError` 2, `ServiceError` 1, success 0. Diagnostics on stderr, results on stdout, JSON where possible.
 - Output filters: Arcane responses pass `stripKeys(ARCANE_DENIED_KEYS)`; Zitadel responses pass `redactSecrets`. Add keys there rather than in a wrapper.
-- Fixed remote commands: `DMZ_COMMANDS`, `PULSAR_COMMANDS`, `VPS_COMMANDS`, `OBS_COMMANDS`, `BACKUP_COMMANDS`, `HOST_COMMANDS`, and `INFERENCE_COMMANDS` must match the entry scripts in `entry/remote/` and their tracked copies in the homelab repository (`02-pulsar-proxmox/dmz/system/`, `02-pulsar-proxmox/pulsar/system/`, `00-frontdoor-vps/system/`, `02-pulsar-proxmox/observability/system/`, `02-pulsar-proxmox/hermes/system/`, `04-nexus-macstudio/system/`, and `host/` of the `astronaute77/arcane` repository). Pulsar's root `authorized_keys` carries one forced key per specialist (network, backup, proxmox, inference), each pinned to its own entry script. Change both sides in the same commit and redeploy the remote script. A new privileged step on the VPS also needs its exact line in `spc-edge-frontdoor-sudoers`.
+- Fixed remote commands: `DMZ_COMMANDS`, `PULSAR_COMMANDS`, `VPS_COMMANDS`, `OBS_COMMANDS`, `BACKUP_COMMANDS`, `HOST_COMMANDS`, and `INFERENCE_COMMANDS` must match the entry scripts in `entry/remote/` and their tracked copies in the homelab repository (`02-pulsar-proxmox/dmz/system/`, `02-pulsar-proxmox/pulsar/system/`, `00-frontdoor-vps/system/`, `02-pulsar-proxmox/observability/system/`, `04-nexus-macstudio/system/`, and `host/` of the `astronaute77/arcane` repository). Pulsar's root `authorized_keys` carries one forced key per specialist (network, backup, proxmox), each pinned to its own entry script. Change both sides in the same commit and redeploy the remote script. A new privileged step on the VPS also needs its exact line in `spc-edge-frontdoor-sudoers`.
 - Repository access is `lib/repo.ts` (`repoCommand`, `RepoSpec`, `trackedFile`): one clone per specialist under `~/.specialists/work/<checkoutName>` (`homelab-edge`, `homelab-identity`; never share a checkout between specialists), a write deploy key, and an optional `writeRoot` that limits `git write`. `edge` (`deploy-nginx`) and `identity` (`dmz deploy-config`) deploy only what origin has: `trackedFile` refuses a dirty, ahead, or behind checkout. The DMZ entry keeps the previous template and restores it when render or restart fails.
 - `network` firewall policy writes are `policyWrite`: JSON body from the agent, checked for the documented required fields, sent as `POST`, `PUT`, or `DELETE` through the same pinned request; UniFi validates the rest.
 - Pi executes sibling tool calls in parallel, so two wrapper processes of the same specialist can run at once. `lib/lock.ts` (`withLock`, a directory lock under `~/.specialists/work/locks`, stale after 10 minutes) serialises shared resources; `edge` holds `edge-tunnel` around the fixed IAP port and the gcloud configuration directory. `repo.ts` checkouts are not locked yet.
@@ -47,16 +47,16 @@ Wrappers ship as TypeScript and run under Node 24 type stripping: erasable synta
 - `security` parses Wazuh alert lines locally (`summariseWazuh`, `summariseVulns`) so the guest never needs `jq`; `wazuh-vulns` is a local view over the same `wazuh-alerts` dump, not a guest command.
 - TLS pinning for self-signed consoles is `lib/pinned.ts` (`pinnedRequest`); `network` and `proxmox` use it with a `*CertSha256` config value obtained once through the wrapper's `fingerprint` command.
 - `proxmox` writes are typed commands, never a generic POST: power actions and snapshot changes go through `runTask`, which polls `/nodes/<node>/tasks/<upid>/status` until `stopped` and fails on any `exitstatus` but `OK`. `--confirm` is stripped by `needsConfirm` for every interrupting action. `SET_KEYS` mirrors the privileges of the `SpecialistGuest` role; the API refuses anything the role lacks, the wrapper refuses earlier.
-- `backup` and `inference` are pure forced-command wrappers with per-command timeouts (`timeoutMs` in the tables) because runs such as `vzdump-run` or `hermes-upgrade` take many minutes; the gate's `timeoutMs` in `specialists.json` must exceed the longest of them.
-- `inference` reads upstream release notes from the GitHub releases API (`hermes-releases`); the skill makes reading them a precondition of `hermes-upgrade`. The Europa check is HTTP only until Windows OpenSSH forced commands are verified.
+- `backup` and `inference` are pure forced-command wrappers with per-command timeouts (`timeoutMs` in the tables) because runs such as `vzdump-run` take many minutes; the gate's `timeoutMs` in `specialists.json` must exceed the longest of them.
+- `inference` reaches Nexus through one forced-command key. The Europa check is HTTP only until Windows OpenSSH forced commands are verified.
 - `REFUSED_PREFIXES` protects only the wrapper itself (`config`, `auth`, `self-update`, `completion`). The GitOps-first rule for managed projects lives in the skill and the agent prompt, not in code, because unmanaged projects and emergencies need the direct CLI.
 - The wrapper's repository commands are the `git` group; `gitops` must stay free because it is an `arcane-cli` command group (server-side syncs).
 - Every passthrough call writes a private per-call copy of `arcanecli.yml` with `jwt_token` set, because some `arcane-cli` commands validate the config file before reading `ARCANE_TOKEN`. The copy is removed after the call.
 - Every wrapper answers `--help` without reading config, so agents can discover subcommands before anything else is set up.
-- `entry/specialist-install.sh` runs as root, so it runs only `/usr/bin`, `/bin`, `/usr/sbin`, `/sbin` and the Node it installed, never Homebrew or anything else the main user can write; it checks that `/usr/local/libexec/specialist-node` and its parents belong to root and are writable by nobody else. Arguments are checked before the root test (tests exercise that part). Downloads go to a root-only temporary directory and are verified before use: Node against `SHASUMS256.txt` and the LTS flag in `index.json`, npm tarballs against the registry's `sha512` integrity, arcane-cli against the release's checksums file. Inside `/Users/specialist` it works only as `specialist` (`sudo -u specialist -H`), from a staging directory root hands over, so a link the specialist plants cannot redirect a root write. Each component switches by rename after a check (every installed wrapper's `--help`, `--version` of the new binary) and restores the previous copy when the check fails. Older versions are refused; `rollback` swaps current and previous. Homebrew's `bw` and `jq` (provision) and `gcloud` (edge) still run as `specialist`; that is a separate issue.
+- `entry/specialist-install.sh` runs as root, so it runs only `/usr/bin`, `/bin`, `/usr/sbin`, `/sbin` and the Node it installed, never Homebrew or anything else the main user can write; it checks that `/usr/local/libexec/specialist-node` (and each `specialist-<tool>` folder) and its parents belong to root and are writable by nobody else. Arguments are checked before the root test (tests exercise that part). Downloads go to a root-only temporary directory and are verified before use: Node against `SHASUMS256.txt` and the LTS flag in `index.json`, npm tarballs against the registry's `sha512` integrity, arcane-cli against the release's checksums file. Inside `/Users/specialist` it works only as `specialist` (`sudo -u specialist -H`), from a staging directory root hands over, so a link the specialist plants cannot redirect a root write. Each component switches by rename after a check (every installed wrapper's `--help`, `--version` of the new binary) and restores the previous copy when the check fails. Older versions are refused; `rollback` swaps current and previous. `python`, `gcloud`, `bw`, and `jq` follow the same rules: version folders under `/usr/local/libexec/specialist-<tool>/` behind the links `current` and `previous`, sealed `root:wheel` and not writable by others, smoke-tested as `specialist` before `current` moves; `python` refuses a switch that breaks the current gcloud. Consumers use the `current` paths: `provision.sh` for `bw` and `jq`, `edge.json` for `gcloud` and `gcloudPython`. Nothing a wrapper runs with secrets may come from Homebrew.
 - `main()` waits for stdout and stderr to flush before `process.exit`: on a pipe, exiting right after a write drops everything past the 64 KiB buffer, which cut large answers such as `projects list --all` until 2026-09-25 (`lib/flush.test.ts`).
 - `arcane update-report [--all]` is `lib/image-updates.ts` over `lib/registry.ts`: a fresh `images updates check --all`, then `projects list --all` for the stack and service of each image reference, then the registries' tag lists and manifest digests (anonymous bearer tokens from each registry's challenge; digests by HEAD, which Docker Hub does not count as a pull; lscr.io is read from ghcr.io). A floating or major-series tag is resolved to the release tag whose digest matches the running and the latest build, searching the newest tags of the three commonest release shapes; a fixed tag is compared with the newest tag of the same shape; a digest pin with the newest release. Checks older than one minute before the run count as stale and show as unknown. Private images (anonymous access refused with 401 or 403) are excluded from rows, counts, and table, listed in `privateImages`, and counted in the summary line. The table is fixed-width text for a code block, because Discord renders no Markdown tables.
-- `arcane host <command>` runs over the forced-command key of user `spc-arcane` on VM 100. `HOST_COMMANDS` in `lib/arcane-host.ts` must list exactly the operations of `entry/remote/spc-arcane-op.py` (a test compares them); the tracked copies live in the arcane repository's `host/` (`spc-arcane-host-entry`, `spc-arcane-op`, `spc-arcane-sudoers`, `spc-arcane-install.sh`) with the probes in `scripts/arcane_ops/`. The entry only splits words (letters, digits, space, `._:/+-`) and hands them to `sudo -n /usr/local/sbin/spc-arcane-op`, the one command its sudoers line allows; the op checks the name and every argument and runs the reviewed arcane-ops probes, which print only allowlisted fields. Manager steps (`manager-*`) are internal to `manager-upgrade`/`manager-rollback` and refused through `host`. Nothing on the host deletes data: a manager rollback restores the image and Compose file, not the data volume (R3 stays manual), `db-restore` only fills an empty database, and dumps are never pruned by the tool. `host-audit` compares the host's hashes with `host/<name>` of the `arcane-gitops` checkout after a pull.
+- `arcane host <command>` runs over the forced-command key of user `spc-arcane` on VM 100. `HOST_COMMANDS` in `lib/arcane-host.ts` must list exactly the operations of `entry/remote/spc-arcane-op.py` (a test compares them); the tracked copies live in the arcane repository's `host/` (`spc-arcane-host-entry`, `spc-arcane-op`, `spc-arcane-sudoers`, `spc-arcane-install.sh`) with the probes in `host/spc-arcane-probes/`. The entry only splits words (letters, digits, space, `._:/+-`) and hands them to `sudo -n /usr/local/sbin/spc-arcane-op`, the one command its sudoers line allows; the op checks the name and every argument and runs the reviewed arcane-ops probes, which print only allowlisted fields. Manager steps (`manager-*`) are internal to `manager-upgrade`/`manager-rollback` and refused through `host`. Nothing on the host deletes data: a manager rollback restores the image and Compose file, not the data volume (R3 stays manual), `db-restore` only fills an empty database, and dumps are never pruned by the tool. `host-audit` compares the host's hashes with `host/<name>` of the `arcane-gitops` checkout after a pull.
 - `arcane manager-upgrade <version>` (`lib/arcane-manager.ts`) follows arcane/AGENTS.md "Manager upgrades": the official image's revision label must equal the release tag's commit (GitHub API), `manager-prepare` records `compose.before.yaml` and every container before the pin commit, the pin goes through the `arcane-gitops` checkout (`git` is exported from `lib/repo.ts` for this), the wait polls `gitops list` and the deployed Compose hash every 30 s for up to 30 minutes, then pull, cold backup, `up -d --no-deps --pull never`, and checks. Any failure before the restart reverts the pin (`stopped`); a failed check after it reverts the pin and runs `manager-rollback` (`rolled back`). The answer always exits 0 with `status`, so the bridge and the agent both see it.
 - `media` runs trendarr unchanged: `trendarrCli` in `media.json` is its `dist/cli.js`, started with `process.execPath` because sudo's PATH has no node. Each call gets `HOME` set to a fresh `0700` directory under `~/.specialists/work/media/` that holds only `.trendarr/config.json` (`0600`, trendarr's own schema, built from the note fields and `media.json`) and is removed in `finally`; trendarr reads no environment variables and has no config flag, and Node's `os.homedir()` follows `$HOME` on POSIX. Every call passes `--json`; `init` is refused. An add prints trendarr's per-ID `results` and exits 0 even when trendarr exits 1 for a failed ID, because the gate shows only stderr on failure; other failures carry trendarr's stderr without its `warning:` lines, which go into the JSON as `warnings`. The bridge's slash commands and Add buttons call the same wrapper through the entry point (`extensions/astro-discord/media.ts`).
 - `arcane release-notes <stack>[/<service>]` is `lib/releases.ts`: a single-image check and `resolveRef` give the running and latest versions, `HttpRegistry.labels` reads `org.opencontainers.image.source` from the latest image (index to linux/amd64 manifest to config blob), and the anonymous GitHub releases API (60 requests an hour, up to 3 pages of 100) gives the releases in between, oldest first. `condenseNotes` keeps each release under 12,000 characters by section priority; `capTotal` drops the oldest releases past 40,000 characters in total.

