@astrofoundry/pi-astro 0.34.0 → 0.35.0

package/specialists/entry/specialist-install.test.ts

@@ -40,13 +40,33 @@ describe("specialist-install", () => {
         [["rollback", "pi"]],
         [["rollback", "node", "extra"]],
         [["status", "now"]],
+        [["python", "3.14.8"]],
+        [["python", "3.14.8+2026101"]],
+        [["python", "3.14.8+20261013+1"]],
+        [["python", "3.14.8-20261013"]],
+        [["gcloud", "589.0"]],
+        [["bw", "cli-v2026.10.0"]],
+        [["jq", "jq-1.8.2"]],
+        [["rollback", "brew"]],
     ])("refuses %j with a usage error before anything else", (args) => {
         const result = install(...args);
         expect(result.status).toBe(2);
         expect(result.stderr).toMatch(/^usage: specialist-install/);
     });
 
-    it.skipIf(isRoot).each([[["node", "24.22.0"]], [["wrappers", "0.31.0"]], [["arcane-cli", "2.16.1"]], [["trendarr", "0.6.0"]], [["rollback", "trendarr"]], [["status"]]])(
+    it.skipIf(isRoot).each([
+        [["node", "24.22.0"]],
+        [["wrappers", "0.31.0"]],
+        [["arcane-cli", "2.16.1"]],
+        [["trendarr", "0.6.0"]],
+        [["python", "3.14.8+20261013"]],
+        [["gcloud", "589.0.0"]],
+        [["bw", "2026.10.0"]],
+        [["jq", "1.8.2"]],
+        [["rollback", "trendarr"]],
+        [["rollback", "gcloud"]],
+        [["status"]],
+    ])(
         "accepts %j and then requires root",
         (args) => {
             const result = install(...args);
@@ -74,6 +94,35 @@ describe("specialist-install", () => {
         expect(shellFunction("version_lt", `version_lt ${a} ${b}`).status).toBe(older ? 0 : 1);
     });
 
+    it.each(["3.14.8+20261013", "3.10.0+20250101", "3.15.0+20270401"])("valid_python_version accepts %s", (v) => {
+        expect(shellFunction("valid_python_version", `valid_python_version '${v}'`).status).toBe(0);
+    });
+
+    it.each(["", "3.14.8", "3.14+20261013", "3.14.8+2026101", "3.14.8+20261013a", "+20261013", "3.14.8+ 20261013"])("valid_python_version rejects %j", (v) => {
+        expect(shellFunction("valid_python_version", `valid_python_version '${v}'`).status).toBe(1);
+    });
+
+    it.each([
+        ["3.14.8+20261009", "3.14.8+20261013", true],
+        ["3.14.8+20261013", "3.14.8+20261013", false],
+        ["3.14.9+20261001", "3.14.8+20261013", false],
+        ["3.14.7+20261101", "3.14.8+20261013", true],
+    ])("python_lt %s < %s is %s", (a, b, older) => {
+        const script = readFileSync(SCRIPT, "utf-8");
+        const lt = /^version_lt\(\) \{\n[\s\S]*?^\}/m.exec(script)?.[0] ?? "";
+        expect(shellFunction("python_lt", `${lt}\npython_lt '${a}' '${b}'`).status).toBe(older ? 0 : 1);
+    });
+
+    it("installs gcloud from fixed components and checked downloads only", () => {
+        const text = readFileSync(SCRIPT, "utf-8");
+        expect(/^GCLOUD_COMPONENTS="([^"]+)"$/m.exec(text)?.[1].split(" ")).toEqual(["core", "core-nix", "gcloud-deps", "gcloud-deps-darwin-arm", "gcloud-crc32c-darwin-arm"]);
+        expect(text).toContain("channel=https://dl.google.com/dl/cloudsdk/channels/rapid\n");
+        expect(text).toContain('fetch "$channel/components-v$version.json"');
+        expect(text).toContain("https://github.com/astral-sh/python-build-standalone/releases/download/$tag");
+        expect(text).toContain("https://api.github.com/repos/bitwarden/clients/releases/tags/cli-v$version");
+        expect(text).toContain("https://github.com/jqlang/jq/releases/download/jq-$version");
+    });
+
     it("installs the same services specialist-cli accepts", () => {
         const services = /^SERVICES="([^"]+)"$/m.exec(readFileSync(SCRIPT, "utf-8"))?.[1].split(" ");
         const allowed = /^ {2}([a-z|]+)\) ;;$/m.exec(readFileSync(ENTRY, "utf-8"))?.[1].split("|");

