@astrofoundry/pi-astro 0.34.1 → 0.36.0

package/specialists/entry/specialist-install.sh

@@ -1,14 +1,16 @@
 #!/bin/sh
 # /usr/local/sbin/specialist-install: installs the specialist user's Node, wrappers,
-# arcane-cli, and trendarr from downloads it checks itself. Installed root-owned 0755.
+# arcane-cli, trendarr, Python, gcloud, bw, and jq from downloads it checks itself.
+# Installed root-owned 0755.
 # Runs as root through
 #   cortex ALL=(root) NOPASSWD: /usr/local/sbin/specialist-install
 # It runs only system binaries and the Node it installed, never anything the cortex
 # user can write (all of Homebrew), and it touches the specialist's home only as that
 # user, so links the specialist plants there cannot redirect a root write.
 #
-#   specialist-install node|wrappers|arcane-cli|trendarr <version>
-#   specialist-install rollback node|wrappers|arcane-cli|trendarr
+#   specialist-install node|wrappers|arcane-cli|trendarr|gcloud|bw|jq <version>
+#   specialist-install python <x.y.z+YYYYMMDD>
+#   specialist-install rollback node|wrappers|arcane-cli|trendarr|python|gcloud|bw|jq
 #   specialist-install status
 set -eu
 PATH=/usr/bin:/bin:/usr/sbin:/sbin
@@ -18,11 +20,18 @@ cd /
 
 SPECIALIST=specialist
 NODE_BASE=/usr/local/libexec/specialist-node
+PYTHON_BASE=/usr/local/libexec/specialist-python
+GCLOUD_BASE=/usr/local/libexec/specialist-gcloud
+BW_BASE=/usr/local/libexec/specialist-bw
+JQ_BASE=/usr/local/libexec/specialist-jq
+# Components of the official darwin-arm gcloud archive that gcloud itself needs (bq,
+# gsutil, and the empty macOS bundled-python component are left out).
+GCLOUD_COMPONENTS="core core-nix gcloud-deps gcloud-deps-darwin-arm gcloud-crc32c-darwin-arm"
 # Same list as the allowlist in specialist-cli; a new specialist needs both reinstalled.
 SERVICES="arcane identity network dns edge security backup proxmox inference media"
 
 usage() {
-  echo "usage: specialist-install node|wrappers|arcane-cli|trendarr <version> | rollback node|wrappers|arcane-cli|trendarr | status" >&2
+  echo "usage: specialist-install node|wrappers|arcane-cli|trendarr|gcloud|bw|jq <version> | python <x.y.z+YYYYMMDD> | rollback node|wrappers|arcane-cli|trendarr|python|gcloud|bw|jq | status" >&2
   exit 2
 }
 
@@ -50,17 +59,34 @@ version_lt() {
   [ "$3" -lt "$6" ]
 }
 
+# A python-build-standalone release: CPython x.y.z and the build date that names the release.
+valid_python_version() {
+  case "$1" in '' | *[!0-9.+]*) return 1 ;; esac
+  printf '%s\n' "$1" | /usr/bin/grep -Eq '^(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})\+[0-9]{8}$'
+}
+
+# True when python release $1 is older than $2: CPython version first, then build date.
+python_lt() {
+  version_lt "${1%+*}" "${2%+*}" && return 0
+  version_lt "${2%+*}" "${1%+*}" && return 1
+  [ "${1#*+}" -lt "${2#*+}" ]
+}
+
 component_ok() {
-  case "$1" in node | wrappers | arcane-cli | trendarr) return 0 ;; esac
+  case "$1" in node | wrappers | arcane-cli | trendarr | python | gcloud | bw | jq) return 0 ;; esac
   return 1
 }
 
 command=${1:-}
 case "$command" in
-  node | wrappers | arcane-cli | trendarr)
+  node | wrappers | arcane-cli | trendarr | gcloud | bw | jq)
     [ $# -eq 2 ] || usage
     valid_version "$2" || usage
     ;;
+  python)
+    [ $# -eq 2 ] || usage
+    valid_python_version "$2" || usage
+    ;;
   rollback)
     [ $# -eq 2 ] || usage
     component_ok "$2" || usage
@@ -230,6 +256,217 @@ rollback_node() {
   echo "node $previous is current; previous $current"
 }
 