package/specialists/README.md

@@ -12,7 +12,7 @@ A specialist is a Pi subagent that is the only way to operate one area of the ho
 | `astro.security` | Wazuh, CrowdSec, rsyslog archive on VM 106 | Read-only: `status`, `attention`, `agents`, `alerts`, `decisions`, `bouncers`, `metrics`, `wazuh-alerts`, `wazuh-vulns`, `wazuh-log`, `remote-hosts`, `remote-log`, `journal` |
 | `astro.backup` | vzdump, the shared Restic repository (Pulsar host config, Arcane app backups), GCS offsite from LXC 102 | Status, journals, and manual runs of every layer; `restic-snapshots|stats|ls`, `restic-restore` into `/var/tmp/spc-restore` on Pulsar, `restore-clean` |
 | `astro.proxmox` | Proxmox VE on Pulsar | API token: `guests`, `guest`, `get <path>`, `tasks`; `start`, `shutdown|reboot|stop --confirm`; snapshots create, delete, rollback; `set` of CPU, memory, options, network. Pulsar key: `host-status`, `host-journal`, `updates`, `guest-exec <vmid> <status|journal|df|updates>` |
-| `astro.inference` | llama.cpp on Nexus, Hermes on LXC 101, Europa health | `nexus-status|start|stop|restart|log|disk`; `hermes-status|journal|errors|restart|api-health|version|guest-status|snapshots`, `hermes-releases`, `hermes-upgrade --confirm`; `europa-health` |
+| `astro.inference` | llama.cpp on Nexus, Europa health | `nexus-status|start|stop|restart|log|disk`; `europa-health` |
 | `astro.media` | trendarr over TMDB, OMDb, and the `media` project on VM 100 (Radarr, Sonarr, SABnzbd) | `trending`, `search`, `add-movies`, `add-series` (at most 20 IMDb IDs), `sabnzbd status|pause|resume`; always trendarr's JSON plus its warnings |
 