package/specialists/inference/run.ts

@@ -13,30 +13,16 @@ const SERVICE = "inference";
 interface InferenceConfig extends Record<string, string> {
     nexusHost: string;
     nexusUser: string;
-    hermesHost: string;
-    hermesUser: string;
-    pulsarHost: string;
-    pulsarUser: string;
     europaHealthUrl: string;
-    /** GitHub repository whose releases carry the Hermes upgrade notes, owner/name. */
-    hermesRepo: string;
 }
 
 const SHAPE = {
     nexusHost: "string",
     nexusUser: "string",
-    hermesHost: "string",
-    hermesUser: "string",
-    pulsarHost: "string",
-    pulsarUser: "string",
     europaHealthUrl: "string",
-    hermesRepo: "string",
 } as const;
 
-type Target = "nexus" | "hermes" | "pulsar";
-
 interface RemoteSpec {
-    target: Target;
     args: number;
     help: string;
     timeoutMs: number;
@@ -45,40 +31,27 @@ interface RemoteSpec {
 
 const MINUTE = 60_000;
 
-/** Fixed remote commands; the forced commands on Nexus (nexus), LXC 101 (hermes), and Pulsar (root) accept exactly these names. */
+/** Fixed remote commands; the forced command on Nexus (user nexus) accepts exactly these names. */
 export const INFERENCE_COMMANDS: Readonly<Record<string, RemoteSpec>> = {
-    "nexus-status": { target: "nexus", args: 0, help: "LaunchAgent states and /health codes of the embed and rerank servers", timeoutMs: MINUTE },
-    "nexus-restart": { target: "nexus", args: 1, help: "nexus-restart <embed|rerank>   launchctl kickstart -k", timeoutMs: 2 * MINUTE },
-    "nexus-start": { target: "nexus", args: 1, help: "nexus-start <embed|rerank>     launchctl bootstrap from the tracked plist", timeoutMs: 2 * MINUTE },
-    "nexus-stop": { target: "nexus", args: 1, help: "nexus-stop <embed|rerank> --confirm   launchctl bootout", timeoutMs: 2 * MINUTE, confirm: true },
-    "nexus-log": { target: "nexus", args: 2, help: "nexus-log <embed|rerank> <lines>", timeoutMs: MINUTE },
-    "nexus-disk": { target: "nexus", args: 0, help: "free space on the Nexus disk", timeoutMs: MINUTE },
-    "hermes-status": { target: "hermes", args: 0, help: "both gateway user services", timeoutMs: MINUTE },
-    "hermes-journal": { target: "hermes", args: 1, help: "hermes-journal <since>         user journal of both gateways", timeoutMs: MINUTE },
-    "hermes-errors": { target: "hermes", args: 0, help: "hermes logs errors", timeoutMs: MINUTE },
-    "hermes-restart": { target: "hermes", args: 1, help: "hermes-restart <gateway|api>", timeoutMs: 2 * MINUTE },
-    "hermes-api-health": { target: "hermes", args: 0, help: "/health and /v1/models codes on localhost:8650 (expect 200 and 401)", timeoutMs: MINUTE },
-    "hermes-version": { target: "hermes", args: 0, help: "installed Hermes version", timeoutMs: MINUTE },
-    "hermes-guest-status": { target: "pulsar", args: 0, help: "pct status 101", timeoutMs: MINUTE },
-    "hermes-snapshots": { target: "pulsar", args: 0, help: "pct listsnapshot 101", timeoutMs: MINUTE },
-    "hermes-upgrade": { target: "pulsar", args: 0, help: "hermes-upgrade --confirm       snapshot LXC 101, hermes update, restart, health check", timeoutMs: 20 * MINUTE, confirm: true },
+    "nexus-status": { args: 0, help: "LaunchAgent states and /health codes of the embed and rerank servers", timeoutMs: MINUTE },
+    "nexus-restart": { args: 1, help: "nexus-restart <embed|rerank>   launchctl kickstart -k", timeoutMs: 2 * MINUTE },
+    "nexus-start": { args: 1, help: "nexus-start <embed|rerank>     launchctl bootstrap from the tracked plist", timeoutMs: 2 * MINUTE },
+    "nexus-stop": { args: 1, help: "nexus-stop <embed|rerank> --confirm   launchctl bootout", timeoutMs: 2 * MINUTE, confirm: true },
+    "nexus-log": { args: 2, help: "nexus-log <embed|rerank> <lines>", timeoutMs: MINUTE },
+    "nexus-disk": { args: 0, help: "free space on the Nexus disk", timeoutMs: MINUTE },
 };
 
