fix: replace LXC/LXD with Incus

Replace all /snap/bin/lxc references with incus in the
hertz-specific tool definitions. Tool names changed from
lxc_exec/lxc_list to incus_exec/incus_list.

Context: LXC snap was removed from hertz; the system
now uses incus (Debian package) for container management.

lmcp.lua

@@ -939,7 +939,7 @@ local function _check_auth(self, conn)
     if not self._auth_token then return true end
     if conn.method == "OPTIONS" then return true end
     local auth = conn.headers["authorization"] or ""
-    local token = auth:match("^Bearer%s+(.+)$")
+    local token = auth:match("^[Bb]earer%s+(.+)$")
     return token == self._auth_token
 end
 

server.lua

@@ -200,6 +200,13 @@ end
 local server_name = os.getenv("LMCP_NAME") or (WINDOWS and "windows-tools" or "linux-tools")
 local server = lmcp.new(server_name, {
     port = tonumber(os.getenv("LMCP_PORT") or arg[1]) or 8080,
+    -- LMCP_HOST: bind interface (default 0.0.0.0). Hosts that need
+    -- single-interface binding (hertz: 192.168.88.18 only) set this.
+    host = os.getenv("LMCP_HOST"),
+    -- LMCP_CONF: path to a conf file with bearer-token entries
+    -- (e.g. /opt/herding/etc/hertz-tools.conf). Read by lmcp.lua's
+    -- read_conf; the `.godparticle` entry becomes the bearer token.
+    conf = os.getenv("LMCP_CONF"),
 })
 
