The keeper can say a word at a table through the keeper's door, signed as the keeper and heard whether or not the gallery may talk, so a call answered too late, after the duel began, can still be answered; waving-hands-say.sh sends it

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0141G6xqLeNRYEtviLWSB5Up

deploy/README.md

@@ -57,6 +57,9 @@ A fresh host, when one is needed: `doctl compute droplet create hall --region ny
   through the duel server's `/keeper` door, which Caddy does not proxy and
   which asks for the key in /etc/waving-hands/keeper.key, made by the deploy
   and readable by root and the waving-hands user alone.
+- `waving-hands-say.sh ROOM "text"`: a word from the keeper in a table's
+  talk, signed as the keeper, through the same door; it is heard whether or
+  not the gallery may talk, so a call that came too late can be answered.
 - `waving-hands-pulse.sh`: the weekly health check (service, errors, rollup
   trend, backup, box).
 - `waving-hands-rollup.sh [day]`: one JSON line per day of counts, run

deploy/deploy.sh

@@ -44,6 +44,7 @@ ssh "root@$HOST" '
   install -m 755 /opt/waving-hands/app/deploy/waving-hands-rollup.sh /usr/local/bin/waving-hands-rollup.sh
   install -m 755 /opt/waving-hands/app/deploy/waving-hands-backup.sh /usr/local/bin/waving-hands-backup.sh
   install -m 755 /opt/waving-hands/app/deploy/waving-hands-reseat.sh /usr/local/bin/waving-hands-reseat.sh
+  install -m 755 /opt/waving-hands/app/deploy/waving-hands-say.sh /usr/local/bin/waving-hands-say.sh
   # The key to the keeper door: made once, readable by root (the reseat script) and the game user (the server) alone.
   if [ ! -s /etc/waving-hands/keeper.key ]; then
     install -d -m 750 -o root -g waving-hands /etc/waving-hands

deploy/waving-hands-say.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# A word from the keeper in a table's talk, signed as the keeper, whether or
+# not the host lets the gallery talk: the answer to a call that came too late,
+# or anything else the table should hear from the keeper. Runs ON the droplet,
+# through the duel server's keeper door.
+#   waving-hands-say.sh ROOM "text"
+set -euo pipefail
+ROOM="${1:?usage: waving-hands-say.sh ROOM \"text\"}"
+TEXT="${2:?usage: waving-hands-say.sh ROOM \"text\"}"
+DOOR="http://127.0.0.1:8788/keeper/rooms/${ROOM^^}"
+[ -s /etc/waving-hands/keeper.key ] || { echo "No keeper's key at /etc/waving-hands/keeper.key; a deploy makes it." >&2; exit 1; }
+# The key goes as a header read from a file descriptor, never on a command line another user could see.
+KEY="@/dev/fd/3"
+exec 3< <(printf 'x-keeper-key: %s\n' "$(cat /etc/waving-hands/keeper.key)")
+BODY=$(TEXT="$TEXT" python3 -c 'import json, os; print(json.dumps({"text": os.environ["TEXT"]}))')
+CODE=$(curl -s -o /tmp/waving-hands-say.$$ -w '%{http_code}' -X POST -H "$KEY" -H 'content-type: application/json' -d "$BODY" "$DOOR/say")
+if [ "$CODE" = 204 ]; then echo "said at ${ROOM^^}"; else cat /tmp/waving-hands-say.$$ >&2; echo >&2; rm -f /tmp/waving-hands-say.$$; exit 1; fi
+rm -f /tmp/waving-hands-say.$$