 const NEXUS_SERVICES = ["embed", "rerank"];
-const HERMES_SERVICES = ["gateway", "api"];
-const SINCE = /^[A-Za-z0-9 :\-+]{1,40}$/;
 
-const HELP = `inference specialist (llama.cpp on Nexus, Hermes on LXC 101, Europa health)
+const HELP = `inference specialist (llama.cpp on Nexus, Europa health)
 
   <command> [args]            fixed operations through forced-command SSH keys
 ${Object.entries(INFERENCE_COMMANDS)
     .map(([name, c]) => `      ${name.padEnd(22)} ${c.help}`)
     .join("\n")}
   europa-health               GET the Europa embedding /health over HTTP (Europa is usually off by design)
-  hermes-releases [n]         latest n upstream Hermes releases, notes cut at 6000 chars (default 5)
-  hermes-release <tag>        one release with its full notes; read every release between the installed version and the target before hermes-upgrade
 
-Europa control and Hermes configuration are operator tasks.`;
+Europa control is an operator task.`;
 
 export function buildInferenceRemote(args: string[]): { remote: string; spec: RemoteSpec } {
     const [name, ...given] = args;
@@ -91,63 +64,14 @@ export function buildInferenceRemote(args: string[]): { remote: string; spec: Re
         rest = rest.filter((_, i) => i !== index);
     }
     if (rest.length !== spec.args) throw new UsageError(`${name} takes ${spec.args} argument(s)`);
-    if (name.startsWith("nexus-") && spec.args >= 1 && !NEXUS_SERVICES.includes(rest[0])) throw new UsageError(`service must be one of ${NEXUS_SERVICES.join(", ")}`);
+    if (spec.args >= 1 && !NEXUS_SERVICES.includes(rest[0])) throw new UsageError(`service must be one of ${NEXUS_SERVICES.join(", ")}`);
     if (name === "nexus-log") {
         const n = Number(rest[1]);
         if (!Number.isInteger(n) || n < 1 || n > 2000) throw new UsageError("lines must be an integer from 1 to 2000");
     }
-    if (name === "hermes-restart" && !HERMES_SERVICES.includes(rest[0])) throw new UsageError(`service must be one of ${HERMES_SERVICES.join(", ")}`);
-    if (name === "hermes-journal" && !SINCE.test(rest[0])) throw new UsageError("since: letters, digits, spaces, colon, plus, minus only");
     return { remote: [name, ...rest].join(" "), spec };
 }
 