 -- ---- Tools ----

tools.d/hertz.lua

@@ -0,0 +1,256 @@
+-- /opt/lmcp/tools.d/hertz.lua — hertz-specific tool registrations.
+--
+-- Invoked by the packaged server.lua's tools.d scan (lmcp ≥ v1.2.0, issue #22).
+-- Receives (server, run) — the configured lmcp instance and the
+-- coroutine-aware run() helper. We add hertz-only tools on top of the
+-- packaged generics (shell, read_file, write_file, edit_file, list_dir,
+-- search_files, fetch, web_search, shell_bg).
+--
+-- Previously these all lived in /opt/lmcp/server.lua (a copy-paste fork of
+-- the packaged server.lua). That pattern drifted on every release; now the
+-- packaged file stays canonical and only the genuine hertz-specifics live
+-- here.
+
+local server, run = ...
+
+-- Local helpers — single-host scoped, not worth lifting into the packaged lib.
+local function read_file_raw(path)
+    local f = io.open(path, 'r')
+    if not f then return nil end
+    local c = f:read('*a'); f:close(); return c
+end
+
+local function farad(cmd, timeout)
+    return run("incus exec farad -- sh -c " .. string.format("%q", cmd),
+        timeout or 15)
+end
+
+-- ---- LXD tools ----
+
+server:tool("incus_exec", "Execute a command inside an Incus container on hertz.", {
+    type = "object",
+    properties = {
+        container = { type = "string", description = "Container name" },
+        command   = { type = "string", description = "Command to execute" },
+        timeout   = { type = "integer", default = 30 },
+    },
+    required = { "container", "command" },
+}, function(a)
+    return run(string.format("incus exec %s -- sh -c %q",
+        a.container:gsub("[^%w%-]", ""), a.command), a.timeout or 30)
+end)
+
+server:tool("incus_list", "List all Incus containers on hertz.",
+    { type = "object" },
+    function() return run("incus list -c ns4 -f csv", 10) end)
+
+-- ---- Fritz!Box tools ----
+
+server:tool("fritz", "Execute Fritz!Box TR-064 command (info, hosts, wan, "
+    .. "wol <mac>, reconnect, reboot, reboot-repeater <ip>, routes, route-add, "
+    .. "route-del, services, actions, call).",
+    {
+        type = "object",
+        properties = {
+            command = { type = "string", description = "fritz subcommand and args" },
+        },
+        required = { "command" },
+    },
+    function(a) return run("sudo /root/.local/bin/fritz " .. a.command, 15) end)
+
+-- ---- Network tools ----
+
+server:tool("ping_host", "Check if a host is reachable (1 ICMP ping, 2s timeout).", {
+    type = "object",
+    properties = { host = { type = "string" } },
+    required = { "host" },
+}, function(a)
+    local host = a.host:gsub("[^%w%.%-:]", "")
+    return run("ping -c1 -W2 " .. host, 5)
+end)
+
+server:tool("network_status",
+    "Check reachability of all infrastructure hosts and MCP endpoints.",
+    { type = "object" },
+    function()
+        local script = [[
+hosts="hertz:localhost boltzmann:boltzmann tesla:tesla data:192.168.88.30 broglie:192.168.88.160 higgs:10.170.16.10"
+for entry in $hosts; do
+    name="${entry%%:*}"
+    ip="${entry#*:}"
+    if ping -c1 -W2 "$ip" >/dev/null 2>&1; then
+        status="UP"
+        if [ "$name" != "data" ]; then
+            if timeout 3 bash -c "echo >/dev/tcp/${ip}/8080" 2>/dev/null; then
+                status="UP (MCP ok)"
+            else
+                status="UP (no MCP)"
+            fi
+        fi
+    else
+        status="DOWN"
+    fi
+    printf "%-12s %-20s %s\n" "$name" "$ip" "$status"
+done
+]]
+        return run(script, 30)
+    end)
+
+server:tool("wol_and_wait",
+    "Wake the data server via Fritz!Box WoL and wait until it (or broglie MCP) is reachable.",
+    {
+        type = "object",
+        properties = {
+            mac          = { type = "string",  default = "", description = "MAC address (auto-detected if empty)" },
+            wait_for_mcp = { type = "boolean", default = true, description = "Wait for broglie MCP instead of just ping" },
+            timeout      = { type = "integer", default = 120 },
+        },
+    },
+    function(a)
+        local mac = a.mac
+        if not mac or mac == "" then
+            local hosts_out = run("sudo /root/.local/bin/fritz hosts 2>/dev/null | grep -i 'data\\|192.168.88.30'", 10)
+            mac = hosts_out and hosts_out:match("(%x%x:%x%x:%x%x:%x%x:%x%x:%x%x)") or ""
+            if mac == "" then return "Error: could not detect MAC for data. Provide it manually." end
+        end
+        run("sudo /root/.local/bin/fritz wol " .. mac:gsub("[^%x:]", ""), 10)
+
+        local timeout = a.timeout or 120
+        local check
+        if a.wait_for_mcp == false then
+            check = "ping -c1 -W2 192.168.88.30"
+        else
+            check = "timeout 3 bash -c 'echo >/dev/tcp/192.168.88.160/8080'"
+        end
+        local target = (a.wait_for_mcp == false) and "data" or "broglie:8080"
+
+        local elapsed = 0
+        while elapsed < timeout do
+            os.execute("sleep 5")
+            elapsed = elapsed + 5