 Call one with `/run astro.<name> -- <task>` or through the `subagent` tool (both from the bundled `astro-subagents` extension). `/run` saves the specialist's session under `~/.pi/agent/subagent-sessions/<agent>/`; `/run astro.<name> --continue -- <task>` resumes the last one started from the same directory, so the specialist keeps what it saw. Sessions older than 7 days are deleted. Specialists may call each other once (`maxSubagentDepth: 1`). They run on `openai-codex/gpt-6-astra` with `xhigh` thinking, set by `model` and `thinking` in each `agents/<name>.md`; an agent without these fields inherits the caller's model and thinking. Each tool takes `args`, an array of strings; `["--help"]` lists the subcommands.
@@ -21,7 +21,7 @@ Call one with `/run astro.<name> -- <task>` or through the `subagent` tool (both
 
 - Credentials and CLIs belong to a dedicated macOS user `specialist` on the host. Agents run as the main user and reach the wrappers only through `sudo -n -u specialist -H /usr/local/bin/specialist-cli`, the single passwordless sudo rule. General sudo asks for a password.
 - Credentials come from Vaultwarden (`homelab` / `specialists`, one Secure Note per specialist) through `specialist-cli provision`, into `0600` files. Wrappers never call `bw`.
-- The wrappers run on a root-owned Node in `/usr/local/libexec/specialist-node/` (latest LTS from nodejs.org), not on Homebrew's, because the main user owns all of `/opt/homebrew` and could otherwise swap the interpreter that reads every secret. `/usr/local/sbin/specialist-install` (root, one passwordless sudo rule) installs that Node, the wrappers, arcane-cli, and trendarr from downloads it checks against the publisher's checksums; it refuses older versions and keeps the previous one for `rollback`. Still open: `provision` runs Homebrew's `bw` and `jq`, and `edge` runs Homebrew's `gcloud`, both as `specialist`.
+- The wrappers run on a root-owned Node in `/usr/local/libexec/specialist-node/` (latest LTS from nodejs.org), not on Homebrew's, because the main user owns all of `/opt/homebrew` and could otherwise swap the interpreter that reads every secret. `/usr/local/sbin/specialist-install` (root, one passwordless sudo rule) installs that Node, the wrappers, arcane-cli, trendarr, and the tools the wrappers run with secrets (`bw` and `jq` for `provision`, `gcloud` and its Python for `edge`) from downloads it checks against the publisher's checksums; it refuses older versions and keeps the previous one for `rollback`.
 - Arcane is reached with a Zitadel service user: a fresh token per call, exchanged for a 300 s Arcane token. Other services use API keys, a PAT, tokens, or SSH keys that the targets pin to forced commands. The VPS is reached through `gcloud compute start-iap-tunnel` with a service account that may only open IAP tunnels and read instances; its gcloud state lives in `/Users/specialist/.specialists/work/gcloud`.
 - Every call is logged in `/Users/specialist/.specialists/audit.log`.
 - The `specialist-gate` extension registers the tool only inside the matching specialist child and blocks other agents from calling the CLIs or reading `/Users/specialist`. `security-guard` carries the same blocks.
@@ -30,7 +30,7 @@ Limits: `network` writes only firewall policies on UniFi. `security` is read-onl
 
 ## Enable specialists on a host
 
-Host: Cortex (macOS on Apple silicon; Homebrew `bw`, `jq`, `gcloud-cli` with `python@3.14`, git; the specialists' Node and trendarr come from `specialist-install`). Steps 1 to 3 are one-time on the services; 4 to 8 are per host.
+Host: Cortex (macOS on Apple silicon; Homebrew git; the specialists' Node, trendarr, `bw`, `jq`, `gcloud`, and gcloud's Python come from `specialist-install`). Steps 1 to 3 are one-time on the services; 4 to 8 are per host.
 