-interface GithubRelease {
-    tag_name?: string;
-    name?: string;
-    published_at?: string;
-    html_url?: string;
-    prerelease?: boolean;
-    body?: string;
-}
-
-/** Trims GitHub release objects to what an upgrade decision needs. */
-export function compactReleases(releases: GithubRelease[]): { tag: string; name: string; published: string; prerelease: boolean; url: string; notes: string }[] {
-    return releases.map((r) => ({
-        tag: r.tag_name ?? "?",
-        name: r.name ?? "",
-        published: r.published_at ?? "",
-        prerelease: r.prerelease === true,
-        url: r.html_url ?? "",
-        notes: (r.body ?? "").slice(0, 6000),
-    }));
-}
-
-const RELEASE_TAG = /^[A-Za-z0-9._-]{1,60}$/;
-
-async function github(config: InferenceConfig, path: string): Promise<unknown> {
-    if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(config.hermesRepo)) throw new ServiceError("hermesRepo must be owner/name");
-    const response = await fetch(`https://api.github.com/repos/${config.hermesRepo}${path}`, {
-        headers: { Accept: "application/vnd.github+json", "User-Agent": "pi-astro-inference-specialist" },
-        signal: AbortSignal.timeout(30_000),
-    });
-    if (!response.ok) throw new ServiceError(`GitHub answered ${response.status} for ${config.hermesRepo}${path}`);
-    return response.json();
-}
-
-async function hermesReleases(config: InferenceConfig, countArg: string | undefined): Promise<number> {
-    const n = countArg === undefined ? 5 : Number(countArg);
-    if (!Number.isInteger(n) || n < 1 || n > 30) throw new UsageError("hermes-releases [n]: n must be 1..30");
-    printJson({ repository: config.hermesRepo, releases: compactReleases((await github(config, `/releases?per_page=${n}`)) as GithubRelease[]) });
-    return 0;
-}
-
-async function hermesRelease(config: InferenceConfig, tag: string | undefined): Promise<number> {
-    if (tag === undefined || !RELEASE_TAG.test(tag)) throw new UsageError("hermes-release <tag>, e.g. v2026.9.14");
-    const release = (await github(config, `/releases/tags/${encodeURIComponent(tag)}`)) as GithubRelease;
-    printJson({ repository: config.hermesRepo, ...compactReleases([release])[0], notes: release.body ?? "" });
-    return 0;
-}
-
 async function europaHealth(config: InferenceConfig): Promise<number> {
     const result = await run("/usr/bin/curl", ["--silent", "--output", "/dev/null", "--max-time", "5", "--write-out", "%{http_code}", config.europaHealthUrl], { timeoutMs: 15_000 });
     const httpCode = result.stdout.trim();
@@ -163,15 +87,9 @@ export async function command(args: string[]): Promise<number> {
     }
     const config = readConfig<InferenceConfig>(SERVICE, SHAPE);
     if (args[0] === "europa-health") return europaHealth(config);
-    if (args[0] === "hermes-releases") return hermesReleases(config, args[1]);
-    if (args[0] === "hermes-release") return hermesRelease(config, args[1]);
     const { remote, spec } = buildInferenceRemote(args);
-    const targets: Record<Target, { host: string; user: string; keyFile: string }> = {
-        nexus: { host: config.nexusHost, user: config.nexusUser, keyFile: secretPath(SERVICE, "SSH_KEY_NEXUS") },
-        hermes: { host: config.hermesHost, user: config.hermesUser, keyFile: secretPath(SERVICE, "SSH_KEY_HERMES") },
-        pulsar: { host: config.pulsarHost, user: config.pulsarUser, keyFile: secretPath(SERVICE, "SSH_KEY_PULSAR") },
-    };
-    const result = await sshFixed({ ...targets[spec.target], knownHostsFile: join(specialistsHome(), "config", "known_hosts") }, remote, spec.timeoutMs);
+    const nexus = { host: config.nexusHost, user: config.nexusUser, keyFile: secretPath(SERVICE, "SSH_KEY_NEXUS") };
+    const result = await sshFixed({ ...nexus, knownHostsFile: join(specialistsHome(), "config", "known_hosts") }, remote, spec.timeoutMs);
     if (result.stdout.length > 0) printRaw(result.stdout);
     if (result.code !== 0) throw new ServiceError(result.stderr.trim() || `${args[0]} exited ${result.code}`);
     return 0;