+# Root-owned tools for the specialist: each version in its own folder under
+# /usr/local/libexec/specialist-<tool>, behind the links current and previous.
+check_tool_base() {
+  check_root_dir /
+  check_root_dir /usr
+  check_root_dir /usr/local
+  ensure_root_dir /usr/local/libexec
+  ensure_root_dir "$1"
+}
+
+# $1 base, $2 link name, $3 version check, $4 executable inside a version folder.
+tool_link() {
+  target=$(/usr/bin/readlink "$1/$2" 2>/dev/null) || return 0
+  "$3" "$target" && [ -x "$1/$target/$4" ] && printf '%s' "$target"
+  return 0
+}
+
+switch_tool_link() {
+  /bin/rm -f "$1/.$2.tmp"
+  (umask 022 && /bin/ln -s "$3" "$1/.$2.tmp")
+  /bin/mv -h "$1/.$2.tmp" "$1/$2"
+}
+
+new_tool_folder() {
+  /bin/rm -rf "$1.partial"
+  /bin/mkdir -m 0755 "$1.partial"
+}
+
+seal_tool_folder() {
+  /usr/sbin/chown -R root:wheel "$1.partial"
+  /bin/chmod -R u=rwX,go=rX "$1.partial"
+}
+
+# Moves the checked $base/$version.partial into place, makes it current, keeps the old current as previous.
+activate_tool() {
+  /bin/rm -rf "$1/$2"
+  /bin/mv "$1/$2.partial" "$1/$2"
+  [ -z "$3" ] || switch_tool_link "$1" previous "$3"
+  switch_tool_link "$1" current "$2"
+  for d in "$1"/*; do
+    n=${d##*/}
+    case "$n" in current | previous | "$2" | "$3") continue ;; esac
+    /bin/rm -rf "$d"
+  done
+}
+
+# $1 base, $2 label, $3 version check, $4 executable, $5 smoke function taking the executable's path.
+rollback_tool() {
+  check_tool_base "$1"
+  current=$(tool_link "$1" current "$3" "$4")
+  previous=$(tool_link "$1" previous "$3" "$4")
+  [ -n "$current" ] && [ -n "$previous" ] || fail "no previous $2 to roll back to"
+  "$5" "$1/$previous/$4" "$previous" || fail "$2 $previous fails its check"
+  switch_tool_link "$1" current "$previous"
+  switch_tool_link "$1" previous "$current"
+  echo "$2 $previous is current; previous $current"
+}
+
+# Python from python-build-standalone: gcloud needs Python 3.10 to 3.15, and its macOS
+# installer offers only Homebrew's (owned by cortex) or an unchecked python.org package.
+SMOKE_PYTHON='"$1" -c "import ssl, sqlite3, sys; print(\"%d.%d.%d\" % sys.version_info[:3])"'
+SMOKE_GCLOUD='cfg=$(/usr/bin/mktemp -d); trap "/bin/rm -rf \"\$cfg\"" EXIT
+CLOUDSDK_PYTHON=$2 CLOUDSDK_CONFIG=$cfg CLOUDSDK_CORE_DISABLE_PROMPTS=1 "$1" version 2>/dev/null | /usr/bin/head -n 1'
+SMOKE_BW='app=$(/usr/bin/mktemp -d); trap "/bin/rm -rf \"\$app\"" EXIT
+BITWARDENCLI_APPDATA_DIR=$app "$1" --version 2>/dev/null'
+SMOKE_JQ='"$1" --version'
+
+smoke_python() {
+  [ "$(as_specialist "$SMOKE_PYTHON" "$1")" = "${2%+*}" ]
+}
+
+current_python() {
+  python=$(tool_link "$PYTHON_BASE" current valid_python_version bin/python3)
+  [ -n "$python" ] || fail "no specialist Python yet: run specialist-install python <x.y.z+YYYYMMDD> first"
+  printf '%s' "$PYTHON_BASE/$python/bin/python3"
+}
+
+# gcloud $1 (bin/gcloud) answers with version $2, run by Python $3.
+gcloud_answers() {
+  [ "$(as_specialist "$SMOKE_GCLOUD" "$1" "$3")" = "Google Cloud SDK $2" ]
+}
+
+smoke_gcloud() {
+  gcloud_answers "$1" "$2" "$(current_python)"
+}
+
+smoke_bw() {
+  [ "$(as_specialist "$SMOKE_BW" "$1")" = "$2" ]
+}
+
+smoke_jq() {
+  [ "$(as_specialist "$SMOKE_JQ" "$1")" = "jq-$2" ]
+}
+
+install_python() {
+  version=$1
+  check_tool_base "$PYTHON_BASE"
+  current=$(tool_link "$PYTHON_BASE" current valid_python_version bin/python3)
+  if [ -n "$current" ] && python_lt "$version" "$current"; then fail "python $version is older than the installed $current; use rollback"; fi
+  [ "$current" != "$version" ] || { echo "python $version is already current"; return 0; }
+  tag=${version#*+}
+  name="cpython-$version-aarch64-apple-darwin-install_only_stripped.tar.gz"
+  base="https://github.com/astral-sh/python-build-standalone/releases/download/$tag"
+  fetch "$base/$name" "$work/$name"
+  fetch "$base/SHA256SUMS" "$work/SHA256SUMS"
+  check_sha256 "$work" "$name" "$work/SHA256SUMS"
+  dest="$PYTHON_BASE/$version"
+  new_tool_folder "$dest"
+  /usr/bin/tar -xzf "$work/$name" -C "$dest.partial" --strip-components 1
+  seal_tool_folder "$dest"
+  smoke_python "$dest.partial/bin/python3" "$version" || fail "python $version does not run"
+  gcloud=$(tool_link "$GCLOUD_BASE" current valid_version bin/gcloud)
+  if [ -n "$gcloud" ]; then
+    gcloud_answers "$GCLOUD_BASE/$gcloud/bin/gcloud" "$gcloud" "$dest.partial/bin/python3" || fail "gcloud $gcloud fails with python $version; current stays ${current:-unset}"
+  fi
+  activate_tool "$PYTHON_BASE" "$version" "$current"
+  echo "python $version is current${current:+; previous $current}"
+}
+
+# gcloud from the components of Google's release snapshot, each archive checked against
+# the sha256 the snapshot lists; the snapshot and the archives come from dl.google.com.
+install_gcloud() {
+  version=$1
+  python=$(current_python)
+  check_tool_base "$GCLOUD_BASE"