 1. **Vaultwarden.** Account `specialists@monadeo.com` with **Can view** on collection `specialists` in organization `homelab`. Secure Notes with Hidden fields (`_B64` fields hold `base64 -i <keyfile> | tr -d '\n'`):
    - `arcane`: `ZITADEL_KEY_JSON`, `GITOPS_DEPLOY_KEY_B64`, `ZITADEL_USER_ID` (plain), `SSH_KEY_ARCANE_HOST_B64` (user `spc-arcane` on VM 100, for `host`, `manager-*`), and optionally `MEALIE_API_KEY` (only `host mealie-api` reads it).
@@ -41,7 +41,7 @@ Host: Cortex (macOS on Apple silicon; Homebrew `bw`, `jq`, `gcloud-cli` with `py
    - `security`: `SSH_KEY_OBS_B64`.
    - `backup`: `SSH_KEY_PULSAR_B64`, `SSH_KEY_ARCANE_B64`.
    - `proxmox`: `PVE_TOKEN_ID` (plain, `spc-proxmox@pve!cortex`), `PVE_TOKEN_SECRET`, `SSH_KEY_PULSAR_B64`.
-   - `inference`: `SSH_KEY_NEXUS_B64`, `SSH_KEY_HERMES_B64`, `SSH_KEY_PULSAR_B64`.
+   - `inference`: `SSH_KEY_NEXUS_B64`.
    - `media`: `TMDB_ACCESS_TOKEN` (TMDB API Read Access Token), `OMDB_API_KEY`, `RADARR_API_KEY`, `SONARR_API_KEY` (Settings, General, Security; each app has one), `SABNZBD_API_KEY` (the API key, not the NZB key, which can only add NZBs and cannot read or pause the queue).
 2. **Identities.** Zitadel (`https://auth.37pla.net/ui/console`): service user `spc-arcane` with Access Token Type JWT and a JSON key; service user `spc-identity` with a Personal Access Token and the Instance Owner role. Technitium (both resolvers): a user with Zones View/Modify/Delete, Dashboard View, DNS Client View, and an API token each. Cloudflare: an account-owned API token with `Zone:Read` and `DNS:Edit` on both zones. GCP project `frontdoor-1337`: service account `spc-edge` with `roles/iap.tunnelResourceAccessor` and `roles/compute.viewer`, JSON key. Proxmox (`ssh pulsar`): user `spc-proxmox@pve`, role `SpecialistGuest` = `VM.Audit VM.PowerMgmt VM.Snapshot VM.Snapshot.Rollback VM.Config.CPU VM.Config.Memory VM.Config.Options VM.Config.Network VM.Config.CDROM VM.GuestAgent.Audit`, ACLs `PVEAuditor` on `/` and `SpecialistGuest` on `/vms` for both the user and the token `spc-proxmox@pve!cortex` (`-privsep 1`).
 3. **Services.** Arcane (Settings, Authentication, Federated Credentials): Issuer `https://auth.37pla.net`, Audience `387825541182390275`, Subject exact = `spc-arcane` user ID, Role Admin, Global, lifetime 300. UniFi: API key (Settings, API Keys) and policies allowing Cortex `10.0.40.37` to TCP 22 on `10.0.20.10`, `10.0.10.37`, `10.0.90.10`, TCP 5380 on `10.0.40.53`, `10.0.40.54`, TCP 8006 on `10.0.10.37`, and TCP 8081 on `10.0.60.5`. GitHub: `spc-arcane-gitops` as a write deploy key on `astronaute77/arcane`, `spc-edge-homelab` and `spc-identity-homelab` as write deploy keys on `astronaute77/homelab`.
@@ -57,7 +57,10 @@ Host: Cortex (macOS on Apple silicon; Homebrew `bw`, `jq`, `gcloud-cli` with `py
    printf 'cortex ALL=(root) NOPASSWD: /usr/local/sbin/specialist-install\n' > /tmp/specialist-install.sudoers && sudo visudo -cf /tmp/specialist-install.sudoers && sudo install -m 0440 -o root -g wheel /tmp/specialist-install.sudoers /etc/sudoers.d/specialist-install && rm /tmp/specialist-install.sudoers
    sudo /usr/local/sbin/specialist-install node 24.22.0
    sudo install -m 0755 -o root -g wheel <package>/specialists/entry/specialist-cli.sh /usr/local/bin/specialist-cli
-   brew install --cask gcloud-cli
+   sudo /usr/local/sbin/specialist-install jq <version>
+   sudo /usr/local/sbin/specialist-install bw <version>
+   sudo /usr/local/sbin/specialist-install python <x.y.z+YYYYMMDD>
+   sudo /usr/local/sbin/specialist-install gcloud <version>
    ```
    `specialist-cli` runs the wrappers with the Node that `specialist-install node` put in place, so that Node comes first. Add `cortex ALL=(specialist) NOPASSWD: ALL` as `/etc/sudoers.d/specialists-setup` (mode `0440`) for the duration of steps 5 to 7, then delete it. `specialist-cli` and `specialist-install` hold the same list of services; after an update that adds one (such as `media`), install both again with the same `sudo install` lines.
 5. **Bootstrap**, as `specialist` (`sudo -u specialist -H zsh`, `umask 077`): `~/.config/specialists/client.env` with `BW_SERVER=https://vault.37pla.net`, `BW_CLIENTID`, `BW_CLIENTSECRET`; `~/.config/specialists/master-password`. Both `0600`.
@@ -70,15 +73,14 @@ Host: Cortex (macOS on Apple silicon; Homebrew `bw`, `jq`, `gcloud-cli` with `py
      "homelabRemote": "git@github.com:astronaute77/homelab.git", "homelabBranch": "main", "repoArea": "02-pulsar-proxmox/dmz", "pomeriumConfig": "02-pulsar-proxmox/dmz/config.yaml" }
    { "unifiBaseUrl": "https://10.0.10.1/proxy/network/integration", "unifiCertSha256": "<from: specialist-cli network -- unifi fingerprint>", "pulsarHost": "10.0.10.37", "pulsarUser": "root" }
    { "technitiumPrimaryUrl": "http://10.0.40.53:5380", "technitiumSecondaryUrl": "http://10.0.40.54:5380", "technitiumCatalog": "catalog.invalid" }
-   { "gcloud": "/opt/homebrew/bin/gcloud", "gcloudPython": "/opt/homebrew/opt/python@3.14/bin/python3.14",
+   { "gcloud": "/usr/local/libexec/specialist-gcloud/current/bin/gcloud", "gcloudPython": "/usr/local/libexec/specialist-python/current/bin/python3",
      "project": "frontdoor-1337", "zone": "us-east1-c", "instance": "frontdoor-1337", "serviceAccount": "spc-edge@frontdoor-1337.iam.gserviceaccount.com",
      "iapLocalPort": 22337, "sshUser": "spc-edge", "publicIp": "35.237.66.101", "probeHost": "auth.37pla.net",
      "homelabRemote": "git@github.com:astronaute77/homelab.git", "homelabBranch": "main", "repoArea": "00-frontdoor-vps", "nginxConf": "00-frontdoor-vps/nginx.conf" }
    { "obsHost": "10.0.90.10", "obsUser": "observability" }
    { "pulsarHost": "10.0.10.37", "pulsarUser": "root", "arcaneHost": "10.0.40.30", "arcaneUser": "arcane" }
    { "apiUrl": "https://10.0.10.37:8006", "certSha256": "<from: specialist-cli proxmox -- fingerprint>", "node": "pulsar", "pulsarHost": "10.0.10.37", "pulsarUser": "root" }
-   { "nexusHost": "10.0.40.38", "nexusUser": "nexus", "hermesHost": "10.0.40.31", "hermesUser": "hermes", "pulsarHost": "10.0.10.37", "pulsarUser": "root",
-     "europaHealthUrl": "http://10.0.60.5:8081/health", "hermesRepo": "NousResearch/hermes-agent" }
+   { "nexusHost": "10.0.40.38", "nexusUser": "nexus", "europaHealthUrl": "http://10.0.60.5:8081/health" }
    { "trendarrCli": "/Users/specialist/.specialists/bin/trendarr/node_modules/@astrofoundry/trendarr/dist/cli.js",
      "radarrUrl": "http://10.0.40.30:7878", "radarrQualityProfileId": 7, "radarrRootFolderPath": "/media/movies",
      "sonarrUrl": "http://10.0.40.30:8989", "sonarrQualityProfileId": 7, "sonarrRootFolderPath": "/media/tv", "sonarrMonitor": "all",
@@ -93,12 +95,17 @@ Host: Cortex (macOS on Apple silicon; Homebrew `bw`, `jq`, `gcloud-cli` with `py
    sudo /usr/local/sbin/specialist-install wrappers <pi-astro version>
    sudo /usr/local/sbin/specialist-install arcane-cli <Arcane server version>
    sudo /usr/local/sbin/specialist-install trendarr <version>
-   sudo /usr/local/sbin/specialist-install rollback node|wrappers|arcane-cli|trendarr
+   sudo /usr/local/sbin/specialist-install jq|bw|gcloud <version>
+   sudo /usr/local/sbin/specialist-install python <x.y.z+YYYYMMDD>
+   sudo /usr/local/sbin/specialist-install rollback node|wrappers|arcane-cli|trendarr|python|gcloud|bw|jq
    sudo /usr/local/sbin/specialist-install status
    ```
    - `node` accepts only an LTS release listed in `https://nodejs.org/dist/index.json`, checks the tarball against `SHASUMS256.txt`, and switches `current` only after every installed wrapper answers `--help` with it; `previous` keeps the last one.
    - `wrappers` takes the pi-astro tarball from the npm registry, checks its `sha512` integrity, copies what `install.sh` copies, writes `~/.specialists/bin/VERSION`, and restores the old files if any wrapper fails `--help`. `install.sh` stays the first-time installer (it also writes the default config files).
    - `arcane-cli` checks the release tarball against `arcane_<version>_checksums.txt`; it follows the Arcane server's version.
+   - `python` installs a python-build-standalone `install_only_stripped` build (astral-sh), checked against the release's `SHA256SUMS`; before the switch it imports `ssl` and `sqlite3` and runs the current gcloud with the new Python.
+   - `gcloud` assembles the SDK from Google's component snapshot `components-v<version>.json` (core, core-nix, gcloud-deps, and their darwin-arm parts), each tarball checked against the snapshot's sha256, because Google lists the full archive's sha256 only in the table on its versioned-archives page, for the current release; it needs the installed Python and answers `gcloud version` before the switch.
+   - `bw` takes `bw-macos-arm64-<version>.zip` from the bitwarden/clients release `cli-v<version>`, checked against the asset digest from the GitHub API; `jq` takes `jq-macos-arm64` from the jqlang/jq release, checked against its `sha256sum.txt`.
    - `trendarr` installs with the root-owned Node's npm, without install scripts, into `trendarr-<version>`.
    - A version older than the installed one is refused; `rollback` swaps back to the kept previous copy. `status` prints the installed versions as JSON.
 7. **SSH targets.** Each target gets an entry script from `entry/remote/` as `/usr/local/sbin/<entry>` (`0755`, root) and the public key in the right `authorized_keys` as
@@ -107,11 +114,10 @@ Host: Cortex (macOS on Apple silicon; Homebrew `bw`, `jq`, `gcloud-cli` with `py
    - Pulsar, root: `spc-network-pulsar-entry.sh`.
    - VM 106, user `observability`: `spc-security-obs-entry.sh` (tracked in the homelab repository, installed by `02-pulsar-proxmox/observability/deploy.sh`).
    - Frontdoor VPS: `spc-edge-frontdoor-install.sh` creates user `spc-edge` (group `systemd-journal`), installs `spc-edge-frontdoor-entry.sh` and the sudoers file `spc-edge-frontdoor-sudoers`, and writes `authorized_keys`. Copy the three files and the public key to `/tmp` with `gcloud compute scp --tunnel-through-iap`, then run it as root.
-   - Pulsar, root, three more keys: `spc-backup-pulsar-entry.sh`, `spc-proxmox-pulsar-entry.sh`, `spc-inference-pulsar-entry.sh` (tracked in `02-pulsar-proxmox/pulsar/system/`).
+   - Pulsar, root, two more keys: `spc-backup-pulsar-entry.sh`, `spc-proxmox-pulsar-entry.sh` (tracked in `02-pulsar-proxmox/pulsar/system/`).
    - VM 100, user `arcane`: `spc-backup-arcane-entry.sh` (tracked as `host/spc-backup-arcane-entry` in the `astronaute77/arcane` repository, next to the host backup scripts).
-   - VM 100, user `spc-arcane` (no docker group): `spc-arcane-host-entry.sh` hands each command to the root-owned `spc-arcane-op.py` (installed as `/usr/local/sbin/spc-arcane-op`), the only command `spc-arcane-sudoers` allows; it runs the reviewed arcane-ops probes from `/usr/local/lib/spc-arcane` and the fixed manager and database steps. `spc-arcane-install.sh` creates the user and installs all of it from `/tmp/spc-arcane`; the files are tracked under `host/` in the arcane repository, the probes under `scripts/arcane_ops/`. Add `"hostAddress": "10.0.40.30", "hostUser": "spc-arcane"` to `arcane.json`; other arcane commands do not read them.
+   - VM 100, user `spc-arcane` (no docker group): `spc-arcane-host-entry.sh` hands each command to the root-owned `spc-arcane-op.py` (installed as `/usr/local/sbin/spc-arcane-op`), the only command `spc-arcane-sudoers` allows; it runs the reviewed probes from `/usr/local/lib/spc-arcane` and the fixed manager and database steps. `spc-arcane-install.sh` creates the user and installs all of it from `/tmp/spc-arcane`; the files are tracked under `host/` in the arcane repository, the probes under `host/spc-arcane-probes/` (moved from the arcane-ops CLI, retired on 2026-10-19). Add `"hostAddress": "10.0.40.30", "hostUser": "spc-arcane"` to `arcane.json`; other arcane commands do not read them.
    - Nexus, user `nexus`: `spc-inference-nexus-entry.sh` as `/usr/local/sbin/spc-inference-nexus-entry` (tracked in `04-nexus-macstudio/system/`).
-   - LXC 101, user `hermes`: `spc-inference-hermes-entry.sh` (tracked in `02-pulsar-proxmox/hermes/system/`).
 8. **Pi**, as the main user: `~/.pi/agent/specialists.json` (below) and the specialist blocks in `~/.pi/agent/security-guard.json` (`specialist-cli`, `arcane-cli`, `-u specialist` in `operations`; `/Users/specialist/**` in `reads` and `writes`; keep the default rules next to them).
    ```json
    { "entry": "/usr/local/bin/specialist-cli", "user": "specialist",
@@ -144,6 +150,6 @@ The `astro-discord` extension gives Discord users access to the specialists from
 