+            local rc = os.execute(check)
+            if rc == true or rc == 0 then
+                return string.format("WoL sent to %s. %s reachable after %ds.",
+                    mac, target, elapsed)
+            end
+        end
+        return string.format("WoL sent to %s but %s not reachable after %ds.",
+            mac, target, timeout)
+    end)
+
+-- ---- Proxmox fallback ----
+
+server:tool("pct_exec",
+    "Execute a command in a Proxmox CT on data (SSH fallback when broglie is down).",
+    {
+        type = "object",
+        properties = {
+            ctid    = { type = "string", description = "Container ID (e.g. 108, 165)" },
+            command = { type = "string" },
+            timeout = { type = "integer", default = 30 },
+        },
+        required = { "ctid", "command" },
+    },
+    function(a)
+        local ctid = a.ctid:gsub("[^%d]", "")
+        return run(string.format("ssh -o ConnectTimeout=5 root@data 'pct exec %s -- sh -c %q'",
+            ctid, a.command), a.timeout or 30)
+    end)
+
+-- ---- Home Assistant ----
+
+server:tool("ha_cli",
+    "Run Home Assistant CLI command inside farad (e.g. 'core restart', 'backups list', 'info').",
+    {
+        type = "object",
+        properties = {
+            command  = { type = "string", description = "ha subcommand, e.g. 'core restart', 'supervisor info', 'backups list'" },
+            raw_json = { type = "boolean", default = false, description = "Return raw JSON output" },
+        },
+        required = { "command" },
+    },
+    function(a)
+        local flags = a.raw_json and " --raw-json" or ""
+        return farad("ha " .. a.command .. flags)
+    end)
+
+server:tool("ha_api",
+    "Call Home Assistant Core REST API. Requires token in /opt/lmcp/ha_token on hertz.",
+    {
+        type = "object",
+        properties = {
+            method   = { type = "string", default = "GET" },
+            endpoint = { type = "string", description = "/api/states, /api/services/climate/set_temperature, etc." },
+            body     = { type = "string", description = "JSON body for POST" },
+        },
+        required = { "endpoint" },
+    },
+    function(a)
+        local token = read_file_raw("/opt/lmcp/ha_token")
+        if not token or token == "" then
+            return "Error: no HA token. Create a long-lived token in HA UI → Profile → "
+                .. "Long-Lived Access Tokens, then: echo '<token>' | sudo tee /opt/lmcp/ha_token"
+        end
+        token = token:gsub("%s+", "")
+        local method = (a.method or "GET"):upper()
+        local cmd = string.format(
+            "curl -sf -X %s -H 'Authorization: Bearer %s' -H 'Content-Type: application/json'",
+            method, token)
+        if a.body and a.body ~= "" then
+            cmd = cmd .. " -d " .. string.format("'%s'", a.body:gsub("'", "'\\''"))
+        end
+        cmd = cmd .. " http://localhost:8123" .. a.endpoint
+        return farad(cmd, 15)
+    end)
+
+-- ---- MQTT (Eurotronic thermostats + general) ----
+
+server:tool("mqtt_pub", "Publish an MQTT message (via Mosquitto in farad).", {
+    type = "object",
+    properties = {
+        topic   = { type = "string" },
+        message = { type = "string" },
+        retain  = { type = "boolean", default = false },
+    },
+    required = { "topic", "message" },
+}, function(a)
+    local retain = a.retain and "-r " or ""
+    return farad(string.format("mosquitto_pub %s-t '%s' -m '%s'",
+        retain, a.topic:gsub("'", "'\\''"), a.message:gsub("'", "'\\''")))
+end)
+
+server:tool("mqtt_sub",
+    "Subscribe to MQTT topics and collect messages (via Mosquitto in farad).",
+    {
+        type = "object",
+        properties = {
+            topic   = { type = "string",  description = "Topic pattern, e.g. 'eurotronic/#' or '#'" },
+            count   = { type = "integer", default = 10, description = "Number of messages to collect" },
+            timeout = { type = "integer", default = 5,  description = "Seconds to wait" },
+            verbose = { type = "boolean", default = true, description = "Show topics with messages" },
+        },
+        required = { "topic" },
+    },
+    function(a)
+        local v = a.verbose ~= false and "-v " or ""
+        return farad(string.format("mosquitto_sub %s-t '%s' -C %d -W %d",
+            v, a.topic:gsub("'", "'\\''"), a.count or 10, a.timeout or 5),
+            (a.timeout or 5) + 5)
+    end)
+
+-- ---- Mediagrab (kids show downloader) ----
+
+server:tool("mediagrab",
+    "Manage kids show downloads in doppler container. Commands: list, weekly, "
+    .. "archive, test <url>, add '<json>'",
+    {
+        type = "object",
+        properties = {
+            command = { type = "string", description = "Command: list, weekly, archive, 'test <url>', 'add <json>'" },
+        },
+        required = { "command" },
+    },
+    function(a)
+        return run("incus exec doppler -- python3 /opt/mediagrab/mediagrab.py "
+            .. a.command, 120)
+    end)