+  current=$(tool_link "$GCLOUD_BASE" current valid_version bin/gcloud)
+  if [ -n "$current" ] && version_lt "$version" "$current"; then fail "gcloud $version is older than the installed $current; use rollback"; fi
+  [ "$current" != "$version" ] || { echo "gcloud $version is already current"; return 0; }
+  channel=https://dl.google.com/dl/cloudsdk/channels/rapid
+  snapshot="$work/components.json"
+  fetch "$channel/components-v$version.json" "$snapshot"
+  [ "$(json_field "$snapshot" version)" = "$version" ] || fail "gcloud $version has no release snapshot"
+  dest="$GCLOUD_BASE/$version"
+  new_tool_folder "$dest"
+  for want in $GCLOUD_COMPONENTS; do
+    i=0
+    found=""
+    while [ "$i" -lt 1000 ]; do
+      id=$(json_field "$snapshot" "components.$i.id") || break
+      if [ "$id" = "$want" ]; then found=$i; break; fi
+      i=$((i + 1))
+    done
+    [ -n "$found" ] || fail "gcloud $version has no component $want"
+    source=$(json_field "$snapshot" "components.$found.data.source") || fail "component $want has no archive"
+    sum=$(json_field "$snapshot" "components.$found.data.checksum") || fail "component $want has no checksum"
+    printf '%s\n' "$source" | /usr/bin/grep -Eq '^components/google-cloud-sdk-[a-z0-9-]+-[0-9]{14}\.tar\.gz$' || fail "unexpected archive for component $want"
+    printf '%s\n' "$sum" | /usr/bin/grep -Eq '^[0-9a-f]{64}$' || fail "unexpected checksum for component $want"
+    fetch "$channel/$source" "$work/$want.tgz"
+    [ "$(/usr/bin/shasum -a 256 "$work/$want.tgz" | /usr/bin/awk '{ print $1 }')" = "$sum" ] || fail "checksum mismatch for component $want"
+    /usr/bin/tar -xzf "$work/$want.tgz" -C "$dest.partial"
+  done
+  seal_tool_folder "$dest"
+  gcloud_answers "$dest.partial/bin/gcloud" "$version" "$python" || fail "gcloud $version does not run"
+  activate_tool "$GCLOUD_BASE" "$version" "$current"
+  echo "gcloud $version is current${current:+; previous $current}"
+}
+
+# Bitwarden CLI: the native macOS arm64 build, checked against the sha256 digest GitHub publishes for the release asset.
+install_bw() {
+  version=$1
+  check_tool_base "$BW_BASE"
+  current=$(tool_link "$BW_BASE" current valid_version bw)
+  if [ -n "$current" ] && version_lt "$version" "$current"; then fail "bw $version is older than the installed $current; use rollback"; fi
+  [ "$current" != "$version" ] || { echo "bw $version is already current"; return 0; }
+  name="bw-macos-arm64-$version.zip"
+  release="$work/bw-release.json"
+  fetch "https://api.github.com/repos/bitwarden/clients/releases/tags/cli-v$version" "$release"
+  i=0
+  found=""
+  while [ "$i" -lt 100 ]; do
+    asset=$(json_field "$release" "assets.$i.name") || break
+    if [ "$asset" = "$name" ]; then found=$i; break; fi
+    i=$((i + 1))
+  done
+  [ -n "$found" ] || fail "bw $version has no $name"
+  digest=$(json_field "$release" "assets.$found.digest") || fail "$name has no published digest"
+  printf '%s\n' "$digest" | /usr/bin/grep -Eq '^sha256:[0-9a-f]{64}$' || fail "unexpected digest for $name"
+  url="https://github.com/bitwarden/clients/releases/download/cli-v$version/$name"
+  [ "$(json_field "$release" "assets.$found.browser_download_url")" = "$url" ] || fail "unexpected download location for $name"
+  fetch "$url" "$work/$name"
+  [ "sha256:$(/usr/bin/shasum -a 256 "$work/$name" | /usr/bin/awk '{ print $1 }')" = "$digest" ] || fail "checksum mismatch for $name"
+  dest="$BW_BASE/$version"
+  new_tool_folder "$dest"
+  /usr/bin/unzip -q "$work/$name" bw -d "$dest.partial" || fail "$name has no bw"
+  /bin/chmod 0755 "$dest.partial/bw"
+  seal_tool_folder "$dest"
+  smoke_bw "$dest.partial/bw" "$version" || fail "bw $version does not run"
+  activate_tool "$BW_BASE" "$version" "$current"
+  echo "bw $version is current${current:+; previous $current}"
+}
+
+# jq: the macOS arm64 binary, checked against the release's sha256sum.txt.
+install_jq() {
+  version=$1
+  check_tool_base "$JQ_BASE"
+  current=$(tool_link "$JQ_BASE" current valid_version jq)
+  if [ -n "$current" ] && version_lt "$version" "$current"; then fail "jq $version is older than the installed $current; use rollback"; fi
+  [ "$current" != "$version" ] || { echo "jq $version is already current"; return 0; }
+  base="https://github.com/jqlang/jq/releases/download/jq-$version"
+  fetch "$base/jq-macos-arm64" "$work/jq-macos-arm64"
+  fetch "$base/sha256sum.txt" "$work/sha256sum.txt"
+  check_sha256 "$work" jq-macos-arm64 "$work/sha256sum.txt"
+  dest="$JQ_BASE/$version"
+  new_tool_folder "$dest"
+  /usr/bin/install -m 0755 "$work/jq-macos-arm64" "$dest.partial/jq"
+  seal_tool_folder "$dest"
+  smoke_jq "$dest.partial/jq" "$version" || fail "jq $version does not run"
+  activate_tool "$JQ_BASE" "$version" "$current"
+  echo "jq $version is current${current:+; previous $current}"
+}
+
 WRAPPER_VERSION='v=$(cat "$HOME/.specialists/bin/VERSION" 2>/dev/null) || exit 0; printf "%s" "$v"'
 