 ## Rotation and operations
 
-Rotation steps for every field live in the homelab repository, `03-cortex-macmini/ROTATION.md`. After any change in Vaultwarden run `specialist-cli provision`. Host state and the sudo rules are documented in `03-cortex-macmini/README.md`; the forced-command scripts are tracked under `02-pulsar-proxmox/dmz/system/`, `02-pulsar-proxmox/pulsar/system/`, `02-pulsar-proxmox/observability/system/`, `02-pulsar-proxmox/hermes/system/`, `host/` of the `astronaute77/arcane` repository, `04-nexus-macstudio/system/`, and `00-frontdoor-vps/system/`.
+Rotation steps for every field live in the homelab repository, `03-cortex-macmini/ROTATION.md`. After any change in Vaultwarden run `specialist-cli provision`. Host state and the sudo rules are documented in `03-cortex-macmini/README.md`; the forced-command scripts are tracked under `02-pulsar-proxmox/dmz/system/`, `02-pulsar-proxmox/pulsar/system/`, `02-pulsar-proxmox/observability/system/`, `host/` of the `astronaute77/arcane` repository, `04-nexus-macstudio/system/`, and `00-frontdoor-vps/system/`.
 
 All nine planned specialists exist. See `AGENTS.md` for how to add one.

package/specialists/edge/run.ts

@@ -15,7 +15,7 @@ const SERVICE = "edge";
 
 interface EdgeConfig extends Record<string, string | number> {
     gcloud: string;
-    /** Python 3.10+ interpreter for gcloud; the Homebrew cask installs none of its own. */
+    /** Python 3.10+ interpreter for gcloud: the installer's root-owned Python, never one the main user can replace. */
     gcloudPython: string;
     project: string;
     zone: string;
@@ -78,17 +78,17 @@ const PACKAGE = /^[a-z0-9][a-z0-9+.-]{0,63}$/;
  * public DNS the way users reach them: status code only, no redirect
  * followed, no credentials. `expect` holds the codes a healthy route returns
  * (the Supabase settings endpoint wants an API key, so 401; Studio redirects
- * to the Pomerium sign-in; the rest answer 200, as arcane-ops judged them).
+ * to the Pomerium sign-in; the rest answer 200).
  */
 export const PUBLIC_ROUTES: Readonly<Record<string, { url: string; expect: readonly number[] }>> = {
     "supabase-auth-settings": { url: "https://supabase.37pla.net/auth/v1/settings", expect: [401] },
     "supabase-jwks": { url: "https://supabase.37pla.net/auth/v1/.well-known/jwks.json", expect: [200] },
     "supabase-openid": { url: "https://supabase.37pla.net/auth/v1/.well-known/openid-configuration", expect: [200] },
-    "supabase-oauth-discovery": { url: "https://supabase.37pla.net/auth/v1/.well-known/oauth-authorization-server", expect: [200] },
+    "supabase-oauth-discovery": { url: "https://supabase.37pla.net/auth/v1/.well-known/oauth-authorization-server", expect: [404] },
     "supabase-studio": { url: "https://supabase-studio.37pla.net/", expect: [301, 302, 303, 307, 308] },
     "grimoire-public": { url: "https://cli.grimoire.monadeo.com/v1/auth/config", expect: [200] },
     "grimoire-public-health": { url: "https://cli.grimoire.monadeo.com/healthz", expect: [200] },
-    "mealie-public": { url: "https://mealie.37pla.net/api/recipes?page=1&perPage=1", expect: [200] },
+    "mealie-public": { url: "https://mealie.37pla.net/api/recipes?page=1&perPage=1", expect: [301, 302, 303, 307, 308] },
 };
 