tools.d/nash.lua

@@ -0,0 +1,103 @@
+-- /opt/lmcp/tools.d/nash.lua -- nash shared memory tools
+--
+-- Provides add/search/list/delete tools for the nash memory service.
+-- Requires NASH_URL env var (e.g. http://192.168.88.143:8000).
+-- When unset, tools return an error guiding the user to set it.
+--
+-- SPDX-License-Identifier: MIT
+
+local server, run = ...
+
+local function nash_url()
+    local url = os.getenv("NASH_URL")
+    if not url or url == "" then return nil end
+    return url:gsub("/+$", "")
+end
+
+local function curl_json(url, method, body, timeout)
+    timeout = timeout or 10
+    local out = "/tmp/lmcp-nash-" .. os.time() .. "-" .. math.random(10000, 99999) .. ".json"
+    local fmt = "http_code=%{http_code}"
+    local cmd
+    if body then
+        local tmp = out .. ".req"
+        local f = io.open(tmp, "w")
+        if f then f:write(body); f:close() end
+        cmd = string.format(
+            "curl -sS -X %s --max-time %d -H 'Content-Type: application/json' --data-binary '@%s' -o '%s' -w '%s' '%s'",
+            method, timeout, tmp, out, fmt, url
+        )
+        os.execute("rm -f '" .. tmp .. "' 2>/dev/null")
+    else
+        cmd = string.format(
+            "curl -sS -X %s --max-time %d -o '%s' -w '%s' '%s'",
+            method, timeout, out, fmt, url
+        )
+    end
+    local raw = run(cmd, timeout + 5) or ""
+    local http_code = tonumber(raw:match("(%d+)$")) or 0
+    local body_out = ""
+    local f = io.open(out, "r")
+    if f then body_out = f:read("*a") or ""; f:close() end
+    os.execute("rm -f '" .. out .. "' 2>/dev/null")
+    return body_out, http_code
+end
+
+server:tool("nash_add", "Store a text entry in shared nash memory.", {
+    type = "object",
+    properties = {
+        text = { type = "string", description = "Text content to remember" },
+    },
+    required = { "text" },
+}, function(a)
+    local base = nash_url()
+    if not base then return "Error: set NASH_URL env var (e.g. http://192.168.88.143:8000)" end
+    local json, code = curl_json(base .. "/add", "POST", '{"text":' .. require("json").encode(a.text) .. '}')
+    if code ~= 200 then return "Error: nash API HTTP " .. code .. ": " .. json end
+    return json
+end)
+
+server:tool("nash_search", "Semantic search across shared nash memory.", {
+    type = "object",
+    properties = {
+        query = { type = "string", description = "Search query" },
+        limit = { type = "integer", description = "Max results (default 5)", default = 5 },
+    },
+    required = { "query" },
+}, function(a)
+    local base = nash_url()
+    if not base then return "Error: set NASH_URL env var (e.g. http://192.168.88.143:8000)" end
+    local body = '{"query":' .. require("json").encode(a.query) .. ',"limit":' .. (a.limit or 5) .. '}'
+    local json, code = curl_json(base .. "/search", "POST", body)
+    if code ~= 200 then return "Error: nash API HTTP " .. code .. ": " .. json end
+    return json
+end)
+
+server:tool("nash_list", "List all entries in shared nash memory.", {
+    type = "object",
+    properties = {
+        limit = { type = "integer", description = "Max results (default 100)", default = 100 },
+    },
+}, function(a)
+    local base = nash_url()
+    if not base then return "Error: set NASH_URL env var (e.g. http://192.168.88.143:8000)" end
+    local body = '{"limit":' .. (a.limit or 100) .. '}'
+    local json, code = curl_json(base .. "/scroll", "POST", body)
+    if code ~= 200 then return "Error: nash API HTTP " .. code .. ": " .. json end
+    return json
+end)
+
+server:tool("nash_delete", "Delete an entry from shared nash memory by ID.", {
+    type = "object",
+    properties = {
+        id = { type = "string", description = "Entry ID to delete" },
+    },
+    required = { "id" },
+}, function(a)
+    local base = nash_url()
+    if not base then return "Error: set NASH_URL env var (e.g. http://192.168.88.143:8000)" end
+    local body = '{"id":' .. require("json").encode(a.id) .. '}'
+    local json, code = curl_json(base .. "/delete", "POST", body)
+    if code ~= 200 then return "Error: nash API HTTP " .. code .. ": " .. json end
+    return json
+end)