 # Moves the new wrapper files in and the old ones aside, two renames per item, then
@@ -433,13 +670,26 @@ json_version() {
   if valid_version "$1"; then printf '"%s"' "$1"; else printf 'null'; fi
 }
 
+json_python() {
+  if valid_python_version "$1"; then printf '"%s"' "$1"; else printf 'null'; fi
+}
+
+# {"current":..,"previous":..} of one root-owned tool: $1 base, $2 version check, $3 executable, $4 JSON writer.
+json_tool() {
+  printf '{"current":%s,"previous":%s}' "$("$4" "$(tool_link "$1" current "$2" "$3")")" "$("$4" "$(tool_link "$1" previous "$2" "$3")")"
+}
+
 status() {
   wrappers=$(as_specialist "$WRAPPER_VERSION" || true)
   arcane=$(as_specialist "$ARCANE_VERSION" || true)
   trendarr=$(as_specialist "$TRENDARR_VERSION" || true)
-  printf '{"node":{"current":%s,"previous":%s},"wrappers":%s,"arcaneCli":%s,"trendarr":%s}\n' \
+  printf '{"node":{"current":%s,"previous":%s},"wrappers":%s,"arcaneCli":%s,"trendarr":%s,"python":%s,"gcloud":%s,"bw":%s,"jq":%s}\n' \
     "$(json_version "$(node_link current)")" "$(json_version "$(node_link previous)")" \
-    "$(json_version "$wrappers")" "$(json_version "$arcane")" "$(json_version "$trendarr")"
+    "$(json_version "$wrappers")" "$(json_version "$arcane")" "$(json_version "$trendarr")" \
+    "$(json_tool "$PYTHON_BASE" valid_python_version bin/python3 json_python)" \
+    "$(json_tool "$GCLOUD_BASE" valid_version bin/gcloud json_version)" \
+    "$(json_tool "$BW_BASE" valid_version bw json_version)" \
+    "$(json_tool "$JQ_BASE" valid_version jq json_version)"
 }
 
 case "$command" in
@@ -447,12 +697,20 @@ case "$command" in
   wrappers) install_wrappers "$2" ;;
   arcane-cli) install_arcane_cli "$2" ;;
   trendarr) install_trendarr "$2" ;;
+  python) install_python "$2" ;;
+  gcloud) install_gcloud "$2" ;;
+  bw) install_bw "$2" ;;
+  jq) install_jq "$2" ;;
   rollback)
     case "$2" in
       node) rollback_node ;;
       wrappers) rollback_wrappers ;;
       arcane-cli) rollback_arcane_cli ;;
       trendarr) rollback_trendarr ;;
+      python) rollback_tool "$PYTHON_BASE" python valid_python_version bin/python3 smoke_python ;;
+      gcloud) rollback_tool "$GCLOUD_BASE" gcloud valid_version bin/gcloud smoke_gcloud ;;
+      bw) rollback_tool "$BW_BASE" bw valid_version bw smoke_bw ;;
+      jq) rollback_tool "$JQ_BASE" jq valid_version jq smoke_jq ;;
     esac
     ;;
   status) status ;;

package/specialists/entry/specialist-install.test.ts

@@ -40,13 +40,33 @@ describe("specialist-install", () => {
         [["rollback", "pi"]],
         [["rollback", "node", "extra"]],
         [["status", "now"]],
+        [["python", "3.14.8"]],
+        [["python", "3.14.8+2026101"]],
+        [["python", "3.14.8+20261013+1"]],
+        [["python", "3.14.8-20261013"]],
+        [["gcloud", "589.0"]],
+        [["bw", "cli-v2026.10.0"]],
+        [["jq", "jq-1.8.2"]],
+        [["rollback", "brew"]],
     ])("refuses %j with a usage error before anything else", (args) => {
         const result = install(...args);
         expect(result.status).toBe(2);
         expect(result.stderr).toMatch(/^usage: specialist-install/);
     });
 