 const HELP = `edge specialist (Frontdoor VPS through an IAP tunnel)

package/specialists/entry/remote/spc-arcane-install.sh

@@ -1,8 +1,8 @@
 #!/bin/sh
 # One-time setup of the spc-arcane user on VM 100 for the arcane specialist.
 # Run as root with these files in /tmp/spc-arcane: spc-arcane-host-entry,
-# spc-arcane-op, spc-arcane-sudoers, spc-arcane-host.pub, and the arcane-ops
-# probes host_probe.py, resource_probe.py, incident_probe.py, kernel_probe.py,
+# spc-arcane-op, spc-arcane-sudoers, spc-arcane-host.pub, and the
+# probes from host/spc-arcane-probes/: host_probe.py, resource_probe.py, incident_probe.py, kernel_probe.py,
 # storage_probe.py, queue_probe.py, mealie_probe.py, radarr_probe.py.
 # Idempotent; reinstalling updates the files and keeps the user.
 set -eu

package/specialists/entry/remote/spc-arcane-op.py

@@ -68,6 +68,9 @@ HOST_FILES = (
     ("spc-arcane-host-entry", "/usr/local/sbin/spc-arcane-host-entry"),
     ("spc-arcane-op", "/usr/local/sbin/spc-arcane-op"),
     ("spc-arcane-sudoers", "/etc/sudoers.d/spc-arcane"),
+) + tuple(
+    (f"spc-arcane-probes/{name}.py", f"{PROBES}/{name}.py")
+    for name in ("host_probe", "resource_probe", "incident_probe", "kernel_probe", "storage_probe", "queue_probe", "mealie_probe", "radarr_probe")
 )
 UNITS = tuple(name for name, _ in HOST_FILES if name.endswith((".service", ".timer")))
 LOOPBACK_CHECKS = {

package/specialists/entry/specialist-install.sh

@@ -1,14 +1,16 @@
 #!/bin/sh
 # /usr/local/sbin/specialist-install: installs the specialist user's Node, wrappers,
-# arcane-cli, and trendarr from downloads it checks itself. Installed root-owned 0755.
+# arcane-cli, trendarr, Python, gcloud, bw, and jq from downloads it checks itself.
+# Installed root-owned 0755.
 # Runs as root through
 #   cortex ALL=(root) NOPASSWD: /usr/local/sbin/specialist-install
 # It runs only system binaries and the Node it installed, never anything the cortex
 # user can write (all of Homebrew), and it touches the specialist's home only as that
 # user, so links the specialist plants there cannot redirect a root write.
 #
-#   specialist-install node|wrappers|arcane-cli|trendarr <version>
-#   specialist-install rollback node|wrappers|arcane-cli|trendarr
+#   specialist-install node|wrappers|arcane-cli|trendarr|gcloud|bw|jq <version>
+#   specialist-install python <x.y.z+YYYYMMDD>
+#   specialist-install rollback node|wrappers|arcane-cli|trendarr|python|gcloud|bw|jq
 #   specialist-install status
 set -eu
 PATH=/usr/bin:/bin:/usr/sbin:/sbin
@@ -18,11 +20,18 @@ cd /
 
 SPECIALIST=specialist
 NODE_BASE=/usr/local/libexec/specialist-node
+PYTHON_BASE=/usr/local/libexec/specialist-python
+GCLOUD_BASE=/usr/local/libexec/specialist-gcloud
+BW_BASE=/usr/local/libexec/specialist-bw
+JQ_BASE=/usr/local/libexec/specialist-jq
+# Components of the official darwin-arm gcloud archive that gcloud itself needs (bq,
+# gsutil, and the empty macOS bundled-python component are left out).
+GCLOUD_COMPONENTS="core core-nix gcloud-deps gcloud-deps-darwin-arm gcloud-crc32c-darwin-arm"
 # Same list as the allowlist in specialist-cli; a new specialist needs both reinstalled.
 SERVICES="arcane identity network dns edge security backup proxmox inference media"
 
 usage() {
-  echo "usage: specialist-install node|wrappers|arcane-cli|trendarr <version> | rollback node|wrappers|arcane-cli|trendarr | status" >&2
+  echo "usage: specialist-install node|wrappers|arcane-cli|trendarr|gcloud|bw|jq <version> | python <x.y.z+YYYYMMDD> | rollback node|wrappers|arcane-cli|trendarr|python|gcloud|bw|jq | status" >&2
   exit 2
 }
 
@@ -50,17 +59,34 @@ version_lt() {
   [ "$3" -lt "$6" ]
 }
 
+# A python-build-standalone release: CPython x.y.z and the build date that names the release.
+valid_python_version() {
+  case "$1" in '' | *[!0-9.+]*) return 1 ;; esac
+  printf '%s\n' "$1" | /usr/bin/grep -Eq '^(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})\+[0-9]{8}$'
+}
+
+# True when python release $1 is older than $2: CPython version first, then build date.
+python_lt() {
+  version_lt "${1%+*}" "${2%+*}" && return 0
+  version_lt "${2%+*}" "${1%+*}" && return 1
+  [ "${1#*+}" -lt "${2#*+}" ]
+}
+
 component_ok() {
-  case "$1" in node | wrappers | arcane-cli | trendarr) return 0 ;; esac
+  case "$1" in node | wrappers | arcane-cli | trendarr | python | gcloud | bw | jq) return 0 ;; esac
   return 1
 }
 
 command=${1:-}
 case "$command" in
-  node | wrappers | arcane-cli | trendarr)
+  node | wrappers | arcane-cli | trendarr | gcloud | bw | jq)
     [ $# -eq 2 ] || usage
     valid_version "$2" || usage
     ;;
+  python)
+    [ $# -eq 2 ] || usage
+    valid_python_version "$2" || usage
+    ;;
   rollback)
     [ $# -eq 2 ] || usage
     component_ok "$2" || usage
@@ -230,6 +256,217 @@ rollback_node() {
   echo "node $previous is current; previous $current"
 }
 