package/specialists/lib/arcane-host.test.ts

@@ -75,6 +75,29 @@ describe("Arcane host commands", () => {
                 ["arcane-backup.timer", null],
             ]);
         });
+
+        it("compares the probes in their subfolder and ignores names outside host/", () => {
+            dir = mkdtempSync(join(tmpdir(), "audit-"));
+            mkdirSync(join(dir, "host", "spc-arcane-probes"), { recursive: true });
+            writeFileSync(join(dir, "host", "spc-arcane-probes", "host_probe.py"), "print(1)\n");
+            writeFileSync(join(dir, "outside.txt"), "x\n");
+            const probe = createHash("sha256").update("print(1)\n").digest("hex");
+            const outside = createHash("sha256").update("x\n").digest("hex");
+            expect(
+                compareAudit(
+                    [
+                        { name: "spc-arcane-probes/host_probe.py", state: "present", sha256: probe },
+                        { name: "../outside.txt", state: "present", sha256: outside },
+                        { name: "/etc/passwd", state: "present", sha256: outside },
+                    ],
+                    dir,
+                ).map((r) => [r.name, r.match]),
+            ).toEqual([
+                ["spc-arcane-probes/host_probe.py", true],
+                ["../outside.txt", null],
+                ["/etc/passwd", null],
+            ]);
+        });
     });
 });
 
@@ -115,7 +138,7 @@ describe("deployment checks", () => {
     const expect_ = { project: "grimoire", commit: "abc1234", services: { "grimoire-api-1": D1 }, jobs: { "grimoire-migrate": D2 }, noHealth: [] };
     const sync = syncFacts({ lastSyncCommit: "abc1234ffff", lastSyncStatus: "success", lastSyncAt: "t1" });
 
-    it("parses the arguments arcane-ops took", () => {
+    it("parses the host command arguments", () => {
         expect(parseDeploymentArgs(["wait", "grimoire", "--commit", "abc1234", "--container", `grimoire-api-1=${D1}`, "--timeout", "120"])).toMatchObject({
             wait: true,
             timeoutS: 120,

package/specialists/lib/arcane-host.ts

@@ -134,15 +134,19 @@ export interface AuditFile {
     gid?: number;
 }
 
+/** A tracked name under `host/`, such as `arcane-backup.sh` or `spc-arcane-probes/host_probe.py`; no `..`, no absolute path. */
+const AUDIT_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*(\/[A-Za-z0-9][A-Za-z0-9._-]*)?$/;
+
 /**
  * Compares the host's file hashes with `host/<name>` in the specialist's
- * checkout of the arcane repository; `match` is null when either side is missing.
+ * checkout of the arcane repository; `match` is null when either side is missing
+ * or the host reports a name outside `host/`.
  */
 export function compareAudit(files: readonly AuditFile[], checkout: string): { name: string; state: string; match: boolean | null; mode?: number; uid?: number; gid?: number }[] {
     return files.map((f) => {
         const source = join(checkout, "host", f.name);
         let expected: string | null = null;
-        if (existsSync(source) && lstatSync(source).isFile()) expected = createHash("sha256").update(readFileSync(source)).digest("hex");
+        if (AUDIT_NAME.test(f.name) && existsSync(source) && lstatSync(source).isFile()) expected = createHash("sha256").update(readFileSync(source)).digest("hex");
         return { name: f.name, state: f.state, match: f.state !== "present" || expected === null ? null : f.sha256 === expected, mode: f.mode, uid: f.uid, gid: f.gid };
     });
 }

package/specialists/lib/deployment.ts

@@ -119,7 +119,7 @@ export function syncFacts(row: Record<string, unknown>): SyncFacts {
     };
 }
 
-/** The checks of arcane-ops `deployment check`, as one pure comparison. */
+/** The deployment checks (sync commit and state, hook, each container's project, image, state, health) as one pure comparison. */
 export function deploymentChecks(expect: DeploymentExpectation, sync: SyncFacts, containers: readonly (ContainerFacts | null)[], syncAfter: SyncFacts): { status: "ok" | "failed" | "unknown"; checks: DeploymentCheck[] } {
     const checks: DeploymentCheck[] = [];
     const commitOk = sync.commit !== null && (sync.commit.startsWith(expect.commit) || expect.commit.startsWith(sync.commit));

package/specialists/provision/provision.sh

@@ -12,8 +12,8 @@ client_file="$config_dir/client.env"
 password_file="$config_dir/master-password"
 root="$home/.specialists"
 collection_name="${SPECIALISTS_COLLECTION:-specialists}"
-BW=/opt/homebrew/bin/bw
-JQ=/opt/homebrew/bin/jq
+BW=/usr/local/libexec/specialist-bw/current/bw
+JQ=/usr/local/libexec/specialist-jq/current/jq
 
