the rendered meta flake pins each agent config by forge URL at its forge main

hive-c0re/src/lifecycle/git.rs

@@ -128,6 +128,42 @@ pub async fn git_rev_parse(dir: &Path, refname: &str) -> Result<String> {
     Ok(String::from_utf8_lossy(&out.stdout).trim().to_owned())
 }
 
+/// The contents of `path` at commit `rev` in `dir`, `None` when `rev` has no
+/// such file. Reads the object database, not the working tree.
+pub async fn git_show_file(dir: &Path, rev: &str, path: &str) -> Result<Option<String>> {
+    let spec = format!("{rev}:{path}");
+    let listed = git_command()
+        .current_dir(dir)
+        .args(["ls-tree", "--name-only", rev, "--", path])
+        .output()
+        .await
+        .with_context(|| format!("git ls-tree {spec} in {}", dir.display()))?;
+    if !listed.status.success() {
+        bail!(
+            "git ls-tree {spec} failed ({}): {}",
+            listed.status,
+            String::from_utf8_lossy(&listed.stderr).trim()
+        );
+    }
+    if listed.stdout.iter().all(u8::is_ascii_whitespace) {
+        return Ok(None);
+    }
+    let shown = git_command()
+        .current_dir(dir)
+        .args(["show", &spec])
+        .output()
+        .await
+        .with_context(|| format!("git show {spec} in {}", dir.display()))?;
+    if !shown.status.success() {
+        bail!(
+            "git show {spec} failed ({}): {}",
+            shown.status,
+            String::from_utf8_lossy(&shown.stderr).trim()
+        );
+    }
+    Ok(Some(String::from_utf8_lossy(&shown.stdout).into_owned()))
+}
+
 /// Plant a lightweight tag at `target`. Errors if the tag already
 /// exists — we want loud failures on id reuse, not silent
 /// overwrites.

hive-c0re/src/lifecycle/mod.rs

@@ -9,7 +9,7 @@ mod tests;
 
 pub use git::{
     git, git_authed, git_command, git_command_authed, git_is_ancestor, git_read_tree_reset,
-    git_rev_parse, git_tag, git_update_ref, git_update_ref_cas,
+    git_rev_parse, git_show_file, git_tag, git_update_ref, git_update_ref_cas,
 };
 pub use host_config::{hand_permissions, write_dropins};
 pub use setup::{
@@ -335,6 +335,7 @@ async fn agents_for_meta(name_to_add: Option<&str>) -> Result<Vec<crate::meta::A
             Some(crate::meta::AgentSpec {
                 port: agent_web_port(&name),
                 archetype: archetypes.get(&name).cloned(),
+                pin: None,
                 name,
             })
         })
@@ -345,6 +346,7 @@ async fn agents_for_meta(name_to_add: Option<&str>) -> Result<Vec<crate::meta::A
         out.push(crate::meta::AgentSpec {
             port: agent_web_port(extra),
             archetype: archetypes.get(extra).cloned(),
+            pin: None,
             name: extra.to_owned(),
         });
     }