The keeper can say a word at a table through the keeper's door, signed as the keeper and heard whether or not the gallery may talk, so a call answered too late, after the game began, can still be answered; <slug>-say.sh sends it

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0141G6xqLeNRYEtviLWSB5Up

template/deploy/README.md

@@ -55,6 +55,9 @@ runs every game's rollup and backup from /etc/cron.d/gamehall.
 - `__SLUG__-visitors.sh [day]`: who is here now and who came that day.
 - `__SLUG__-reseat.sh ROOM [SEAT]`: who sits at a table; with a seat, a new
   token for a player locked out of it, as a link to send them.
+- `__SLUG__-say.sh ROOM "text"`: a word from the keeper in a table's talk,
+  signed as the keeper, through the same door; it is heard whether or not
+  the gallery may talk, so a call that came too late can be answered.
 - `__SLUG__-pulse.sh`: the weekly health check (service, errors, rollup
   trend, backup, box).
 - `__SLUG__-rollup.sh [day]`: one JSON line per day of counts, run

template/deploy/__SLUG__-say.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# A word from the keeper in a table's talk, signed as the keeper, whether or
+# not the host lets the gallery talk: the answer to a call that came too late,
+# or anything else the table should hear from the keeper. Runs ON the droplet,
+# through the game server's keeper door.
+#   __SLUG__-say.sh ROOM "text"
+set -euo pipefail
+ROOM="${1:?usage: __SLUG__-say.sh ROOM \"text\"}"
+TEXT="${2:?usage: __SLUG__-say.sh ROOM \"text\"}"
+DOOR="http://127.0.0.1:__PORT__/keeper/rooms/${ROOM^^}"
+[ -s /etc/__SLUG__/keeper.key ] || { echo "No keeper's key at /etc/__SLUG__/keeper.key; a deploy makes it." >&2; exit 1; }
+# The key goes as a header read from a file descriptor, never on a command line another user could see.
+KEY="@/dev/fd/3"
+exec 3< <(printf 'x-keeper-key: %s\n' "$(cat /etc/__SLUG__/keeper.key)")
+BODY=$(TEXT="$TEXT" python3 -c 'import json, os; print(json.dumps({"text": os.environ["TEXT"]}))')
+CODE=$(curl -s -o /tmp/__SLUG__-say.$$ -w '%{http_code}' -X POST -H "$KEY" -H 'content-type: application/json' -d "$BODY" "$DOOR/say")
+if [ "$CODE" = 204 ]; then echo "said at ${ROOM^^}"; else cat /tmp/__SLUG__-say.$$ >&2; echo >&2; rm -f /tmp/__SLUG__-say.$$; exit 1; fi
+rm -f /tmp/__SLUG__-say.$$

template/deploy/deploy.sh

@@ -43,6 +43,7 @@ ssh "root@$HOST" '
   install -m 755 /opt/__SLUG__/app/deploy/__SLUG__-rollup.sh /usr/local/bin/__SLUG__-rollup.sh
   install -m 755 /opt/__SLUG__/app/deploy/__SLUG__-backup.sh /usr/local/bin/__SLUG__-backup.sh
   install -m 755 /opt/__SLUG__/app/deploy/__SLUG__-reseat.sh /usr/local/bin/__SLUG__-reseat.sh
+  install -m 755 /opt/__SLUG__/app/deploy/__SLUG__-say.sh /usr/local/bin/__SLUG__-say.sh
   # The key to the keeper door: made once, readable by root (the reseat script) and the game user (the server) alone.
   if [ ! -s /etc/__SLUG__/keeper.key ]; then
     install -d -m 750 -o root -g __SLUG__ /etc/__SLUG__