+# Root-owned tools for the specialist: each version in its own folder under
+# /usr/local/libexec/specialist-<tool>, behind the links current and previous.
+check_tool_base() {
+  check_root_dir /
+  check_root_dir /usr
+  check_root_dir /usr/local
+  ensure_root_dir /usr/local/libexec
+  ensure_root_dir "$1"
+}
+
+# $1 base, $2 link name, $3 version check, $4 executable inside a version folder.
+tool_link() {
+  target=$(/usr/bin/readlink "$1/$2" 2>/dev/null) || return 0
+  "$3" "$target" && [ -x "$1/$target/$4" ] && printf '%s' "$target"
+  return 0
+}
+
+switch_tool_link() {
+  /bin/rm -f "$1/.$2.tmp"
+  (umask 022 && /bin/ln -s "$3" "$1/.$2.tmp")
+  /bin/mv -h "$1/.$2.tmp" "$1/$2"
+}
+
+new_tool_folder() {
+  /bin/rm -rf "$1.partial"
+  /bin/mkdir -m 0755 "$1.partial"
+}
+
+seal_tool_folder() {
+  /usr/sbin/chown -R root:wheel "$1.partial"
+  /bin/chmod -R u=rwX,go=rX "$1.partial"
+}
+
+# Moves the checked $base/$version.partial into place, makes it current, keeps the old current as previous.
+activate_tool() {
+  /bin/rm -rf "$1/$2"
+  /bin/mv "$1/$2.partial" "$1/$2"
+  [ -z "$3" ] || switch_tool_link "$1" previous "$3"
+  switch_tool_link "$1" current "$2"
+  for d in "$1"/*; do
+    n=${d##*/}
+    case "$n" in current | previous | "$2" | "$3") continue ;; esac
+    /bin/rm -rf "$d"
+  done
+}
+
+# $1 base, $2 label, $3 version check, $4 executable, $5 smoke function taking the executable's path.
+rollback_tool() {
+  check_tool_base "$1"
+  current=$(tool_link "$1" current "$3" "$4")
+  previous=$(tool_link "$1" previous "$3" "$4")
+  [ -n "$current" ] && [ -n "$previous" ] || fail "no previous $2 to roll back to"
+  "$5" "$1/$previous/$4" "$previous" || fail "$2 $previous fails its check"
+  switch_tool_link "$1" current "$previous"
+  switch_tool_link "$1" previous "$current"
+  echo "$2 $previous is current; previous $current"
+}
+
+# Python from python-build-standalone: gcloud needs Python 3.10 to 3.15, and its macOS
+# installer offers only Homebrew's (owned by cortex) or an unchecked python.org package.
+SMOKE_PYTHON='"$1" -c "import ssl, sqlite3, sys; print(\"%d.%d.%d\" % sys.version_info[:3])"'
+SMOKE_GCLOUD='cfg=$(/usr/bin/mktemp -d); trap "/bin/rm -rf \"\$cfg\"" EXIT
+CLOUDSDK_PYTHON=$2 CLOUDSDK_CONFIG=$cfg CLOUDSDK_CORE_DISABLE_PROMPTS=1 "$1" version 2>/dev/null | /usr/bin/head -n 1'
+SMOKE_BW='app=$(/usr/bin/mktemp -d); trap "/bin/rm -rf \"\$app\"" EXIT
+BITWARDENCLI_APPDATA_DIR=$app "$1" --version 2>/dev/null'
+SMOKE_JQ='"$1" --version'
+
+smoke_python() {
+  [ "$(as_specialist "$SMOKE_PYTHON" "$1")" = "${2%+*}" ]
+}
+
+current_python() {
+  python=$(tool_link "$PYTHON_BASE" current valid_python_version bin/python3)
+  [ -n "$python" ] || fail "no specialist Python yet: run specialist-install python <x.y.z+YYYYMMDD> first"
+  printf '%s' "$PYTHON_BASE/$python/bin/python3"
+}
+
+# gcloud $1 (bin/gcloud) answers with version $2, run by Python $3.
+gcloud_answers() {
+  [ "$(as_specialist "$SMOKE_GCLOUD" "$1" "$3")" = "Google Cloud SDK $2" ]
+}
+
+smoke_gcloud() {
+  gcloud_answers "$1" "$2" "$(current_python)"
+}
+
+smoke_bw() {
+  [ "$(as_specialist "$SMOKE_BW" "$1")" = "$2" ]
+}
+
+smoke_jq() {
+  [ "$(as_specialist "$SMOKE_JQ" "$1")" = "jq-$2" ]
+}
+
+install_python() {
+  version=$1
+  check_tool_base "$PYTHON_BASE"
+  current=$(tool_link "$PYTHON_BASE" current valid_python_version bin/python3)
+  if [ -n "$current" ] && python_lt "$version" "$current"; then fail "python $version is older than the installed $current; use rollback"; fi
+  [ "$current" != "$version" ] || { echo "python $version is already current"; return 0; }
+  tag=${version#*+}
+  name="cpython-$version-aarch64-apple-darwin-install_only_stripped.tar.gz"
+  base="https://github.com/astral-sh/python-build-standalone/releases/download/$tag"
+  fetch "$base/$name" "$work/$name"
+  fetch "$base/SHA256SUMS" "$work/SHA256SUMS"
+  check_sha256 "$work" "$name" "$work/SHA256SUMS"
+  dest="$PYTHON_BASE/$version"
+  new_tool_folder "$dest"
+  /usr/bin/tar -xzf "$work/$name" -C "$dest.partial" --strip-components 1
+  seal_tool_folder "$dest"
+  smoke_python "$dest.partial/bin/python3" "$version" || fail "python $version does not run"
+  gcloud=$(tool_link "$GCLOUD_BASE" current valid_version bin/gcloud)
+  if [ -n "$gcloud" ]; then
+    gcloud_answers "$GCLOUD_BASE/$gcloud/bin/gcloud" "$gcloud" "$dest.partial/bin/python3" || fail "gcloud $gcloud fails with python $version; current stays ${current:-unset}"
+  fi
+  activate_tool "$PYTHON_BASE" "$version" "$current"
+  echo "python $version is current${current:+; previous $current}"
+}
+
+# gcloud from the components of Google's release snapshot, each archive checked against
+# the sha256 the snapshot lists; the snapshot and the archives come from dl.google.com.
+install_gcloud() {
+  version=$1
+  python=$(current_python)
+  check_tool_base "$GCLOUD_BASE"
+  current=$(tool_link "$GCLOUD_BASE" current valid_version bin/gcloud)
+  if [ -n "$current" ] && version_lt "$version" "$current"; then fail "gcloud $version is older than the installed $current; use rollback"; fi
+  [ "$current" != "$version" ] || { echo "gcloud $version is already current"; return 0; }
+  channel=https://dl.google.com/dl/cloudsdk/channels/rapid
+  snapshot="$work/components.json"
+  fetch "$channel/components-v$version.json" "$snapshot"
+  [ "$(json_field "$snapshot" version)" = "$version" ] || fail "gcloud $version has no release snapshot"
+  dest="$GCLOUD_BASE/$version"
+  new_tool_folder "$dest"
+  for want in $GCLOUD_COMPONENTS; do
+    i=0
+    found=""
+    while [ "$i" -lt 1000 ]; do
+      id=$(json_field "$snapshot" "components.$i.id") || break
+      if [ "$id" = "$want" ]; then found=$i; break; fi
+      i=$((i + 1))
+    done
+    [ -n "$found" ] || fail "gcloud $version has no component $want"
+    source=$(json_field "$snapshot" "components.$found.data.source") || fail "component $want has no archive"
+    sum=$(json_field "$snapshot" "components.$found.data.checksum") || fail "component $want has no checksum"
+    printf '%s\n' "$source" | /usr/bin/grep -Eq '^components/google-cloud-sdk-[a-z0-9-]+-[0-9]{14}\.tar\.gz$' || fail "unexpected archive for component $want"
+    printf '%s\n' "$sum" | /usr/bin/grep -Eq '^[0-9a-f]{64}$' || fail "unexpected checksum for component $want"
+    fetch "$channel/$source" "$work/$want.tgz"
+    [ "$(/usr/bin/shasum -a 256 "$work/$want.tgz" | /usr/bin/awk '{ print $1 }')" = "$sum" ] || fail "checksum mismatch for component $want"
+    /usr/bin/tar -xzf "$work/$want.tgz" -C "$dest.partial"
+  done
+  seal_tool_folder "$dest"
+  gcloud_answers "$dest.partial/bin/gcloud" "$version" "$python" || fail "gcloud $version does not run"
+  activate_tool "$GCLOUD_BASE" "$version" "$current"
+  echo "gcloud $version is current${current:+; previous $current}"
+}
+
+# Bitwarden CLI: the native macOS arm64 build, checked against the sha256 digest GitHub publishes for the release asset.
+install_bw() {
+  version=$1
+  check_tool_base "$BW_BASE"
+  current=$(tool_link "$BW_BASE" current valid_version bw)
+  if [ -n "$current" ] && version_lt "$version" "$current"; then fail "bw $version is older than the installed $current; use rollback"; fi
+  [ "$current" != "$version" ] || { echo "bw $version is already current"; return 0; }
+  name="bw-macos-arm64-$version.zip"
+  release="$work/bw-release.json"
+  fetch "https://api.github.com/repos/bitwarden/clients/releases/tags/cli-v$version" "$release"
+  i=0
+  found=""
+  while [ "$i" -lt 100 ]; do
+    asset=$(json_field "$release" "assets.$i.name") || break
+    if [ "$asset" = "$name" ]; then found=$i; break; fi
+    i=$((i + 1))
+  done
+  [ -n "$found" ] || fail "bw $version has no $name"
+  digest=$(json_field "$release" "assets.$found.digest") || fail "$name has no published digest"
+  printf '%s\n' "$digest" | /usr/bin/grep -Eq '^sha256:[0-9a-f]{64}$' || fail "unexpected digest for $name"
+  url="https://github.com/bitwarden/clients/releases/download/cli-v$version/$name"
+  [ "$(json_field "$release" "assets.$found.browser_download_url")" = "$url" ] || fail "unexpected download location for $name"
+  fetch "$url" "$work/$name"
+  [ "sha256:$(/usr/bin/shasum -a 256 "$work/$name" | /usr/bin/awk '{ print $1 }')" = "$digest" ] || fail "checksum mismatch for $name"
+  dest="$BW_BASE/$version"
+  new_tool_folder "$dest"
+  /usr/bin/unzip -q "$work/$name" bw -d "$dest.partial" || fail "$name has no bw"
+  /bin/chmod 0755 "$dest.partial/bw"
+  seal_tool_folder "$dest"
+  smoke_bw "$dest.partial/bw" "$version" || fail "bw $version does not run"
+  activate_tool "$BW_BASE" "$version" "$current"
+  echo "bw $version is current${current:+; previous $current}"
+}
+
+# jq: the macOS arm64 binary, checked against the release's sha256sum.txt.
+install_jq() {
+  version=$1
+  check_tool_base "$JQ_BASE"
+  current=$(tool_link "$JQ_BASE" current valid_version jq)
+  if [ -n "$current" ] && version_lt "$version" "$current"; then fail "jq $version is older than the installed $current; use rollback"; fi
+  [ "$current" != "$version" ] || { echo "jq $version is already current"; return 0; }
+  base="https://github.com/jqlang/jq/releases/download/jq-$version"
+  fetch "$base/jq-macos-arm64" "$work/jq-macos-arm64"
+  fetch "$base/sha256sum.txt" "$work/sha256sum.txt"
+  check_sha256 "$work" jq-macos-arm64 "$work/sha256sum.txt"
+  dest="$JQ_BASE/$version"
+  new_tool_folder "$dest"
+  /usr/bin/install -m 0755 "$work/jq-macos-arm64" "$dest.partial/jq"
+  seal_tool_folder "$dest"
+  smoke_jq "$dest.partial/jq" "$version" || fail "jq $version does not run"
+  activate_tool "$JQ_BASE" "$version" "$current"
+  echo "jq $version is current${current:+; previous $current}"
+}
+
 WRAPPER_VERSION='v=$(cat "$HOME/.specialists/bin/VERSION" 2>/dev/null) || exit 0; printf "%s" "$v"'
 