 for f in "$client_file" "$password_file"; do
   [ -f "$f" ] || { echo "missing $f" >&2; exit 2; }

package/specialists/wrappers.test.ts

@@ -7,7 +7,7 @@ import { buildBackupRemote, command as backupCommand } from "./backup/run.ts";
 import { parseParams, parseRecordFilters, technitiumRequest, command as dnsCommand } from "./dns/run.ts";
 import { buildVpsRemote, command as edgeCommand, isTransientSshFailure, PUBLIC_ROUTES, routeProbe } from "./edge/run.ts";
 import { API_PREFIXES, buildDmzRemote, validateApiPath, command as identityCommand } from "./identity/run.ts";
-import { buildInferenceRemote, compactReleases, command as inferenceCommand } from "./inference/run.ts";
+import { buildInferenceRemote, command as inferenceCommand } from "./inference/run.ts";
 import { MAX_ADD_IDS, buildTrendarrCall, interpretRun, parseImdbIds, trendarrConfig, trendarrError, trendarrWarnings, command as mediaCommand } from "./media/run.ts";
 import { ServiceError, UsageError } from "./lib/errors.ts";
 import { safeRepoPath, safeWritePath } from "./lib/repo.ts";
@@ -189,7 +189,7 @@ describe("edge wrapper", () => {
         const curl = async (args: string[]) => {
             seen.push(args);
             const url = args.at(-1) ?? "";
-            return { stdout: url.includes("/auth/v1/settings") ? "401 0.12" : url.includes("studio") ? "302 0.10" : "200 0.05", code: 0 };
+            return { stdout: url.includes("/auth/v1/settings") ? "401 0.12" : url.includes("oauth-authorization-server") ? "404 0.08" : url.includes("studio") || url.includes("mealie") ? "302 0.10" : "200 0.05", code: 0 };
         };
         const all = await routeProbe([], curl);
         expect(all).toHaveLength(Object.keys(PUBLIC_ROUTES).length);
@@ -429,31 +429,21 @@ describe("proxmox wrapper", () => {
 });
 
 describe("inference wrapper", () => {
-    it("maps commands to targets and enforces confirmation", () => {
-        expect(buildInferenceRemote(["nexus-status"])).toMatchObject({ remote: "nexus-status", spec: { target: "nexus" } });
+    it("maps commands to fixed remote strings and enforces confirmation", () => {
+        expect(buildInferenceRemote(["nexus-status"]).remote).toBe("nexus-status");
         expect(buildInferenceRemote(["nexus-log", "embed", "100"]).remote).toBe("nexus-log embed 100");
         expect(buildInferenceRemote(["nexus-stop", "rerank", "--confirm"]).remote).toBe("nexus-stop rerank");
-        expect(buildInferenceRemote(["hermes-upgrade", "--confirm"])).toMatchObject({ remote: "hermes-upgrade", spec: { target: "pulsar" } });
-        expect(buildInferenceRemote(["hermes-journal", "1 hour ago"])).toMatchObject({ spec: { target: "hermes" } });
         expect(() => buildInferenceRemote(["nexus-stop", "rerank"])).toThrow(/--confirm/);
-        expect(() => buildInferenceRemote(["hermes-upgrade"])).toThrow(/--confirm/);
         expect(() => buildInferenceRemote(["nexus-restart", "server"])).toThrow(/service/);
         expect(() => buildInferenceRemote(["nexus-log", "embed", "5000"])).toThrow(/lines/);
-        expect(() => buildInferenceRemote(["hermes-restart", "discord"])).toThrow(/service/);
         expect(() => buildInferenceRemote(["europa-start"])).toThrow(/unknown command/);
-    });
-
-    it("compacts github releases", () => {
-        const releases = compactReleases([{ tag_name: "v2026.9.1", name: "Sept", published_at: "2026-09-10T00:00:00Z", html_url: "https://x/y", prerelease: false, body: "x".repeat(7000) }, {}]);
-        expect(releases[0]).toMatchObject({ tag: "v2026.9.1", name: "Sept", prerelease: false, url: "https://x/y" });
-        expect(releases[0].notes.length).toBe(6000);
-        expect(releases[1]).toEqual({ tag: "?", name: "", published: "", prerelease: false, url: "", notes: "" });
+        expect(() => buildInferenceRemote(["hermes-status"])).toThrow(/unknown command/);
     });
 