-    it.skipIf(isRoot).each([[["node", "24.22.0"]], [["wrappers", "0.31.0"]], [["arcane-cli", "2.16.1"]], [["trendarr", "0.6.0"]], [["rollback", "trendarr"]], [["status"]]])(
+    it.skipIf(isRoot).each([
+        [["node", "24.22.0"]],
+        [["wrappers", "0.31.0"]],
+        [["arcane-cli", "2.16.1"]],
+        [["trendarr", "0.6.0"]],
+        [["python", "3.14.8+20261013"]],
+        [["gcloud", "589.0.0"]],
+        [["bw", "2026.10.0"]],
+        [["jq", "1.8.2"]],
+        [["rollback", "trendarr"]],
+        [["rollback", "gcloud"]],
+        [["status"]],
+    ])(
         "accepts %j and then requires root",
         (args) => {
             const result = install(...args);
@@ -74,6 +94,35 @@ describe("specialist-install", () => {
         expect(shellFunction("version_lt", `version_lt ${a} ${b}`).status).toBe(older ? 0 : 1);
     });
 
+    it.each(["3.14.8+20261013", "3.10.0+20250101", "3.15.0+20270401"])("valid_python_version accepts %s", (v) => {
+        expect(shellFunction("valid_python_version", `valid_python_version '${v}'`).status).toBe(0);
+    });
+
+    it.each(["", "3.14.8", "3.14+20261013", "3.14.8+2026101", "3.14.8+20261013a", "+20261013", "3.14.8+ 20261013"])("valid_python_version rejects %j", (v) => {
+        expect(shellFunction("valid_python_version", `valid_python_version '${v}'`).status).toBe(1);
+    });
+
+    it.each([
+        ["3.14.8+20261009", "3.14.8+20261013", true],
+        ["3.14.8+20261013", "3.14.8+20261013", false],
+        ["3.14.9+20261001", "3.14.8+20261013", false],
+        ["3.14.7+20261101", "3.14.8+20261013", true],
+    ])("python_lt %s < %s is %s", (a, b, older) => {
+        const script = readFileSync(SCRIPT, "utf-8");
+        const lt = /^version_lt\(\) \{\n[\s\S]*?^\}/m.exec(script)?.[0] ?? "";
+        expect(shellFunction("python_lt", `${lt}\npython_lt '${a}' '${b}'`).status).toBe(older ? 0 : 1);
+    });
+
+    it("installs gcloud from fixed components and checked downloads only", () => {
+        const text = readFileSync(SCRIPT, "utf-8");
+        expect(/^GCLOUD_COMPONENTS="([^"]+)"$/m.exec(text)?.[1].split(" ")).toEqual(["core", "core-nix", "gcloud-deps", "gcloud-deps-darwin-arm", "gcloud-crc32c-darwin-arm"]);
+        expect(text).toContain("channel=https://dl.google.com/dl/cloudsdk/channels/rapid\n");
+        expect(text).toContain('fetch "$channel/components-v$version.json"');
+        expect(text).toContain("https://github.com/astral-sh/python-build-standalone/releases/download/$tag");
+        expect(text).toContain("https://api.github.com/repos/bitwarden/clients/releases/tags/cli-v$version");
+        expect(text).toContain("https://github.com/jqlang/jq/releases/download/jq-$version");
+    });
+
     it("installs the same services specialist-cli accepts", () => {
         const services = /^SERVICES="([^"]+)"$/m.exec(readFileSync(SCRIPT, "utf-8"))?.[1].split(" ");
         const allowed = /^ {2}([a-z|]+)\) ;;$/m.exec(readFileSync(ENTRY, "utf-8"))?.[1].split("|");

package/specialists/inference/run.ts

@@ -13,30 +13,16 @@ const SERVICE = "inference";
 interface InferenceConfig extends Record<string, string> {
     nexusHost: string;
     nexusUser: string;
-    hermesHost: string;
-    hermesUser: string;
-    pulsarHost: string;
-    pulsarUser: string;
     europaHealthUrl: string;
-    /** GitHub repository whose releases carry the Hermes upgrade notes, owner/name. */
-    hermesRepo: string;
 }
 
 const SHAPE = {
     nexusHost: "string",
     nexusUser: "string",
-    hermesHost: "string",
-    hermesUser: "string",
-    pulsarHost: "string",
-    pulsarUser: "string",
     europaHealthUrl: "string",
-    hermesRepo: "string",
 } as const;
 