 # Moves the new wrapper files in and the old ones aside, two renames per item, then
@@ -433,13 +670,26 @@ json_version() {
   if valid_version "$1"; then printf '"%s"' "$1"; else printf 'null'; fi
 }
 
+json_python() {
+  if valid_python_version "$1"; then printf '"%s"' "$1"; else printf 'null'; fi
+}
+
+# {"current":..,"previous":..} of one root-owned tool: $1 base, $2 version check, $3 executable, $4 JSON writer.
+json_tool() {
+  printf '{"current":%s,"previous":%s}' "$("$4" "$(tool_link "$1" current "$2" "$3")")" "$("$4" "$(tool_link "$1" previous "$2" "$3")")"
+}
+
 status() {
   wrappers=$(as_specialist "$WRAPPER_VERSION" || true)
   arcane=$(as_specialist "$ARCANE_VERSION" || true)
   trendarr=$(as_specialist "$TRENDARR_VERSION" || true)
-  printf '{"node":{"current":%s,"previous":%s},"wrappers":%s,"arcaneCli":%s,"trendarr":%s}\n' \
+  printf '{"node":{"current":%s,"previous":%s},"wrappers":%s,"arcaneCli":%s,"trendarr":%s,"python":%s,"gcloud":%s,"bw":%s,"jq":%s}\n' \
     "$(json_version "$(node_link current)")" "$(json_version "$(node_link previous)")" \
-    "$(json_version "$wrappers")" "$(json_version "$arcane")" "$(json_version "$trendarr")"
+    "$(json_version "$wrappers")" "$(json_version "$arcane")" "$(json_version "$trendarr")" \
+    "$(json_tool "$PYTHON_BASE" valid_python_version bin/python3 json_python)" \
+    "$(json_tool "$GCLOUD_BASE" valid_version bin/gcloud json_version)" \
+    "$(json_tool "$BW_BASE" valid_version bw json_version)" \
+    "$(json_tool "$JQ_BASE" valid_version jq json_version)"
 }
 
 case "$command" in
@@ -447,12 +697,20 @@ case "$command" in
   wrappers) install_wrappers "$2" ;;
   arcane-cli) install_arcane_cli "$2" ;;
   trendarr) install_trendarr "$2" ;;
+  python) install_python "$2" ;;
+  gcloud) install_gcloud "$2" ;;
+  bw) install_bw "$2" ;;
+  jq) install_jq "$2" ;;
   rollback)
     case "$2" in
       node) rollback_node ;;
       wrappers) rollback_wrappers ;;
       arcane-cli) rollback_arcane_cli ;;
       trendarr) rollback_trendarr ;;
+      python) rollback_tool "$PYTHON_BASE" python valid_python_version bin/python3 smoke_python ;;
+      gcloud) rollback_tool "$GCLOUD_BASE" gcloud valid_version bin/gcloud smoke_gcloud ;;
+      bw) rollback_tool "$BW_BASE" bw valid_version bw smoke_bw ;;
+      jq) rollback_tool "$JQ_BASE" jq valid_version jq smoke_jq ;;
     esac
     ;;
   status) status ;;