Update weather skill to use new weatherflow api

home/.agents/skills/weather/scripts/weather-day

@@ -17,9 +17,9 @@
 set -euo pipefail
 
 STATION_ID=173994
-API_KEY=6bff2f89-84ab-463c-886e-fc0f443da4cf
+API_KEY=b29d10d0-6e40-44a5-869d-f7af76072b6b
 API_BASE=https://swd.weatherflow.com/swd/rest
-BUILD=169
+BUILD=181
 
 # Everything below the high/low is an integral, and an integral fails quietly: a
 # wrong high looks wrong, a wrong degree-day total looks like a number. So this
@@ -56,6 +56,17 @@ MAX_GAP_SECONDS=3600
 ORIGIN=https://tempestwx.com
 USER_AGENT='Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0'
 
+# Since build ~181 the API also wants `token`, a Firebase ID token. The web app
+# gets one from firebase.auth().signInAnonymously() on public station pages; this
+# is the REST form of that call, with the `apiKey` from the Firebase config in the
+# tempestwx.com main.js bundle. The key is referrer-restricted, so the Referer is
+# required — without it Google answers 403 API_KEY_HTTP_REFERRER_BLOCKED. Tokens
+# last an hour, far longer than one run, so a fresh one per run is enough.
+#
+# Also reaches identitytoolkit.googleapis.com, which needs the same squid.conf
+# allowance as swd.weatherflow.com.
+FIREBASE_API_KEY=AIzaSyA8aLVHWe7TVmctOXXVXYTl4pnzTgUydG4
+
 if [ $# -gt 1 ]; then
   echo 'usage: weather-day [YYYY-MM-DD]   (default: yesterday)' >&2
   exit 2
@@ -96,6 +107,7 @@ tempest_get() {
     -H "Origin: ${ORIGIN}" \
     --data-urlencode "api_key=${API_KEY}" \
     --data-urlencode "build=${BUILD}" \
+    --data-urlencode "token=${TOKEN}" \
     "${@:2}")
   code=${resp##*$'\n'}
   json=${resp%$'\n'*}
@@ -108,6 +120,18 @@ tempest_get() {
   printf '%s' "$json"
 }
 
+signup=$(curl -sS -X POST \
+  "https://identitytoolkit.googleapis.com/v1/accounts:signUp?key=${FIREBASE_API_KEY}" \
+  -H 'Content-Type: application/json' \
+  -H "Referer: ${ORIGIN}/" \
+  -d '{"returnSecureToken":true}')
+TOKEN=$(printf '%s' "$signup" | jq -r '.idToken // empty')
+if [ -z "$TOKEN" ]; then
+  echo "weather-day: anonymous Firebase sign-in failed" >&2
+  echo "  $(printf '%s' "$signup" | jq -c '.error // .' 2>/dev/null || printf '%s' "$signup")" >&2
+  exit 1
+fi
+
 # A station has one ST (Tempest) device and usually an HB (hub) alongside it; only
 # the ST reports weather.
 locations=$(tempest_get "locations/${STATION_ID}" --data-urlencode 'include_arbitrary_locations=true')

home/.config/fish/functions/dev-app.fish

@@ -4,7 +4,9 @@ function dev-app -d "Run a checkout's Obsidian dev app on voyager, shown here th
   if test -n "$argv[1]"
     set checkout /tachi/code/obsidian/obsidian.worktrees/$argv[1]
   end
-  # One quoted string, so voyager's login shell runs it whole. ods exec app
+  # waypipe execs the remote command directly, and ssh flattens it into one
-  # starts Electron as a Wayland client with the checkout's own user data.
+  # string for voyager's shell, so a shell builtin like cd or && can't be used.
-  waypipe --compress zstd ssh voyager "cd $checkout && ods exec app"
+  # env -C sets the working directory instead. ods exec app starts Electron as
+  # a Wayland client with the checkout's own user data.
+  waypipe --compress zstd ssh voyager env -C $checkout ods exec app
 end