-type Target = "nexus" | "hermes" | "pulsar";
-
 interface RemoteSpec {
-    target: Target;
     args: number;
     help: string;
     timeoutMs: number;
@@ -45,40 +31,27 @@ interface RemoteSpec {
 
 const MINUTE = 60_000;
 
-/** Fixed remote commands; the forced commands on Nexus (nexus), LXC 101 (hermes), and Pulsar (root) accept exactly these names. */
+/** Fixed remote commands; the forced command on Nexus (user nexus) accepts exactly these names. */
 export const INFERENCE_COMMANDS: Readonly<Record<string, RemoteSpec>> = {
-    "nexus-status": { target: "nexus", args: 0, help: "LaunchAgent states and /health codes of the embed and rerank servers", timeoutMs: MINUTE },
-    "nexus-restart": { target: "nexus", args: 1, help: "nexus-restart <embed|rerank>   launchctl kickstart -k", timeoutMs: 2 * MINUTE },
-    "nexus-start": { target: "nexus", args: 1, help: "nexus-start <embed|rerank>     launchctl bootstrap from the tracked plist", timeoutMs: 2 * MINUTE },
-    "nexus-stop": { target: "nexus", args: 1, help: "nexus-stop <embed|rerank> --confirm   launchctl bootout", timeoutMs: 2 * MINUTE, confirm: true },
-    "nexus-log": { target: "nexus", args: 2, help: "nexus-log <embed|rerank> <lines>", timeoutMs: MINUTE },
-    "nexus-disk": { target: "nexus", args: 0, help: "free space on the Nexus disk", timeoutMs: MINUTE },
-    "hermes-status": { target: "hermes", args: 0, help: "both gateway user services", timeoutMs: MINUTE },
-    "hermes-journal": { target: "hermes", args: 1, help: "hermes-journal <since>         user journal of both gateways", timeoutMs: MINUTE },
-    "hermes-errors": { target: "hermes", args: 0, help: "hermes logs errors", timeoutMs: MINUTE },
-    "hermes-restart": { target: "hermes", args: 1, help: "hermes-restart <gateway|api>", timeoutMs: 2 * MINUTE },
-    "hermes-api-health": { target: "hermes", args: 0, help: "/health and /v1/models codes on localhost:8650 (expect 200 and 401)", timeoutMs: MINUTE },
-    "hermes-version": { target: "hermes", args: 0, help: "installed Hermes version", timeoutMs: MINUTE },
-    "hermes-guest-status": { target: "pulsar", args: 0, help: "pct status 101", timeoutMs: MINUTE },
-    "hermes-snapshots": { target: "pulsar", args: 0, help: "pct listsnapshot 101", timeoutMs: MINUTE },
-    "hermes-upgrade": { target: "pulsar", args: 0, help: "hermes-upgrade --confirm       snapshot LXC 101, hermes update, restart, health check", timeoutMs: 20 * MINUTE, confirm: true },
+    "nexus-status": { args: 0, help: "LaunchAgent states and /health codes of the embed and rerank servers", timeoutMs: MINUTE },
+    "nexus-restart": { args: 1, help: "nexus-restart <embed|rerank>   launchctl kickstart -k", timeoutMs: 2 * MINUTE },
+    "nexus-start": { args: 1, help: "nexus-start <embed|rerank>     launchctl bootstrap from the tracked plist", timeoutMs: 2 * MINUTE },
+    "nexus-stop": { args: 1, help: "nexus-stop <embed|rerank> --confirm   launchctl bootout", timeoutMs: 2 * MINUTE, confirm: true },
+    "nexus-log": { args: 2, help: "nexus-log <embed|rerank> <lines>", timeoutMs: MINUTE },
+    "nexus-disk": { args: 0, help: "free space on the Nexus disk", timeoutMs: MINUTE },
 };
 
 const NEXUS_SERVICES = ["embed", "rerank"];
-const HERMES_SERVICES = ["gateway", "api"];
-const SINCE = /^[A-Za-z0-9 :\-+]{1,40}$/;
 
-const HELP = `inference specialist (llama.cpp on Nexus, Hermes on LXC 101, Europa health)
+const HELP = `inference specialist (llama.cpp on Nexus, Europa health)
 
   <command> [args]            fixed operations through forced-command SSH keys
 ${Object.entries(INFERENCE_COMMANDS)
     .map(([name, c]) => `      ${name.padEnd(22)} ${c.help}`)
     .join("\n")}
   europa-health               GET the Europa embedding /health over HTTP (Europa is usually off by design)
-  hermes-releases [n]         latest n upstream Hermes releases, notes cut at 6000 chars (default 5)
-  hermes-release <tag>        one release with its full notes; read every release between the installed version and the target before hermes-upgrade
 