     it("prints help without touching config", async () => {
         const write = vi.spyOn(process.stdout, "write").mockImplementation(() => true);
         expect(await inferenceCommand(["help"])).toBe(0);
-        expect(String(write.mock.calls[0][0])).toContain("hermes-releases");
+        expect(String(write.mock.calls[0][0])).toContain("europa-health");
         write.mockRestore();
     });
 });

package/specialists/entry/remote/spc-inference-hermes-entry.sh

@@ -1,27 +0,0 @@
-#!/bin/sh
-# Forced command for the spc-inference key on LXC 101 (user hermes, no sudo).
-# authorized_keys line in /home/hermes/.ssh/authorized_keys:
-#   command="/usr/local/sbin/spc-inference-hermes-entry",no-port-forwarding,no-agent-forwarding,no-pty,no-X11-forwarding ssh-ed25519 AAAA... spc-inference-hermes@cortex
-set -eu
-export PATH="$HOME/.local/bin:$HOME/.hermes/hermes-agent/venv/bin:/usr/local/bin:/usr/bin:/bin"
-export XDG_RUNTIME_DIR="/run/user/$(id -u)"
-cmd="${SSH_ORIGINAL_COMMAND:-}"
-name="${cmd%% *}"
-rest=""
-[ "$cmd" != "$name" ] && rest="${cmd#* }"
-since_ok() { printf '%s' "$1" | grep -Eq '^[A-Za-z0-9 :+-]{1,40}$'; }
-units="hermes-gateway.service hermes-gateway-api.service"
-
-case "$name" in
-  hermes-status) systemctl --user status $units --no-pager --lines=5 || true ;;
-  hermes-journal) since_ok "$rest" || { echo "bad since" >&2; exit 2; }; journalctl --user -u hermes-gateway.service -u hermes-gateway-api.service --since "$rest" --no-pager -n 200 ;;
-  hermes-errors) hermes logs errors ;;
-  hermes-restart)
-    case "$rest" in gateway) u=hermes-gateway.service ;; api) u=hermes-gateway-api.service ;; *) echo "bad service" >&2; exit 2 ;; esac
-    systemctl --user restart "$u"; sleep 3; systemctl --user status "$u" --no-pager --lines=5 || true ;;
-  hermes-api-health)
-    printf 'health=%s\n' "$(curl -s -o /dev/null -w '%{http_code}' -m 5 http://localhost:8650/health || echo 000)"
-    printf 'models=%s (401 expected)\n' "$(curl -s -o /dev/null -w '%{http_code}' -m 5 http://localhost:8650/v1/models || echo 000)" ;;
-  hermes-version) hermes --version | head -1 ;;
-  *) echo "refused: $cmd" >&2; exit 2 ;;
-esac

package/specialists/entry/remote/spc-inference-pulsar-entry.sh

@@ -1,14 +0,0 @@
-#!/bin/sh
-# Forced command for the spc-inference key on Pulsar (root): Hermes guest operations.
-# authorized_keys line:
-#   command="/usr/local/sbin/spc-inference-pulsar-entry",no-port-forwarding,no-agent-forwarding,no-pty,no-X11-forwarding ssh-ed25519 AAAA... spc-inference-pulsar@cortex
-set -eu
-export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
-cmd="${SSH_ORIGINAL_COMMAND:-}"
-
-case "$cmd" in
-  hermes-guest-status) pct status 101 ;;
-  hermes-snapshots) pct listsnapshot 101 ;;
-  hermes-upgrade) /usr/local/bin/hermes-upgrade ;;
-  *) echo "refused: $cmd" >&2; exit 2 ;;
-esac