-Europa control and Hermes configuration are operator tasks.`;
+Europa control is an operator task.`;
 
 export function buildInferenceRemote(args: string[]): { remote: string; spec: RemoteSpec } {
     const [name, ...given] = args;
@@ -91,63 +64,14 @@ export function buildInferenceRemote(args: string[]): { remote: string; spec: Re
         rest = rest.filter((_, i) => i !== index);
     }
     if (rest.length !== spec.args) throw new UsageError(`${name} takes ${spec.args} argument(s)`);
-    if (name.startsWith("nexus-") && spec.args >= 1 && !NEXUS_SERVICES.includes(rest[0])) throw new UsageError(`service must be one of ${NEXUS_SERVICES.join(", ")}`);
+    if (spec.args >= 1 && !NEXUS_SERVICES.includes(rest[0])) throw new UsageError(`service must be one of ${NEXUS_SERVICES.join(", ")}`);
     if (name === "nexus-log") {
         const n = Number(rest[1]);
         if (!Number.isInteger(n) || n < 1 || n > 2000) throw new UsageError("lines must be an integer from 1 to 2000");
     }
-    if (name === "hermes-restart" && !HERMES_SERVICES.includes(rest[0])) throw new UsageError(`service must be one of ${HERMES_SERVICES.join(", ")}`);
-    if (name === "hermes-journal" && !SINCE.test(rest[0])) throw new UsageError("since: letters, digits, spaces, colon, plus, minus only");
     return { remote: [name, ...rest].join(" "), spec };
 }
 
-interface GithubRelease {
-    tag_name?: string;
-    name?: string;
-    published_at?: string;
-    html_url?: string;
-    prerelease?: boolean;
-    body?: string;
-}
-
-/** Trims GitHub release objects to what an upgrade decision needs. */
-export function compactReleases(releases: GithubRelease[]): { tag: string; name: string; published: string; prerelease: boolean; url: string; notes: string }[] {
-    return releases.map((r) => ({
-        tag: r.tag_name ?? "?",
-        name: r.name ?? "",
-        published: r.published_at ?? "",
-        prerelease: r.prerelease === true,
-        url: r.html_url ?? "",
-        notes: (r.body ?? "").slice(0, 6000),
-    }));
-}
-
-const RELEASE_TAG = /^[A-Za-z0-9._-]{1,60}$/;
-
-async function github(config: InferenceConfig, path: string): Promise<unknown> {
-    if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(config.hermesRepo)) throw new ServiceError("hermesRepo must be owner/name");
-    const response = await fetch(`https://api.github.com/repos/${config.hermesRepo}${path}`, {
-        headers: { Accept: "application/vnd.github+json", "User-Agent": "pi-astro-inference-specialist" },
-        signal: AbortSignal.timeout(30_000),
-    });
-    if (!response.ok) throw new ServiceError(`GitHub answered ${response.status} for ${config.hermesRepo}${path}`);
-    return response.json();
-}
-
-async function hermesReleases(config: InferenceConfig, countArg: string | undefined): Promise<number> {
-    const n = countArg === undefined ? 5 : Number(countArg);
-    if (!Number.isInteger(n) || n < 1 || n > 30) throw new UsageError("hermes-releases [n]: n must be 1..30");
-    printJson({ repository: config.hermesRepo, releases: compactReleases((await github(config, `/releases?per_page=${n}`)) as GithubRelease[]) });
-    return 0;
-}
-
-async function hermesRelease(config: InferenceConfig, tag: string | undefined): Promise<number> {
-    if (tag === undefined || !RELEASE_TAG.test(tag)) throw new UsageError("hermes-release <tag>, e.g. v2026.9.14");
-    const release = (await github(config, `/releases/tags/${encodeURIComponent(tag)}`)) as GithubRelease;
-    printJson({ repository: config.hermesRepo, ...compactReleases([release])[0], notes: release.body ?? "" });
-    return 0;
-}
-
 async function europaHealth(config: InferenceConfig): Promise<number> {
     const result = await run("/usr/bin/curl", ["--silent", "--output", "/dev/null", "--max-time", "5", "--write-out", "%{http_code}", config.europaHealthUrl], { timeoutMs: 15_000 });
     const httpCode = result.stdout.trim();
@@ -163,15 +87,9 @@ export async function command(args: string[]): Promise<number> {
     }
     const config = readConfig<InferenceConfig>(SERVICE, SHAPE);
     if (args[0] === "europa-health") return europaHealth(config);
-    if (args[0] === "hermes-releases") return hermesReleases(config, args[1]);
-    if (args[0] === "hermes-release") return hermesRelease(config, args[1]);
     const { remote, spec } = buildInferenceRemote(args);
-    const targets: Record<Target, { host: string; user: string; keyFile: string }> = {
-        nexus: { host: config.nexusHost, user: config.nexusUser, keyFile: secretPath(SERVICE, "SSH_KEY_NEXUS") },
-        hermes: { host: config.hermesHost, user: config.hermesUser, keyFile: secretPath(SERVICE, "SSH_KEY_HERMES") },
-        pulsar: { host: config.pulsarHost, user: config.pulsarUser, keyFile: secretPath(SERVICE, "SSH_KEY_PULSAR") },
-    };
-    const result = await sshFixed({ ...targets[spec.target], knownHostsFile: join(specialistsHome(), "config", "known_hosts") }, remote, spec.timeoutMs);
+    const nexus = { host: config.nexusHost, user: config.nexusUser, keyFile: secretPath(SERVICE, "SSH_KEY_NEXUS") };
+    const result = await sshFixed({ ...nexus, knownHostsFile: join(specialistsHome(), "config", "known_hosts") }, remote, spec.timeoutMs);
     if (result.stdout.length > 0) printRaw(result.stdout);
     if (result.code !== 0) throw new ServiceError(result.stderr.trim() || `${args[0]} exited ${result.code}`);
     return 0;

package/specialists/lib/arcane-host.test.ts

@@ -75,6 +75,29 @@ describe("Arcane host commands", () => {
                 ["arcane-backup.timer", null],
             ]);
         });
+
+        it("compares the probes in their subfolder and ignores names outside host/", () => {
+            dir = mkdtempSync(join(tmpdir(), "audit-"));
+            mkdirSync(join(dir, "host", "spc-arcane-probes"), { recursive: true });
+            writeFileSync(join(dir, "host", "spc-arcane-probes", "host_probe.py"), "print(1)\n");
+            writeFileSync(join(dir, "outside.txt"), "x\n");
+            const probe = createHash("sha256").update("print(1)\n").digest("hex");
+            const outside = createHash("sha256").update("x\n").digest("hex");
+            expect(
+                compareAudit(
+                    [
+                        { name: "spc-arcane-probes/host_probe.py", state: "present", sha256: probe },
+                        { name: "../outside.txt", state: "present", sha256: outside },
+                        { name: "/etc/passwd", state: "present", sha256: outside },
+                    ],
+                    dir,
+                ).map((r) => [r.name, r.match]),
+            ).toEqual([
+                ["spc-arcane-probes/host_probe.py", true],
+                ["../outside.txt", null],
+                ["/etc/passwd", null],
+            ]);
+        });
     });
 });
 
@@ -115,7 +138,7 @@ describe("deployment checks", () => {
     const expect_ = { project: "grimoire", commit: "abc1234", services: { "grimoire-api-1": D1 }, jobs: { "grimoire-migrate": D2 }, noHealth: [] };
     const sync = syncFacts({ lastSyncCommit: "abc1234ffff", lastSyncStatus: "success", lastSyncAt: "t1" });
 
-    it("parses the arguments arcane-ops took", () => {
+    it("parses the host command arguments", () => {
         expect(parseDeploymentArgs(["wait", "grimoire", "--commit", "abc1234", "--container", `grimoire-api-1=${D1}`, "--timeout", "120"])).toMatchObject({
             wait: true,
             timeoutS: 120,

package/specialists/lib/arcane-host.ts

@@ -134,15 +134,19 @@ export interface AuditFile {
     gid?: number;
 }
 
+/** A tracked name under `host/`, such as `arcane-backup.sh` or `spc-arcane-probes/host_probe.py`; no `..`, no absolute path. */
+const AUDIT_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*(\/[A-Za-z0-9][A-Za-z0-9._-]*)?$/;
+
 /**
  * Compares the host's file hashes with `host/<name>` in the specialist's
- * checkout of the arcane repository; `match` is null when either side is missing.
+ * checkout of the arcane repository; `match` is null when either side is missing
+ * or the host reports a name outside `host/`.
  */
 export function compareAudit(files: readonly AuditFile[], checkout: string): { name: string; state: string; match: boolean | null; mode?: number; uid?: number; gid?: number }[] {
     return files.map((f) => {
         const source = join(checkout, "host", f.name);
         let expected: string | null = null;
-        if (existsSync(source) && lstatSync(source).isFile()) expected = createHash("sha256").update(readFileSync(source)).digest("hex");
+        if (AUDIT_NAME.test(f.name) && existsSync(source) && lstatSync(source).isFile()) expected = createHash("sha256").update(readFileSync(source)).digest("hex");
         return { name: f.name, state: f.state, match: f.state !== "present" || expected === null ? null : f.sha256 === expected, mode: f.mode, uid: f.uid, gid: f.gid };
     });
 }

package/specialists/lib/deployment.ts

@@ -119,7 +119,7 @@ export function syncFacts(row: Record<string, unknown>): SyncFacts {
     };
 }
 
-/** The checks of arcane-ops `deployment check`, as one pure comparison. */
+/** The deployment checks (sync commit and state, hook, each container's project, image, state, health) as one pure comparison. */
 export function deploymentChecks(expect: DeploymentExpectation, sync: SyncFacts, containers: readonly (ContainerFacts | null)[], syncAfter: SyncFacts): { status: "ok" | "failed" | "unknown"; checks: DeploymentCheck[] } {
     const checks: DeploymentCheck[] = [];
     const commitOk = sync.commit !== null && (sync.commit.startsWith(expect.commit) || expect.commit.startsWith(sync.commit));